mirror of
https://github.com/anthropics/claude-code-action.git
synced 2026-07-27 22:38:30 +08:00
4257c8e059
Switch claude.yml, claude-review.yml, and issue-triage.yml from the anthropic_api_key secret to the workload identity federation inputs. The federation rule, organization, and service account IDs are read from repository variables; issue-triage.yml additionally gains the id-token: write permission required to request the OIDC token.
38 lines
1.4 KiB
YAML
38 lines
1.4 KiB
YAML
name: Claude Issue Triage
|
|
description: Run Claude Code for issue triage in GitHub Actions
|
|
on:
|
|
issues:
|
|
types: [opened]
|
|
|
|
jobs:
|
|
triage-issue:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
issues: write
|
|
# Required to mint the OIDC token that is exchanged for a Claude API
|
|
# access token (Workload Identity Federation).
|
|
id-token: write
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v6
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Run Claude Code for Issue Triage
|
|
uses: anthropics/claude-code-action@main
|
|
env:
|
|
CLAUDE_CODE_SCRIPT_CAPS: '{"edit-issue-labels.sh":2}'
|
|
with:
|
|
prompt: "/label-issue REPO: ${{ github.repository }} ISSUE_NUMBER: ${{ github.event.issue.number }}"
|
|
# Authenticate to the Claude API via Workload Identity Federation
|
|
# (the workflow's OIDC token is exchanged for a short-lived access
|
|
# token) instead of a static API key. See docs/setup.md.
|
|
anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
|
|
anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
|
|
anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
|
|
allowed_non_write_users: "*" # Required for issue triage workflow, if users without repo write access create issues
|
|
github_token: ${{ secrets.GITHUB_TOKEN }}
|