Repository navigation
Conversation
The reusable Claude workflow takes the four ANTHROPIC_* repository variables instead of the ANTHROPIC_API_KEY secret. Public repositories do not see the org variables, so the values are set on this repository. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
OX Security reviewed this pull request — nothing to fix.
Branch |
7654cd0 to
9f54fcc
Compare
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
I am removing the Claude workflows entirely in #778. |
|
Superseded by #778, which removes the Claude Code workflows entirely. |
There was a problem hiding this comment.
🟡 Changes recommended
Removing the API-key input disables buffered inline-comment classification in the pinned action, allowing test or probe comments to be posted to PRs because the classifier does not support federated credentials.
1 open issue
What changed in this PR
Migrates the SDK’s Claude CI workflows from a static Anthropic API key to workload identity federation, enabling the secret to be retired after verification.
Changes:
- Configures both Claude action modes with four repository-level federation variables.
- Removes API-key secret declarations and forwarding from caller workflows.
- Updates CI documentation and permission comments to describe federated authentication.
| File | Description |
|---|---|
.github/workflows/claude-code-interactive.yml |
Removes secret forwarding and clarifies the existing token permission. |
.github/workflows/claude-code-automation-pr-review.yml |
Removes secret forwarding for automated PR reviews. |
.github/workflows/claude-code-automation-operational-excellence-weekly.yml |
Removes secret forwarding for weekly automation. |
.github/workflows/_claude-code.yml |
Replaces API-key inputs with federation variables in both modes. |
.github/CLAUDE.md |
Documents federation and removes the API key from the secrets list. |
Review effort: Balanced
| anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }} | ||
| anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }} | ||
| anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }} | ||
| anthropic_workspace_id: ${{ vars.ANTHROPIC_WORKSPACE_ID }} |
Codecov Report✅ All modified and coverable lines are covered by tests. |
|
Why
Claude in CI should use Anthropic workload identity federation instead of the
ANTHROPIC_API_KEYsecret, so the key can be retired (OP-3891, OP-3890). This repository is public, so it gets a dedicated federation rule and repository-levelANTHROPIC_*variables instead of the org ones.Impact
Verification and rollback
github_tokencommit; the log must showWorkload identity federation configured.gh secret delete ANTHROPIC_API_KEY -R aignostics/python-sdk.🤖 Generated with Claude Code