ci(OP-3891): authenticate Claude with workload identity federation

.github/CLAUDE.md

@@ -141,9 +141,10 @@ than copying), `track_progress`, `use_sticky_comment`. Model is
 `claude-sonnet-4-5-20250929`.
 
 **Setup**: installs `uv`, dev tools (`_install_dev_tools.bash`),
-`uv sync --all-extras --locked`, headless display. Only secret available is
-`ANTHROPIC_API_KEY` — Claude Code workflows intentionally have **no** platform
-or GCP credentials.
+`uv sync --all-extras --locked`, headless display. Claude authenticates with
+workload identity federation through the repository-level `ANTHROPIC_*` Actions
+variables; no secret is passed. Claude Code workflows intentionally have **no**
+platform or GCP credentials.
 
 ## Scheduled jobs
 
@@ -171,8 +172,7 @@ Secrets: `BETTERSTACK_AUDIT_HEARTBEAT_URL`,
 E2E. **Production** (`platform.aignostics.com`) is used only by scheduled jobs
 and release validation — never in PR CI.
 
-GitHub secrets: `ANTHROPIC_API_KEY`,
-`AIGNOSTICS_CLIENT_ID_DEVICE_{STAGING,PRODUCTION}`,
+GitHub secrets: `AIGNOSTICS_CLIENT_ID_DEVICE_{STAGING,PRODUCTION}`,
 `AIGNOSTICS_REFRESH_TOKEN_{STAGING,PRODUCTION}`, the BetterStack URLs above,
 `CODECOV_TOKEN`, `SONAR_TOKEN`, `SENTRY_DSN`/`SENTRY_AUTH_TOKEN`,
 `UV_PUBLISH_TOKEN`, `KETRYX_PROJECT`/`KETRYX_API_KEY`, `SLACK_*_RELEASE_ANNOUNCEMENT`.

.github/workflows/_claude-code.yml

@@ -31,17 +31,14 @@ on:
         required: false
         default: false
         type: boolean
-    secrets:
-      ANTHROPIC_API_KEY:
-        required: true
 
 jobs:
   claude-code:
     runs-on: ubuntu-latest
     permissions:
       actions: read # github_ci MCP server of claude-code-action reads workflow runs and job logs
       contents: read
-      id-token: write # anthropics/claude-code-action exchanges the OIDC token for the Claude App token
+      id-token: write # anthropics/claude-code-action exchanges the OIDC token for the Claude App token and the Anthropic API token
       pull-requests: read # github_ci MCP server of claude-code-action reads the pull request (pulls.get)
     steps:
       - name: Checkout repository
@@ -78,7 +75,10 @@ jobs:
         if: inputs.mode == 'interactive'
         uses: anthropics/claude-code-action@db77d4d3c98f3f6380e7cd45ffba2342a3dbde3c # v1.0.254
         with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
+          anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
+          anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
+          anthropic_workspace_id: ${{ vars.ANTHROPIC_WORKSPACE_ID }}
           track_progress: ${{ inputs.track_progress }}
           additional_permissions: |
             actions: read
@@ -93,7 +93,10 @@ jobs:
         if: inputs.mode == 'automation'
         uses: anthropics/claude-code-action@db77d4d3c98f3f6380e7cd45ffba2342a3dbde3c # v1.0.254
         with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
+          anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
+          anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
+          anthropic_workspace_id: ${{ vars.ANTHROPIC_WORKSPACE_ID }}
           track_progress: ${{ inputs.track_progress }}
           use_sticky_comment: ${{ inputs.use_sticky_comment }}
           additional_permissions: |

.github/workflows/claude-code-automation-operational-excellence-weekly.yml

@@ -16,7 +16,7 @@ jobs:
     permissions:
       actions: read # github_ci MCP server of claude-code-action in _claude-code.yml reads workflow runs and job logs
       contents: read
-      id-token: write # anthropics/claude-code-action in _claude-code.yml exchanges the OIDC token for the Claude App token
+      id-token: write # anthropics/claude-code-action in _claude-code.yml exchanges the OIDC token for the Claude App token and the Anthropic API token
       pull-requests: read # github_ci MCP server of claude-code-action in _claude-code.yml reads the pull request (pulls.get)
     with:
       mode: 'automation'
@@ -291,6 +291,3 @@ jobs:
         ## Meta
 
         Suggest improvements to this workflow! You're continuously learning what works.
-
-    secrets:
-      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

.github/workflows/claude-code-automation-pr-review.yml

@@ -19,7 +19,7 @@ jobs:
     permissions:
       actions: read # github_ci MCP server of claude-code-action in _claude-code.yml reads workflow runs and job logs
       contents: read
-      id-token: write # anthropics/claude-code-action in _claude-code.yml exchanges the OIDC token for the Claude App token
+      id-token: write # anthropics/claude-code-action in _claude-code.yml exchanges the OIDC token for the Claude App token and the Anthropic API token
       pull-requests: read # github_ci MCP server of claude-code-action in _claude-code.yml reads the pull request (pulls.get)
     with:
       mode: 'automation'
@@ -266,5 +266,3 @@ jobs:
         ---
 
         **Remember**: This is medical device software. Insist on highest standards. Be thorough, actionable, and kind.
-    secrets:
-      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

.github/workflows/claude-code-interactive.yml

@@ -26,10 +26,8 @@ jobs:
     permissions:
       actions: read # github_ci MCP server of claude-code-action in _claude-code.yml reads workflow runs and job logs
       contents: read
-      id-token: write # anthropics/claude-code-action in _claude-code.yml exchanges the OIDC token for the Claude App token
+      id-token: write # anthropics/claude-code-action in _claude-code.yml exchanges the OIDC token for the Claude App token and the Anthropic API token
       pull-requests: read # github_ci MCP server of claude-code-action in _claude-code.yml reads the pull request (pulls.get)
     with:
       mode: 'interactive'
       track_progress: ${{ github.event_name != 'workflow_dispatch' && true || false }}
-    secrets:
-      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}