* chore: bump actions/setup-node from v4.4.0 to v6.4.0 (Node.js 24)
setup-node v4 runs on the deprecated Node.js 20 action runtime, producing
a deprecation warning on every workflow run that uses base-action. v6 runs
on Node 24. This only changes the action's own runtime — the node-version
it installs for user code is unaffected.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Disable setup-node v5+ automatic package-manager caching
Preserves v4 behavior: caching only when use_node_cache=true.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: ant-kurt <209710463+ant-kurt@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* Add workload identity federation support to base-action
Move the workload identity module into base-action so the standalone
action can fetch and refresh the GitHub OIDC identity token itself, and
expose the same federation inputs as the outer action. Switch the
base-action test workflows from the anthropic_api_key secret to the
federation repo variables and grant them id-token: write.
* Verify MCP test tool invocation instead of init connection status
MCP servers can connect asynchronously, so the init event may report a
server as pending. Check that the server is registered at init, then
assert the test tool was actually called and returned its response.
Also pass the MCP config through claude_args --mcp-config, replacing the
removed mcp_config input.
* Add workload identity federation auth support
Adds anthropic_federation_rule_id, anthropic_organization_id,
anthropic_service_account_id, anthropic_workspace_id, and
anthropic_oidc_audience inputs. When the federation rule and organization
are set, the action fetches the workflow's GitHub Actions OIDC token,
writes it to a file in RUNNER_TEMP, keeps it refreshed during execution,
and points the Claude Code CLI at it via ANTHROPIC_IDENTITY_TOKEN_FILE so
the CLI can exchange it for a short-lived access token instead of using a
static API key.
* Add WIF example workflow and base-action federation docs
* Default workload identity OIDC audience to https://api.anthropic.com
* docs: add pull_request_target/workflow_run guidance and base-action trust model
Adds a security.md section on safe checkout patterns under
pull_request_target/workflow_run, and a trust-model section to the
base-action README clarifying that callers are responsible for the
working directory and prompt being trusted.
🏠 Remote-Dev: homespace
* docs: refine PRT/workflow_run guidance — root checkout + workflow_run ref
Second example now checks out the base ref at the workspace root before
the head-ref subdirectory checkout (this action expects a git repo at
the root). Adds the workflow_run ref form, drops the PRT-specific
gh-pr-diff hint from the first example, and generalises the closing
line to cover both event types.
🏠 Remote-Dev: homespace
* docs: use actions/checkout@v6 in examples (consistency)
🏠 Remote-Dev: homespace
