mirror of
https://github.com/anthropics/claude-code-action.git
synced 2026-07-27 22:38:30 +08:00
4257c8e059
Switch claude.yml, claude-review.yml, and issue-triage.yml from the anthropic_api_key secret to the workload identity federation inputs. The federation rule, organization, and service account IDs are read from repository variables; issue-triage.yml additionally gains the id-token: write permission required to request the OIDC token.
34 lines
1.1 KiB
YAML
34 lines
1.1 KiB
YAML
name: PR Review
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened]
|
|
|
|
jobs:
|
|
review:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
id-token: write
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v6
|
|
with:
|
|
fetch-depth: 1
|
|
|
|
- name: PR Review with Progress Tracking
|
|
uses: anthropics/claude-code-action@v1
|
|
with:
|
|
# Authenticate to the Claude API via Workload Identity Federation
|
|
# (the workflow's OIDC token is exchanged for a short-lived access
|
|
# token) instead of a static API key. See docs/setup.md.
|
|
anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
|
|
anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
|
|
anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
|
|
|
|
prompt: "/review-pr REPO: ${{ github.repository }} PR_NUMBER: ${{ github.event.pull_request.number }}"
|
|
claude_args: |
|
|
--allowedTools "mcp__github_inline_comment__create_inline_comment"
|
|
--model "claude-opus-4-7"
|