mirror of
https://github.com/anthropics/claude-code-action.git
synced 2026-08-22 03:18:54 +08:00
Add workload identity federation support to base-action (#1378)
* Add workload identity federation support to base-action Move the workload identity module into base-action so the standalone action can fetch and refresh the GitHub OIDC identity token itself, and expose the same federation inputs as the outer action. Switch the base-action test workflows from the anthropic_api_key secret to the federation repo variables and grant them id-token: write. * Verify MCP test tool invocation instead of init connection status MCP servers can connect asynchronously, so the init event may report a server as pending. Check that the server is registered at init, then assert the test tool was actually called and returned its response. Also pass the MCP config through claude_args --mcp-config, replacing the removed mcp_config input.
This commit is contained in:
Ashwin Bhat
@@ -1,120 +0,0 @@
|
||||
import { describe, it, expect, beforeEach, afterEach, mock } from "bun:test";
|
||||
import { retryWithBackoff } from "../src/utils/retry";
|
||||
|
||||
describe("retryWithBackoff", () => {
|
||||
let originalConsoleLog: typeof console.log;
|
||||
let originalConsoleError: typeof console.error;
|
||||
|
||||
beforeEach(() => {
|
||||
originalConsoleLog = console.log;
|
||||
originalConsoleError = console.error;
|
||||
console.log = mock(() => {});
|
||||
console.error = mock(() => {});
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
console.log = originalConsoleLog;
|
||||
console.error = originalConsoleError;
|
||||
});
|
||||
|
||||
it("returns the result on first success", async () => {
|
||||
const result = await retryWithBackoff(() => Promise.resolve("ok"), {
|
||||
maxAttempts: 3,
|
||||
initialDelayMs: 1,
|
||||
});
|
||||
expect(result).toBe("ok");
|
||||
});
|
||||
|
||||
it("retries on failure and succeeds", async () => {
|
||||
let attempt = 0;
|
||||
const result = await retryWithBackoff(
|
||||
() => {
|
||||
attempt++;
|
||||
if (attempt < 3) throw new Error("transient");
|
||||
return Promise.resolve("recovered");
|
||||
},
|
||||
{ maxAttempts: 3, initialDelayMs: 1 },
|
||||
);
|
||||
expect(result).toBe("recovered");
|
||||
expect(attempt).toBe(3);
|
||||
});
|
||||
|
||||
it("throws after exhausting all attempts", async () => {
|
||||
await expect(
|
||||
retryWithBackoff(() => Promise.reject(new Error("permanent")), {
|
||||
maxAttempts: 2,
|
||||
initialDelayMs: 1,
|
||||
}),
|
||||
).rejects.toThrow("permanent");
|
||||
});
|
||||
|
||||
it("stops retrying immediately when shouldRetry returns false", async () => {
|
||||
class NonRetryableError extends Error {
|
||||
constructor() {
|
||||
super("non-retryable");
|
||||
this.name = "NonRetryableError";
|
||||
}
|
||||
}
|
||||
|
||||
let attempts = 0;
|
||||
await expect(
|
||||
retryWithBackoff(
|
||||
() => {
|
||||
attempts++;
|
||||
throw new NonRetryableError();
|
||||
},
|
||||
{
|
||||
maxAttempts: 3,
|
||||
initialDelayMs: 1,
|
||||
shouldRetry: (error) => !(error instanceof NonRetryableError),
|
||||
},
|
||||
),
|
||||
).rejects.toThrow("non-retryable");
|
||||
expect(attempts).toBe(1);
|
||||
});
|
||||
|
||||
it("continues retrying when shouldRetry returns true", async () => {
|
||||
let attempts = 0;
|
||||
await expect(
|
||||
retryWithBackoff(
|
||||
() => {
|
||||
attempts++;
|
||||
throw new Error("retryable");
|
||||
},
|
||||
{
|
||||
maxAttempts: 3,
|
||||
initialDelayMs: 1,
|
||||
shouldRetry: () => true,
|
||||
},
|
||||
),
|
||||
).rejects.toThrow("retryable");
|
||||
expect(attempts).toBe(3);
|
||||
});
|
||||
|
||||
it("preserves the original error when shouldRetry aborts", async () => {
|
||||
class SpecificError extends Error {
|
||||
code = 401;
|
||||
constructor() {
|
||||
super("unauthorized");
|
||||
this.name = "SpecificError";
|
||||
}
|
||||
}
|
||||
|
||||
try {
|
||||
await retryWithBackoff(
|
||||
() => {
|
||||
throw new SpecificError();
|
||||
},
|
||||
{
|
||||
maxAttempts: 3,
|
||||
initialDelayMs: 1,
|
||||
shouldRetry: (error) => !(error instanceof SpecificError),
|
||||
},
|
||||
);
|
||||
expect.unreachable("should have thrown");
|
||||
} catch (error) {
|
||||
expect(error).toBeInstanceOf(SpecificError);
|
||||
expect((error as SpecificError).code).toBe(401);
|
||||
}
|
||||
});
|
||||
});
|
||||
@@ -1,127 +0,0 @@
|
||||
#!/usr/bin/env bun
|
||||
|
||||
import { describe, test, expect, beforeEach, afterEach, spyOn } from "bun:test";
|
||||
import * as core from "@actions/core";
|
||||
import { existsSync, mkdtempSync, readFileSync, rmSync, statSync } from "fs";
|
||||
import { tmpdir } from "os";
|
||||
import { join } from "path";
|
||||
import {
|
||||
isWorkloadIdentityConfigured,
|
||||
setupWorkloadIdentity,
|
||||
} from "../src/auth/workload-identity";
|
||||
|
||||
describe("workload identity federation", () => {
|
||||
let originalEnv: NodeJS.ProcessEnv;
|
||||
let tempDir: string;
|
||||
let getIDTokenSpy: ReturnType<typeof spyOn>;
|
||||
let warningSpy: ReturnType<typeof spyOn>;
|
||||
let setSecretSpy: ReturnType<typeof spyOn>;
|
||||
|
||||
beforeEach(() => {
|
||||
originalEnv = { ...process.env };
|
||||
tempDir = mkdtempSync(join(tmpdir(), "wif-test-"));
|
||||
process.env.RUNNER_TEMP = tempDir;
|
||||
delete process.env.ANTHROPIC_API_KEY;
|
||||
delete process.env.CLAUDE_CODE_OAUTH_TOKEN;
|
||||
delete process.env.ANTHROPIC_FEDERATION_RULE_ID;
|
||||
delete process.env.ANTHROPIC_ORGANIZATION_ID;
|
||||
delete process.env.ANTHROPIC_OIDC_AUDIENCE;
|
||||
delete process.env.ANTHROPIC_IDENTITY_TOKEN_FILE;
|
||||
|
||||
getIDTokenSpy = spyOn(core, "getIDToken").mockResolvedValue(
|
||||
"test-identity-token",
|
||||
);
|
||||
warningSpy = spyOn(core, "warning").mockImplementation(() => {});
|
||||
setSecretSpy = spyOn(core, "setSecret").mockImplementation(() => {});
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
process.env = originalEnv;
|
||||
getIDTokenSpy.mockRestore();
|
||||
warningSpy.mockRestore();
|
||||
setSecretSpy.mockRestore();
|
||||
rmSync(tempDir, { recursive: true, force: true });
|
||||
});
|
||||
|
||||
describe("isWorkloadIdentityConfigured", () => {
|
||||
test("returns false when no federation variables are set", () => {
|
||||
expect(isWorkloadIdentityConfigured()).toBe(false);
|
||||
});
|
||||
|
||||
test("returns false when only one federation variable is set", () => {
|
||||
process.env.ANTHROPIC_FEDERATION_RULE_ID = "fdrl_test";
|
||||
expect(isWorkloadIdentityConfigured()).toBe(false);
|
||||
});
|
||||
|
||||
test("returns true when rule ID and organization ID are set", () => {
|
||||
process.env.ANTHROPIC_FEDERATION_RULE_ID = "fdrl_test";
|
||||
process.env.ANTHROPIC_ORGANIZATION_ID =
|
||||
"00000000-0000-0000-0000-000000000000";
|
||||
expect(isWorkloadIdentityConfigured()).toBe(true);
|
||||
});
|
||||
});
|
||||
|
||||
describe("setupWorkloadIdentity", () => {
|
||||
test("returns undefined when federation is not configured", async () => {
|
||||
const handle = await setupWorkloadIdentity();
|
||||
expect(handle).toBeUndefined();
|
||||
expect(getIDTokenSpy).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
test("returns undefined and warns when an API key is also set", async () => {
|
||||
process.env.ANTHROPIC_FEDERATION_RULE_ID = "fdrl_test";
|
||||
process.env.ANTHROPIC_ORGANIZATION_ID =
|
||||
"00000000-0000-0000-0000-000000000000";
|
||||
process.env.ANTHROPIC_API_KEY = "sk-ant-test";
|
||||
|
||||
const handle = await setupWorkloadIdentity();
|
||||
expect(handle).toBeUndefined();
|
||||
expect(warningSpy).toHaveBeenCalled();
|
||||
expect(getIDTokenSpy).not.toHaveBeenCalled();
|
||||
expect(process.env.ANTHROPIC_IDENTITY_TOKEN_FILE).toBeUndefined();
|
||||
});
|
||||
|
||||
test("writes the identity token file and exports its path", async () => {
|
||||
process.env.ANTHROPIC_FEDERATION_RULE_ID = "fdrl_test";
|
||||
process.env.ANTHROPIC_ORGANIZATION_ID =
|
||||
"00000000-0000-0000-0000-000000000000";
|
||||
|
||||
const handle = await setupWorkloadIdentity();
|
||||
try {
|
||||
expect(handle).toBeDefined();
|
||||
expect(handle!.tokenFile).toBe(
|
||||
join(tempDir, "claude-workload-identity", "identity-token"),
|
||||
);
|
||||
expect(process.env.ANTHROPIC_IDENTITY_TOKEN_FILE).toBe(
|
||||
handle!.tokenFile,
|
||||
);
|
||||
expect(existsSync(handle!.tokenFile)).toBe(true);
|
||||
expect(readFileSync(handle!.tokenFile, "utf-8")).toBe(
|
||||
"test-identity-token",
|
||||
);
|
||||
expect(statSync(handle!.tokenFile).mode & 0o777).toBe(0o600);
|
||||
expect(setSecretSpy).toHaveBeenCalledWith("test-identity-token");
|
||||
// Default audience scopes the JWT to the Claude API token exchange
|
||||
expect(getIDTokenSpy).toHaveBeenCalledWith("https://api.anthropic.com");
|
||||
} finally {
|
||||
handle?.stop();
|
||||
}
|
||||
});
|
||||
|
||||
test("requests the configured audience", async () => {
|
||||
process.env.ANTHROPIC_FEDERATION_RULE_ID = "fdrl_test";
|
||||
process.env.ANTHROPIC_ORGANIZATION_ID =
|
||||
"00000000-0000-0000-0000-000000000000";
|
||||
process.env.ANTHROPIC_OIDC_AUDIENCE = "https://example.com/custom";
|
||||
|
||||
const handle = await setupWorkloadIdentity();
|
||||
try {
|
||||
expect(getIDTokenSpy).toHaveBeenCalledWith(
|
||||
"https://example.com/custom",
|
||||
);
|
||||
} finally {
|
||||
handle?.stop();
|
||||
}
|
||||
});
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user