From 435333101b56142e3268002ee4a509ee990e2a14 Mon Sep 17 00:00:00 2001 From: Tom Riglar Date: Fri, 23 Oct 2026 13:05:22 +0100 Subject: [PATCH] ci: authenticate the Claude action with the org CLAUDE_CODE_OAUTH_TOKEN Back from workload identity federation to the OAuth token, now an org-level secret. Federation bills the Anthropic API org's purchased credit, which promotional credit doesn't cover for Claude Code, so reviews were failing with "Credit balance is too low". Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_016xsPHeqEEpmiNy9YvGFDwB --- .github/workflows/claude-code-review.yml | 10 ++-------- .github/workflows/claude.yml | 8 +------- 2 files changed, 3 insertions(+), 15 deletions(-) diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index 2a2e1d5..8e8a6dc 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -13,7 +13,7 @@ on: jobs: claude-review: # Skip PRs we shouldn't (or can't) review: - # - Dependabot / forks: no OIDC token to exchange, so the action would fail. + # - Dependabot / forks: no CLAUDE_CODE_OAUTH_TOKEN, so the action would fail. # - release-please release PRs: just version bumps + changelog — nothing to # review, and it must never block a release. # - Back-merge PRs (production -> dev, opened by release-please.yml): only @@ -44,13 +44,7 @@ jobs: id: claude-review uses: anthropics/claude-code-action@v1 with: - # Workload identity federation: the action swaps the job's GitHub OIDC - # token (hence `id-token: write`) for a short-lived Anthropic token. - # No stored secret. These IDs aren't secret either. - anthropic_federation_rule_id: fdrl_01TQKFjxagS7QzsRp6royjYN - anthropic_organization_id: 43f1fdcd-16a2-46c9-902d-f939b82bb4f4 - anthropic_service_account_id: svac_01TcDsbHiTCxQ5m7aNHrBgLg - anthropic_workspace_id: wrkspc_01SadkG1A6MDwLr3FVD1VmyN + claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' plugins: 'code-review@claude-code-plugins' # --comment is required for the review to be posted to the PR: the diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 7749816..f1fc658 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -34,13 +34,7 @@ jobs: id: claude uses: anthropics/claude-code-action@v1 with: - # Workload identity federation: the action swaps the job's GitHub OIDC - # token (hence `id-token: write`) for a short-lived Anthropic token. - # No stored secret. These IDs aren't secret either. - anthropic_federation_rule_id: fdrl_01TQKFjxagS7QzsRp6royjYN - anthropic_organization_id: 43f1fdcd-16a2-46c9-902d-f939b82bb4f4 - anthropic_service_account_id: svac_01TcDsbHiTCxQ5m7aNHrBgLg - anthropic_workspace_id: wrkspc_01SadkG1A6MDwLr3FVD1VmyN + claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} # This is an optional setting that allows Claude to read CI results on PRs additional_permissions: |