Support OAuth authentication for self-hosted runners

Author: GiggleLiu

.github/workflows/pr-automation.yml

@@ -170,12 +170,13 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -eo pipefail
-          # Use secret if set, otherwise use runner's env
+          # Use secret if set, otherwise use runner's env (or OAuth from keychain)
           [ -n "$ANTHROPIC_API_KEY_SECRET" ] && export ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY_SECRET"
 
-          # Check API key is available
-          if [ -z "$ANTHROPIC_API_KEY" ]; then
-            echo "Error: ANTHROPIC_API_KEY not set" | tee claude-output.txt
+          # For GitHub-hosted runners, API key is required
+          # For self-hosted runners, OAuth from keychain is also supported
+          if [ -z "$ANTHROPIC_API_KEY" ] && [ "${{ vars.RUNNER_TYPE }}" != "self-hosted" ]; then
+            echo "Error: ANTHROPIC_API_KEY not set (required for GitHub-hosted runners)" | tee claude-output.txt
             exit 1
           fi
 
@@ -204,19 +205,26 @@ jobs:
             exit 1
           fi
 
+          # Check for max turns exhaustion
+          if grep -q "Reached max turns" claude-output.txt; then
+            echo "Error: Claude exhausted max turns without completing"
+            exit 1
+          fi
+
       - name: Fix issues
         if: needs.setup.outputs.command == 'fix'
         env:
           ANTHROPIC_API_KEY_SECRET: ${{ secrets.ANTHROPIC_API_KEY }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -eo pipefail
-          # Use secret if set, otherwise use runner's env
+          # Use secret if set, otherwise use runner's env (or OAuth from keychain)
           [ -n "$ANTHROPIC_API_KEY_SECRET" ] && export ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY_SECRET"
 
-          # Check API key is available
-          if [ -z "$ANTHROPIC_API_KEY" ]; then
-            echo "Error: ANTHROPIC_API_KEY not set" | tee claude-output.txt
+          # For GitHub-hosted runners, API key is required
+          # For self-hosted runners, OAuth from keychain is also supported
+          if [ -z "$ANTHROPIC_API_KEY" ] && [ "${{ vars.RUNNER_TYPE }}" != "self-hosted" ]; then
+            echo "Error: ANTHROPIC_API_KEY not set (required for GitHub-hosted runners)" | tee claude-output.txt
             exit 1
           fi
 
@@ -278,6 +286,12 @@ jobs:
             exit 1
           fi
 
+          # Check for max turns exhaustion
+          if grep -q "Reached max turns" claude-output.txt; then
+            echo "Error: Claude exhausted max turns without completing"
+            exit 1
+          fi
+
       - name: Debug test
         if: needs.setup.outputs.command == 'debug'
         run: |