actions/claude-code-action
1
0
Fork 0
mirror of https://github.com/anthropics/claude-code-action.git synced 2026-08-21 19:08:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add Workload Identity Federation (OIDC) authentication support (#1338)

Browse Source 
* Add workload identity federation auth support

Adds anthropic_federation_rule_id, anthropic_organization_id,
anthropic_service_account_id, anthropic_workspace_id, and
anthropic_oidc_audience inputs. When the federation rule and organization
are set, the action fetches the workflow's GitHub Actions OIDC token,
writes it to a file in RUNNER_TEMP, keeps it refreshed during execution,
and points the Claude Code CLI at it via ANTHROPIC_IDENTITY_TOKEN_FILE so
the CLI can exchange it for a short-lived access token instead of using a
static API key.

* Add WIF example workflow and base-action federation docs

* Default workload identity OIDC audience to https://api.anthropic.com
This commit is contained in:
Ashwin Bhat
2026-05-21 15:19:15 -07:00
committed by GitHub
parent c9d66afb17
commit 661a6fefbd
12 changed files with 486 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
base-action/src/validate-env.ts
+18 -4
View File
@@ -8,6 +8,14 @@ export function validateEnvironmentVariables() {
const useFoundry = process.env.CLAUDE_CODE_USE_FOUNDRY === "1";
const anthropicApiKey = process.env.ANTHROPIC_API_KEY;
const claudeCodeOAuthToken = process.env.CLAUDE_CODE_OAUTH_TOKEN;
const federationRuleId = process.env.ANTHROPIC_FEDERATION_RULE_ID;
const federationOrganizationId = process.env.ANTHROPIC_ORGANIZATION_ID;
const hasWorkloadIdentity = Boolean(
federationRuleId && federationOrganizationId,
);
const hasPartialWorkloadIdentity =
!hasWorkloadIdentity &&
Boolean(federationRuleId || federationOrganizationId);
const errors: string[] = [];
@@ -20,10 +28,16 @@ export function validateEnvironmentVariables() {
}
if (!useBedrock && !useVertex && !useFoundry) {
if (!anthropicApiKey && !claudeCodeOAuthToken) {
errors.push(
"Either ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN is required when using direct Anthropic API.",
);
if (!anthropicApiKey && !claudeCodeOAuthToken && !hasWorkloadIdentity) {
if (hasPartialWorkloadIdentity) {
errors.push(
"Workload identity federation requires both ANTHROPIC_FEDERATION_RULE_ID and ANTHROPIC_ORGANIZATION_ID to be set.",
);
} else {
errors.push(
"Either ANTHROPIC_API_KEY, CLAUDE_CODE_OAUTH_TOKEN, or workload identity federation (ANTHROPIC_FEDERATION_RULE_ID and ANTHROPIC_ORGANIZATION_ID) is required when using direct Anthropic API.",
);
}
}
} else if (useBedrock) {
const awsRegion = process.env.AWS_REGION;