clone/claude-code
1
0
Fork 0
mirror of https://github.com/anthropics/claude-code.git synced 2026-05-24 05:04:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use workload identity federation for Claude auth in CI workflows (#61584)

Browse Source 
Replace the static ANTHROPIC_API_KEY secret with Workload Identity
Federation inputs in claude.yml, claude-issue-triage.yml, and
claude-dedupe-issues.yml. The federation rule, organization, service
account, and workspace IDs are read from repository variables.
This commit is contained in:
Ashwin Bhat
2026-05-22 15:55:40 -07:00
committed by GitHub
parent 64e53823de
commit 5ef2f06c6a
3 changed files with 25 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
.github/workflows/claude-dedupe-issues.yml vendored
View File

@@ -17,6 +17,8 @@ jobs:
permissions:
contents: read
issues: write
# Required to mint the OIDC token exchanged for a Claude API access token (Workload Identity Federation)
id-token: write
steps:
- name: Checkout repository
@@ -31,7 +33,13 @@ jobs:
github_token: ${{ secrets.GITHUB_TOKEN }}
allowed_non_write_users: "*"
prompt: "/dedupe ${{ github.repository }}/issues/${{ github.event.issue.number || inputs.issue_number }}"
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
# Authenticate to the Claude API via Workload Identity Federation
# (the workflow's OIDC token is exchanged for a short-lived access
# token) instead of a static API key.
anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
anthropic_workspace_id: ${{ vars.ANTHROPIC_WORKSPACE_ID }}
claude_args: "--model claude-sonnet-4-5-20250929"
- name: Log duplicate comment event to Statsig

10
.github/workflows/claude-issue-triage.yml vendored
View File

@@ -18,6 +18,8 @@ jobs:
permissions:
contents: read
issues: write
# Required to mint the OIDC token exchanged for a Claude API access token (Workload Identity Federation)
id-token: write
steps:
- name: Checkout repository
@@ -34,6 +36,12 @@ jobs:
github_token: ${{ secrets.GITHUB_TOKEN }}
allowed_non_write_users: "*"
prompt: "/triage-issue REPO: ${{ github.repository }} ISSUE_NUMBER: ${{ github.event.issue.number }} EVENT: ${{ github.event_name }}"
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
# Authenticate to the Claude API via Workload Identity Federation
# (the workflow's OIDC token is exchanged for a short-lived access
# token) instead of a static API key.
anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
anthropic_workspace_id: ${{ vars.ANTHROPIC_WORKSPACE_ID }}
claude_args: |
--model claude-opus-4-6

8
.github/workflows/claude.yml vendored
View File

@@ -33,6 +33,12 @@ jobs:
id: claude
uses: anthropics/claude-code-action@v1
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
# Authenticate to the Claude API via Workload Identity Federation
# (the workflow's OIDC token is exchanged for a short-lived access
# token) instead of a static API key.
anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
anthropic_workspace_id: ${{ vars.ANTHROPIC_WORKSPACE_ID }}
claude_args: "--model claude-sonnet-4-5-20250929"