fix(gha): Add id-token write permission and switch to GH_TOKEN for Claude actions#1238
fix(gha): Add id-token write permission and switch to GH_TOKEN for Claude actions#1238MervinPraison merged 1 commit intomainfrom
Conversation
…aude actions Fixes OIDC token fetch failure and 401 Bad Credentials errors in claude.yml and claude-issue-triage.yml.
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
Review Summary by QodoFix OIDC token and authentication in Claude workflows
WalkthroughsDescription• Add id-token: write permission to Claude workflow • Replace PAT_TOKEN with GH_TOKEN in both workflows • Fixes OIDC token fetch and authentication errors Diagramflowchart LR
A["Claude Workflows"] -->|Add id-token permission| B["OIDC Token Access"]
A -->|Replace PAT_TOKEN| C["GH_TOKEN"]
B --> D["Fixed Authentication"]
C --> D
File Changes1. .github/workflows/claude.yml
|
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe PR updates two GitHub Actions workflows to modify token authentication handling. It replaces references to Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
Poem
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Code Review by Qodo
1. OIDC with unpinned action
|
There was a problem hiding this comment.
Pull request overview
Updates the Claude GitHub Actions workflows to fix authentication failures by enabling OIDC token minting and using a different GitHub token secret for API access.
Changes:
- Add
id-token: writejob permission to allow OIDC token requests in the main Claude workflow. - Switch Claude workflows from
secrets.PAT_TOKENtosecrets.GH_TOKENfor thegithub_tokeninput.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .github/workflows/claude.yml | Adds OIDC id-token permission and switches github_token to secrets.GH_TOKEN. |
| .github/workflows/claude-issue-triage.yml | Switches github_token to secrets.GH_TOKEN. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| with: | ||
| anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} | ||
| github_token: ${{ secrets.PAT_TOKEN }} No newline at end of file | ||
| github_token: ${{ secrets.GH_TOKEN }} No newline at end of file |
There was a problem hiding this comment.
Trailing whitespace after the secret expression can trigger YAML/style lint failures and makes diffs noisier. Please remove the extra space after ${{ secrets.GH_TOKEN }}.
| github_token: ${{ secrets.GH_TOKEN }} | |
| github_token: ${{ secrets.GH_TOKEN }} |
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
| pull-requests: write | ||
| issues: write | ||
| actions: read | ||
| id-token: write |
There was a problem hiding this comment.
1. Oidc with unpinned action 🐞 Bug ⛨ Security
claude.yml now grants id-token: write while running anthropics/claude-code-action@beta (a mutable tag), increasing supply-chain impact because a compromised tag update could mint OIDC tokens in your job context. Pin the third-party action to an immutable commit SHA (or a trusted release digest) before enabling OIDC token issuance.
Agent Prompt
### Issue description
The workflow grants `id-token: write` but uses `anthropics/claude-code-action@beta`, which is a mutable reference. This increases the supply-chain blast radius because the referenced code can change without being reviewed in this repo.
### Issue Context
`id-token: write` enables OIDC token requests in the job. Third-party actions referenced by mutable tags should be pinned to an immutable commit SHA (or equivalent immutable identifier) before granting sensitive permissions.
### Fix Focus Areas
- .github/workflows/claude.yml[27-45]
### What to change
- Replace `anthropics/claude-code-action@beta` with a commit-SHA-pinned reference (or an immutable release reference provided by the publisher).
- Keep `id-token: write` only if OIDC is still required after the pin.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
|
@copilot Do a thorough review of this PR. Read ALL existing reviewer comments above first. Review areas:
|
Fixes OIDC token fetch failure and 401 Bad Credentials errors in the Claude workflows.
Summary by CodeRabbit