actions/claude-code-action
1
0
Fork 0
mirror of https://github.com/anthropics/claude-code-action.git synced 2026-08-22 03:18:54 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add workload identity federation support to base-action (#1378)

Browse Source 
* Add workload identity federation support to base-action

Move the workload identity module into base-action so the standalone
action can fetch and refresh the GitHub OIDC identity token itself, and
expose the same federation inputs as the outer action. Switch the
base-action test workflows from the anthropic_api_key secret to the
federation repo variables and grant them id-token: write.

* Verify MCP test tool invocation instead of init connection status

MCP servers can connect asynchronously, so the init event may report a
server as pending. Check that the server is registered at init, then
assert the test tool was actually called and returned its response.
Also pass the MCP config through claude_args --mcp-config, replacing the
removed mcp_config input.
This commit is contained in:
Ashwin Bhat
2026-06-02 11:52:23 -07:00
committed by GitHub
parent 7f37f2e373
commit 420335da51
15 changed files with 250 additions and 126 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/test-settings.yml
+19 -4
View File
@@ -5,6 +5,13 @@ on:
workflow_dispatch:
workflow_call:
# The Claude API is authenticated via workload identity federation: id-token
# lets the action mint the GitHub OIDC token it exchanges for a short-lived
# access token. See docs/setup.md.
permissions:
contents: read
id-token: write
jobs:
test-settings-inline-allow:
runs-on: ubuntu-latest
@@ -17,7 +24,9 @@ jobs:
with:
prompt: |
Use Bash to echo "Hello from settings test"
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
settings: |
{
"permissions": {
@@ -66,7 +75,9 @@ jobs:
with:
prompt: |
Run the command `echo $HOME` to check the home directory path
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
settings: |
{
"permissions": {
@@ -108,7 +119,9 @@ jobs:
with:
prompt: |
Use Bash to echo "Hello from settings file test"
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
settings: "test-settings.json"
- name: Verify echo worked
@@ -162,7 +175,9 @@ jobs:
with:
prompt: |
Run the command `echo $HOME` to check the home directory path
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
settings: "test-settings.json"
- name: Verify echo was denied