Skip to content

Document the federation rule claims for Claude workflows #10842

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
robert3005 wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

Document the federation rule claims for Claude workflows #10842

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 7 additions & 4 deletions .github/workflows/claude-write.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,12 @@ name: Claude Code (Write)
# - CLAUDE_APP_LOGIN
# Set this to the bot login for the GitHub App, usually `<app-slug>[bot]`.
# - ANTHROPIC_ORGANIZATION_ID, ANTHROPIC_SERVICE_ACCOUNT_ID, ANTHROPIC_FEDERATION_RULE_WRITE
# Identifiers, not credentials. The write rule matches only this workflow.
# Identifiers, not credentials. The write rule matches only this workflow and
# fuzzer-fix-automation.yml, and only in the `claude-automation` environment.
#
# Why this workflow exists separately
# - This is the only workflow that can read the GitHub App private key.
# - This workflow and fuzzer-fix-automation.yml are the only workflows that can
# read the GitHub App private key.
# - It is primarily issue-driven. The only PR path it allows is a follow-up comment
# on a same-repo PR that was already opened by the Claude GitHub App.
# - Claude uses a short-lived GitHub App installation token, not GITHUB_TOKEN, so
Expand Down Expand Up @@ -198,8 +200,9 @@ jobs:
id: claude
uses: anthropics/claude-code-action@2dca132ff0e0c4094ce6048b422c6915a071210b # v1.0.247
with:
# The environment puts `environment:claude-automation` in the OIDC subject,
# which is all the `vortex-claude-write` rule matches. Unreachable elsewhere.
# The environment puts `environment:claude-automation` in the OIDC subject.
# The `vortex-claude-write` rule matches that subject, and it also requires
# this workflow or fuzzer-fix-automation.yml as `job_workflow_ref`.
anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_WRITE }}
anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
Expand Down
2 changes: 2 additions & 0 deletions .github/workflows/fuzzer-fix-automation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -277,6 +277,8 @@ jobs:
# This job runs in the claude-automation environment, so the OIDC subject is
# `environment:claude-automation`. Only the `vortex-claude-write` rule matches
# that subject. The `vortex-claude-ci` rule fails the token exchange with 401.
# The write rule also requires this workflow as `job_workflow_ref`. If you
# rename this file, update the rule, or the token exchange fails with 401.
anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_WRITE }}
anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
Expand Down
Loading