Follow Discord
Sweep 22 Oct 2026 · 21:04Z Build v2.1.309 528 read Stable v2.1.308 Latest v2.1.309 Next v2.1.309 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeReleasesv2.1.239entry #162

Claude Code v2.1.239 ·

GitHub Actions input copies of secret variables are now scrubbed too

GitHub Actions INPUT_-prefixed copies of secret variables are now scrubbed too.

You'll notice Improvements
JSON All of v2.1.239
You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
Secret ScrubbingArea: what it touches
ImprovementsKind: in v2.1.239,
ImprovementsSection of the release
What

The list of environment variables Claude Code refuses to expose now also covers the INPUT_-prefixed copy of each one, which is the form GitHub Actions uses when a secret is passed in as a workflow input.

Details
  • The base list already included ANTHROPIC_AUTH_TOKEN, AWS_SESSION_TOKEN, ACTIONS_RUNTIME_TOKEN and SSH_SIGNING_KEY among others.
  • The prefixed names are built at runtime from the base list, so any future addition to the denylist is covered automatically.
Evidence

ACTIONS_RUNTIME_TOKEN

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.239 →

Feedback