| claude_code_oauth_token | Claude Code OAuth token | no | "" |
| anthropic_api_key | Anthropic API key (alternative to OAuth token) | no | "" |
| use_bedrock | Use Amazon Bedrock with OIDC authentication | no | false |
| use_vertex | Use Google Vertex AI with OIDC authentication | no | false |
| use_foundry | Use Microsoft Foundry with OIDC authentication | no | false |
| custom_github_token | GitHub token for API access. If omitted, claude-code-action uses Claude GitHub App token (claude[bot]). Provide explicitly to use a custom token or github.token instead. Named custom_github_token to avoid the reserved github_token input name. | no | "" |
| allowed_bots | Comma-separated list of allowed bot usernames, or '*' to allow all bots. Defaults to '*' because bots are not inherently more dangerous than humans. | no | * |
| allowed_non_write_users | Comma-separated list of users without write permission who are allowed to trigger Claude, or '*' to allow all. Only works when custom_github_token is provided. Enables bubblewrap sandbox and env scrubbing for safety. | no | "" |
| include_comments_by_actor | Filter to include only comments from specific actors. Supports wildcards (e.g. '*[bot]'). Empty means include all. | no | "" |
| exclude_comments_by_actor | Filter to exclude comments from specific actors. Supports wildcards. Exclusion takes precedence over inclusion. | no | "" |
| additional_permissions | Additional GitHub permissions for the App token (newline-separated 'key: value'). Example: 'actions: read' enables CI/CD failure analysis. Only effective with OIDC token exchange (ignored when custom_github_token is set). | no | "" |
| settings | Claude Code settings as a JSON string or path to a JSON file. Merged with existing settings (input takes precedence). Can configure hooks, env, MCP settings, etc. | no | "" |
| model | Claude model to use | no | opus |
| effort | Reasoning effort level for the top-level orchestrator session (low, medium, high, xhigh, max). The kyosei skill itself only dispatches reviewer subagents and posts JSON, so a lower level reduces cost and latency without affecting review quality. Reviewer subagents have their own `effort: high` in agent frontmatter, which overrides this session-level value per Claude Code's agent fields spec. Set to an empty string to omit the flag and use the model default. | no | medium |
| allowed_tools | Allowed tools for Claude Code (newline-separated, replaces the default set below). The default is limited to read-only, non-destructive tools; posting reviews is handled by the kyosei skill itself, not directly by Claude. List each GitHub MCP tool individually as `mcp__github__<tool_name>`, because claude-code-action only starts the GitHub MCP server when a tool name begins with `mcp__github__` (the bare `mcp__github` prefix does not work). The default also allows what the bundled plugins need: the `Agent` tool and the MCP servers used by the research survey agent (`mcp__backlog__*`, `mcp__plugin_nix-tasuke_nixos`, `mcp__plugin_research_*`). The `mcp__plugin_*` servers ship with the bundled plugins and work out of the box. Backlog (`mcp__backlog__*`) is not bundled, so it only works if you configure the Backlog MCP server yourself (for example via `.mcp.json`). | no | Agent
Bash(awk:*)
Bash(gh issue list:*)
Bash(gh issue status:*)
Bash(gh issue view:*)
Bash(gh label list:*)
Bash(gh label view:*)
Bash(gh pr checks:*)
Bash(gh pr diff:*)
Bash(gh pr list:*)
Bash(gh pr status:*)
Bash(gh pr view:*)
Bash(gh release list:*)
Bash(gh release view:*)
Bash(gh repo view:*)
Bash(gh ruleset list:*)
Bash(gh ruleset view:*)
Bash(gh run list:*)
Bash(gh run view:*)
Bash(gh search:*)
Bash(gh status:*)
Bash(gh workflow list:*)
Bash(gh workflow view:*)
Bash(git blame:*)
Bash(git cat-file:*)
Bash(git describe:*)
Bash(git diff:*)
Bash(git for-each-ref:*)
Bash(git log:*)
Bash(git ls-files:*)
Bash(git ls-remote:*)
Bash(git ls-tree:*)
Bash(git rev-list:*)
Bash(git rev-parse:*)
Bash(git shortlog:*)
Bash(git show-branch:*)
Bash(git show:*)
Bash(git status:*)
Bash(jq:*)
Bash(node:*)
Glob
Grep
Read
Skill
Task
TodoWrite
WebFetch
WebSearch
mcp__backlog__get_issue
mcp__backlog__get_issue_comments
mcp__backlog__get_issues
mcp__backlog__get_myself
mcp__backlog__get_notifications
mcp__backlog__get_project
mcp__backlog__get_project_list
mcp__backlog__get_pull_request
mcp__backlog__get_pull_requests
mcp__backlog__get_wiki
mcp__backlog__get_wiki_pages
mcp__github__get_code_scanning_alert
mcp__github__get_commit
mcp__github__get_dependabot_alert
mcp__github__get_discussion
mcp__github__get_discussion_comments
mcp__github__get_file_contents
mcp__github__get_issue
mcp__github__get_issue_comments
mcp__github__get_job_logs
mcp__github__get_label
mcp__github__get_latest_release
mcp__github__get_me
mcp__github__get_pull_request
mcp__github__get_pull_request_diff
mcp__github__get_pull_request_files
mcp__github__get_pull_request_review_comments
mcp__github__get_pull_request_reviews
mcp__github__get_pull_request_status
mcp__github__get_release_by_tag
mcp__github__get_secret_scanning_alert
mcp__github__get_tag
mcp__github__get_team_members
mcp__github__get_teams
mcp__github__get_workflow_run
mcp__github__issue_read
mcp__github__list_branches
mcp__github__list_code_scanning_alerts
mcp__github__list_commits
mcp__github__list_dependabot_alerts
mcp__github__list_discussion_categories
mcp__github__list_discussions
mcp__github__list_issue_types
mcp__github__list_issues
mcp__github__list_pull_requests
mcp__github__list_releases
mcp__github__list_secret_scanning_alerts
mcp__github__list_sub_issues
mcp__github__list_tags
mcp__github__list_workflow_jobs
mcp__github__list_workflow_runs
mcp__github__list_workflows
mcp__github__pull_request_read
mcp__github__search_code
mcp__github__search_issues
mcp__github__search_pull_requests
mcp__github__search_repositories
mcp__github__search_users
mcp__plugin_nix-tasuke_nixos
mcp__plugin_research_cloudflare
mcp__plugin_research_context7
mcp__plugin_research_deepwiki
mcp__plugin_research_mdn
mcp__plugin_research_microsoft-learn
|
| additional_allowed_tools | Additional allowed tools to append to allowed_tools (newline-separated) | no | "" |
| claude_args | Additional arguments to pass to Claude CLI (appended after --model and --allowed-tools) | no | "" |
| include_fix_links | Include 'Fix this' deep links in PR review feedback | no | true |
| display_report | Display Claude Code Report in GitHub Step Summary. Useful for understanding what Claude did during the review. "auto" (default) enables it only for private repositories. "always" enables it regardless of repository visibility. "never" disables it entirely. "true"/"false" are accepted as aliases for backward compatibility. | no | auto |
| show_full_output | Show full Claude Code JSON output in Actions logs. May contain secrets in tool results; use only for debugging. Ignored on public repositories to prevent secret leakage. | no | false |
| marketplace_url | Git URL of the plugin marketplace | no | https://github.com/ncaq/konoka.git |
| plugin_name | Plugin identifier within the marketplace (newline-separated for multiple) | no | kyosei@konoka
research@konoka |
| self_hosted_packages | Newline-separated list of packages to install via apt-get on self-hosted runners. Installation runs only when the runner is self-hosted and apt-get is available. Set to an empty string to skip installation entirely. | no | curl
gawk
gh
git
jq
zstd
|