surshar / claude-code

Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.

Built by Anthropic · github.com/anthropics

Use workload identity federation for Claude auth in CI workflows (#61584)Browse files

Replace the static ANTHROPIC_API_KEY secret with Workload Identity
Federation inputs in claude.yml, claude-issue-triage.yml, and
claude-dedupe-issues.yml. The federation rule, organization, service
account, and workspace IDs are read from repository variables.

Ashwin Bhat authored on May 22, 2026 · GitHub committed on May 22, 2026 parent 64e5382 · commit 5ef2f06c6aa0

3 changed files+25 -3compared with 64e5382

M.github/workflows/claude-dedupe-issues.yml

M.github/workflows/claude-issue-triage.yml

M.github/workflows/claude.yml

M.github/workflows/claude-dedupe-issues.yml+9 -1

		@@ -17,6 +17,8 @@
17	17	permissions:
18	18	contents: read
19	19	issues: write
	20	+ # Required to mint the OIDC token exchanged for a Claude API access token (Workload Identity Federation)
	21	+ id-token: write
20	22
21	23	steps:
22	24	- name: Checkout repository
		@@ -31,7 +33,13 @@
31	33	github_token: ${{ secrets.GITHUB_TOKEN }}
32	34	allowed_non_write_users: "*"
33	35	prompt: "/dedupe ${{ github.repository }}/issues/${{ github.event.issue.number \|\| inputs.issue_number }}"
34		- anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
	36	+ # Authenticate to the Claude API via Workload Identity Federation
	37	+ # (the workflow's OIDC token is exchanged for a short-lived access
	38	+ # token) instead of a static API key.
	39	+ anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
	40	+ anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
	41	+ anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
	42	+ anthropic_workspace_id: ${{ vars.ANTHROPIC_WORKSPACE_ID }}
35	43	claude_args: "--model claude-sonnet-4-5-20250929"
36	44
37	45	- name: Log duplicate comment event to Statsig

M.github/workflows/claude-issue-triage.yml+9 -1

		@@ -18,6 +18,8 @@
18	18	permissions:
19	19	contents: read
20	20	issues: write
	21	+ # Required to mint the OIDC token exchanged for a Claude API access token (Workload Identity Federation)
	22	+ id-token: write
21	23
22	24	steps:
23	25	- name: Checkout repository
		@@ -34,6 +36,12 @@
34	36	github_token: ${{ secrets.GITHUB_TOKEN }}
35	37	allowed_non_write_users: "*"
36	38	prompt: "/triage-issue REPO: ${{ github.repository }} ISSUE_NUMBER: ${{ github.event.issue.number }} EVENT: ${{ github.event_name }}"
37		- anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
	39	+ # Authenticate to the Claude API via Workload Identity Federation
	40	+ # (the workflow's OIDC token is exchanged for a short-lived access
	41	+ # token) instead of a static API key.
	42	+ anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
	43	+ anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
	44	+ anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
	45	+ anthropic_workspace_id: ${{ vars.ANTHROPIC_WORKSPACE_ID }}
38	46	claude_args: \|
39	47	--model claude-opus-4-6

M.github/workflows/claude.yml+7 -1

		@@ -33,6 +33,12 @@
33	33	id: claude
34	34	uses: anthropics/claude-code-action@v1
35	35	with:
36		- anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
	36	+ # Authenticate to the Claude API via Workload Identity Federation
	37	+ # (the workflow's OIDC token is exchanged for a short-lived access
	38	+ # token) instead of a static API key.
	39	+ anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
	40	+ anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
	41	+ anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
	42	+ anthropic_workspace_id: ${{ vars.ANTHROPIC_WORKSPACE_ID }}
37	43	claude_args: "--model claude-sonnet-4-5-20250929"
38	44