From 163049049e95bc60008bb769a19f63e25bc2d38f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabian=20Spie=C3=9F?= Date: Fri, 13 Nov 2026 15:38:06 +0100 Subject: [PATCH 1/2] ci(OP-3891): authenticate Claude with workload identity federation The PR review takes the four ANTHROPIC_* repository variables instead of the ANTHROPIC_API_KEY secret, as foundry-python v2.7.0 does. Public repositories do not see the org variables, so the values are set here. Co-Authored-By: Claude Opus 5.5 --- .github/AGENTS.md | 10 ++++------ .github/workflows/claude-code-automation-pr-review.yml | 10 +++++++++- docs/foundry/getting-started.md | 2 +- 3 files changed, 14 insertions(+), 8 deletions(-) diff --git a/.github/AGENTS.md b/.github/AGENTS.md index a851779..a7f6d60 100644 --- a/.github/AGENTS.md +++ b/.github/AGENTS.md @@ -178,9 +178,8 @@ Cancels in-progress runs for same branch * Security * Adherence to AGENTS.md guidelines -**Secrets required**: - -* `ANTHROPIC_API_KEY` +**Authentication**: workload identity federation through the repository-level +`ANTHROPIC_*` Actions variables; no secret is needed. ## Git Conventions @@ -268,9 +267,8 @@ Cancels in-progress runs for same branch * `CODECOV_TOKEN` - Codecov coverage reporting * `SONAR_TOKEN` - SonarCloud analysis -**Claude Code**: - -* `ANTHROPIC_API_KEY` - Claude API access +**Claude Code**: no secret; workload identity federation through the +repository-level `ANTHROPIC_*` Actions variables. ## Debugging CI Failures diff --git a/.github/workflows/claude-code-automation-pr-review.yml b/.github/workflows/claude-code-automation-pr-review.yml index 06d7330..7a3f655 100644 --- a/.github/workflows/claude-code-automation-pr-review.yml +++ b/.github/workflows/claude-code-automation-pr-review.yml @@ -26,7 +26,15 @@ jobs: - name: Run Claude Code PR Review uses: anthropics/claude-code-action@d535f5172dec02b204866b393d6b20b9b2aaf98d # v1.0.266 with: - anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} + # Workload identity federation: the job's GitHub OIDC token is exchanged + # for a short-lived Anthropic token. Values are repository-level Actions + # variables (identifiers, not secrets): a public repository cannot see the + # org-level ones. Do not also set anthropic_api_key: a static key takes + # precedence and federation is silently skipped. + anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }} + anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }} + anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }} + anthropic_workspace_id: ${{ vars.ANTHROPIC_WORKSPACE_ID }} track_progress: ${{ github.event_name == 'pull_request' && contains(fromJSON('["opened", "synchronize", "ready_for_review", "reopened"]'), github.event.action) }} use_sticky_comment: true claude_args: | diff --git a/docs/foundry/getting-started.md b/docs/foundry/getting-started.md index 1661289..5f1476d 100644 --- a/docs/foundry/getting-started.md +++ b/docs/foundry/getting-started.md @@ -112,7 +112,7 @@ These services are active automatically at the organisation level: | [CodeQL](https://github.com/aignostics/foundry-python-core/security/code-scanning) | Static security analysis | Runs weekly (Tuesdays 3:22 AM UTC) via included workflow | | [CodeCov](https://app.codecov.io/gh/aignostics/foundry-python-core) | Coverage tracking & PR comments | Org-level; coverage uploads automatic | | [Dependabot](https://github.com/aignostics/foundry-python-core/settings/security_analysis) | Dependency vulnerability alerts | Enabled by default via enterprise policy | -| [Claude Code](https://github.com/aignostics/foundry-python-core/actions) | AI-powered PR reviews (`claude` label) | `ANTHROPIC_API_KEY` is org-wide; no setup required | +| [Claude Code](https://github.com/aignostics/foundry-python-core/actions) | AI-powered PR reviews (`claude` label) | Workload identity federation through the `ANTHROPIC_*` Actions variables; org-wide for private and internal repositories, set on the repository for public ones | ### Renovate From 1de597a7d5373a95798116cf82cd6340678f0004 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabian=20Spie=C3=9F?= Date: Fri, 13 Nov 2026 16:00:41 +0100 Subject: [PATCH 2/2] ci(OP-3891): drop the WIF comment block Co-Authored-By: Claude Opus 5.5 --- .github/workflows/claude-code-automation-pr-review.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/workflows/claude-code-automation-pr-review.yml b/.github/workflows/claude-code-automation-pr-review.yml index 7a3f655..07e8d5e 100644 --- a/.github/workflows/claude-code-automation-pr-review.yml +++ b/.github/workflows/claude-code-automation-pr-review.yml @@ -26,11 +26,6 @@ jobs: - name: Run Claude Code PR Review uses: anthropics/claude-code-action@d535f5172dec02b204866b393d6b20b9b2aaf98d # v1.0.266 with: - # Workload identity federation: the job's GitHub OIDC token is exchanged - # for a short-lived Anthropic token. Values are repository-level Actions - # variables (identifiers, not secrets): a public repository cannot see the - # org-level ones. Do not also set anthropic_api_key: a static key takes - # precedence and federation is silently skipped. anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }} anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }} anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}