Accept claude-code-oauth-token as auth alternative to claude-api-key

action.yml

@@ -24,8 +24,13 @@ inputs:
     default: '20'
 
   claude-api-key:
-    description: 'Anthropic Claude API key for security analysis'
-    required: true
+    description: 'Anthropic Claude API key for security analysis. Provide either this OR claude-code-oauth-token.'
+    required: false
+    default: ''
+
+  claude-code-oauth-token:
+    description: 'Claude Code OAuth token (Max/Pro subscription) — alternative to claude-api-key. Mint with `claude setup-token` locally.'
+    required: false
     default: ''
 
   claude-model:
@@ -182,7 +187,8 @@ runs:
         GITHUB_REPOSITORY: ${{ github.repository }}
         PR_NUMBER: ${{ github.event.pull_request.number }}
         ANTHROPIC_API_KEY: ${{ inputs.claude-api-key }}
-        ENABLE_CLAUDE_FILTERING: 'true' 
+        CLAUDE_CODE_OAUTH_TOKEN: ${{ inputs.claude-code-oauth-token }}
+        ENABLE_CLAUDE_FILTERING: 'true'
         EXCLUDE_DIRECTORIES: ${{ inputs.exclude-directories }}
         FALSE_POSITIVE_FILTERING_INSTRUCTIONS: ${{ inputs.false-positive-filtering-instructions }}
         CUSTOM_SECURITY_SCAN_INSTRUCTIONS: ${{ inputs.custom-security-scan-instructions }}
@@ -203,13 +209,17 @@ runs:
           exit 0
         fi
 
-        # Validate API key is provided
-        if [ -z "$ANTHROPIC_API_KEY" ]; then
-          echo "::error::ANTHROPIC_API_KEY is not set. Please provide the claude-api-key input to the action."
-          echo "Example usage:"
+        # Validate at least one auth method is provided
+        if [ -z "$ANTHROPIC_API_KEY" ] && [ -z "$CLAUDE_CODE_OAUTH_TOKEN" ]; then
+          echo "::error::Neither claude-api-key nor claude-code-oauth-token is set. Provide one."
+          echo "Example with API key:"
           echo "  - uses: anthropics/claude-code-security-reviewer@main"
           echo "    with:"
           echo "      claude-api-key: \$\{{ secrets.ANTHROPIC_API_KEY }}"
+          echo "Example with Max/Pro OAuth token (mint with 'claude setup-token'):"
+          echo "  - uses: anthropics/claude-code-security-reviewer@main"
+          echo "    with:"
+          echo "      claude-code-oauth-token: \$\{{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}"
           exit 1
         fi
 
@@ -226,6 +236,7 @@ runs:
         echo "Python version: $(python --version)"
         echo "Claude CLI version: $(claude --version 2>&1 || echo 'Claude CLI not found')"
         echo "ANTHROPIC_API_KEY set: $(if [ -n "$ANTHROPIC_API_KEY" ]; then echo 'Yes'; else echo 'No'; fi)"
+        echo "CLAUDE_CODE_OAUTH_TOKEN set: $(if [ -n "$CLAUDE_CODE_OAUTH_TOKEN" ]; then echo 'Yes'; else echo 'No'; fi)"
         echo "GITHUB_REPOSITORY: $GITHUB_REPOSITORY"
         echo "PR_NUMBER: $PR_NUMBER"
         echo "Python path: $PYTHONPATH"

claudecode/github_action_audit.py

@@ -323,10 +323,17 @@ def validate_claude_available(self) -> Tuple[bool, str]:
             )
 
             if result.returncode == 0:
-                # Also check if API key is configured
+                # Verify at least one auth credential is present:
+                #   - ANTHROPIC_API_KEY (direct API)
+                #   - CLAUDE_CODE_OAUTH_TOKEN (Max/Pro subscription, mint via `claude setup-token`)
                 api_key = os.environ.get('ANTHROPIC_API_KEY', '')
-                if not api_key:
-                    return False, "ANTHROPIC_API_KEY environment variable is not set"
+                oauth_token = os.environ.get('CLAUDE_CODE_OAUTH_TOKEN', '')
+                if not api_key and not oauth_token:
+                    return False, (
+                        "Neither ANTHROPIC_API_KEY nor CLAUDE_CODE_OAUTH_TOKEN "
+                        "environment variable is set. Set one to authenticate "
+                        "Claude Code."
+                    )
                 return True, ""
             else:
                 error_msg = f"Claude Code returned exit code {result.returncode}"