actions/claude-code-action
1
0
Fork 0
mirror of https://github.com/anthropics/claude-code-action.git synced 2026-07-27 22:38:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

Use workload identity federation for Claude auth in CI workflows (#1344)

Browse Source 
Switch claude.yml, claude-review.yml, and issue-triage.yml from the
anthropic_api_key secret to the workload identity federation inputs.
The federation rule, organization, and service account IDs are read
from repository variables; issue-triage.yml additionally gains the
id-token: write permission required to request the OIDC token.
This commit is contained in:
Ashwin Bhat 2026-05-22 15:46:06 -07:00 committed by GitHub
parent bbfaf8e1ff
commit 4257c8e059
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 21 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
.github/workflows/claude-review.yml vendored
View File

@ -20,7 +20,12 @@ jobs:
- name: PR Review with Progress Tracking - name: PR Review with Progress Tracking
uses: anthropics/claude-code-action@v1 uses: anthropics/claude-code-action@v1
with: with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} # Authenticate to the Claude API via Workload Identity Federation
# (the workflow's OIDC token is exchanged for a short-lived access
# token) instead of a static API key. See docs/setup.md.
anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
prompt: "/review-pr REPO: ${{ github.repository }} PR_NUMBER: ${{ github.event.pull_request.number }}" prompt: "/review-pr REPO: ${{ github.repository }} PR_NUMBER: ${{ github.event.pull_request.number }}"
claude_args: | claude_args: |

7
.github/workflows/claude.yml vendored
View File

@ -33,7 +33,12 @@ jobs:
id: claude id: claude
uses: anthropics/claude-code-action@main uses: anthropics/claude-code-action@main
with: with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} # Authenticate to the Claude API via Workload Identity Federation
# (the workflow's OIDC token is exchanged for a short-lived access
# token) instead of a static API key. See docs/setup.md.
anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
claude_args: | claude_args: |
--allowedTools "Bash(bun install),Bash(bun test:*),Bash(bun run format),Bash(bun typecheck)" --allowedTools "Bash(bun install),Bash(bun test:*),Bash(bun run format),Bash(bun typecheck)"
--model "claude-opus-4-7" --model "claude-opus-4-7"

10
.github/workflows/issue-triage.yml vendored
View File

@ -11,6 +11,9 @@ jobs:
permissions: permissions:
contents: read contents: read
issues: write issues: write
# Required to mint the OIDC token that is exchanged for a Claude API
# access token (Workload Identity Federation).
id-token: write
steps: steps:
- name: Checkout repository - name: Checkout repository
@ -24,6 +27,11 @@ jobs:
CLAUDE_CODE_SCRIPT_CAPS: '{"edit-issue-labels.sh":2}' CLAUDE_CODE_SCRIPT_CAPS: '{"edit-issue-labels.sh":2}'
with: with:
prompt: "/label-issue REPO: ${{ github.repository }} ISSUE_NUMBER: ${{ github.event.issue.number }}" prompt: "/label-issue REPO: ${{ github.repository }} ISSUE_NUMBER: ${{ github.event.issue.number }}"
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} # Authenticate to the Claude API via Workload Identity Federation
# (the workflow's OIDC token is exchanged for a short-lived access
# token) instead of a static API key. See docs/setup.md.
anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
allowed_non_write_users: "*" # Required for issue triage workflow, if users without repo write access create issues allowed_non_write_users: "*" # Required for issue triage workflow, if users without repo write access create issues
github_token: ${{ secrets.GITHUB_TOKEN }} github_token: ${{ secrets.GITHUB_TOKEN }}