feat: Anthropic WIF support in EngineAuthConfig and ClaudeEngine

pkg/workflow/claude_engine.go

@@ -50,15 +50,22 @@ func (e *ClaudeEngine) GetAPMTarget() string {
 	return "claude"
 }
 
-// GetRequiredSecretNames returns the list of secrets required by the Claude engine
-// This includes ANTHROPIC_API_KEY and optionally MCP_GATEWAY_API_KEY and mcp-scripts secrets
+// GetRequiredSecretNames returns the list of secrets required by the Claude engine.
+// When Anthropic WIF (github-oidc + provider=anthropic) is configured, no static API key
+// is needed and only common MCP secrets are returned.
 func (e *ClaudeEngine) GetRequiredSecretNames(workflowData *WorkflowData) []string {
+	if isAnthropicWIF(workflowData) {
+		return collectCommonMCPSecrets(workflowData)
+	}
 	return append([]string{"ANTHROPIC_API_KEY"}, collectCommonMCPSecrets(workflowData)...)
 }
 
 // GetSecretValidationStep returns the secret validation step for the Claude engine.
-// Returns an empty step if custom command is specified.
+// Returns an empty step if custom command is specified or if Anthropic WIF is configured.
 func (e *ClaudeEngine) GetSecretValidationStep(workflowData *WorkflowData) GitHubActionStep {
+	if isAnthropicWIF(workflowData) {
+		return GitHubActionStep{}
+	}
 	return BuildDefaultSecretValidationStep(
 		workflowData,
 		[]string{"ANTHROPIC_API_KEY"},
@@ -67,6 +74,16 @@ func (e *ClaudeEngine) GetSecretValidationStep(workflowData *WorkflowData) GitHu
 	)
 }
 
+// isAnthropicWIF returns true when the workflow is configured to use Anthropic
+// Workload Identity Federation (github-oidc auth type with provider=anthropic).
+func isAnthropicWIF(workflowData *WorkflowData) bool {
+	if workflowData == nil || workflowData.EngineConfig == nil || workflowData.EngineConfig.Auth == nil {
+		return false
+	}
+	auth := workflowData.EngineConfig.Auth
+	return auth.Type == "github-oidc" && auth.Provider == "anthropic"
+}
+
 func (e *ClaudeEngine) GetInstallationSteps(workflowData *WorkflowData) []GitHubActionStep {
 	claudeLog.Printf("Generating installation steps for Claude engine: workflow=%s", workflowData.Name)
 

pkg/workflow/claude_engine_test.go

@@ -932,3 +932,72 @@ func TestClaudeEngineWithExpressionVersion(t *testing.T) {
 		t.Errorf("Expression should NOT be embedded directly in npm install command, got:\n%s", installStep)
 	}
 }
+
+func TestIsAnthropicWIF(t *testing.T) {
+tests := []struct {
+name         string
+workflowData *WorkflowData
+want         bool
+}{
+{
+name:         "nil workflowData returns false",
+workflowData: nil,
+want:         false,
+},
+{
+name:         "nil EngineConfig returns false",
+workflowData: &WorkflowData{},
+want:         false,
+},
+{
+name: "nil Auth returns false",
+workflowData: &WorkflowData{
+EngineConfig: &EngineConfig{},
+},
+want: false,
+},
+{
+name: "github-oidc without provider returns false",
+workflowData: &WorkflowData{
+EngineConfig: &EngineConfig{
+Auth: &EngineAuthConfig{Type: "github-oidc"},
+},
+},
+want: false,
+},
+{
+name: "github-oidc with azure provider returns false",
+workflowData: &WorkflowData{
+EngineConfig: &EngineConfig{
+Auth: &EngineAuthConfig{Type: "github-oidc", Provider: "azure"},
+},
+},
+want: false,
+},
+{
+name: "static type with anthropic provider returns false",
+workflowData: &WorkflowData{
+EngineConfig: &EngineConfig{
+Auth: &EngineAuthConfig{Type: "static", Provider: "anthropic"},
+},
+},
+want: false,
+},
+{
+name: "github-oidc with anthropic provider returns true",
+workflowData: &WorkflowData{
+EngineConfig: &EngineConfig{
+Auth: &EngineAuthConfig{Type: "github-oidc", Provider: "anthropic"},
+},
+},
+want: true,
+},
+}
+
+for _, tt := range tests {
+t.Run(tt.name, func(t *testing.T) {
+got := isAnthropicWIF(tt.workflowData)
+assert.Equal(t, tt.want, got)
+})
+}
+}

pkg/workflow/engine.go

@@ -75,12 +75,19 @@ type EngineConfig struct {
 // EngineAuthConfig represents engine.auth frontmatter settings that map to
 // AWF_AUTH_* environment variables consumed by the AWF API proxy sidecar.
 type EngineAuthConfig struct {
-	Type          string
-	Audience      string
+	Type     string
+	Audience string
+	Provider string // "azure" or "anthropic"
+	// Azure WIF fields
 	AzureTenantID string
 	AzureClientID string
 	AzureScope    string
 	AzureCloud    string
+	// Anthropic WIF fields
+	AnthropicFederationRuleID string
+	AnthropicOrganizationID   string
+	AnthropicServiceAccountID string
+	AnthropicWorkspaceID      string
 }
 
 // NetworkPermissions represents network access permissions for workflow execution
@@ -607,6 +614,9 @@ func parseEngineAuthConfig(authObj map[string]any) *EngineAuthConfig {
 	if s, ok := authObj["audience"].(string); ok {
 		auth.Audience = s
 	}
+	if s, ok := authObj["provider"].(string); ok {
+		auth.Provider = s
+	}
 	if s, ok := authObj["azure-tenant-id"].(string); ok {
 		auth.AzureTenantID = s
 	}
@@ -619,6 +629,18 @@ func parseEngineAuthConfig(authObj map[string]any) *EngineAuthConfig {
 	if s, ok := authObj["azure-cloud"].(string); ok {
 		auth.AzureCloud = s
 	}
+	if s, ok := authObj["federation-rule-id"].(string); ok {
+		auth.AnthropicFederationRuleID = s
+	}
+	if s, ok := authObj["organization-id"].(string); ok {
+		auth.AnthropicOrganizationID = s
+	}
+	if s, ok := authObj["service-account-id"].(string); ok {
+		auth.AnthropicServiceAccountID = s
+	}
+	if s, ok := authObj["workspace-id"].(string); ok {
+		auth.AnthropicWorkspaceID = s
+	}
 	return auth
 }
 
@@ -663,6 +685,31 @@ func applyEngineAuthEnv(config *EngineConfig) {
 			config.Env["AWF_AUTH_AZURE_CLOUD"] = config.Auth.AzureCloud
 		}
 	}
+	if config.Auth.Provider != "" {
+		if _, exists := config.Env["AWF_AUTH_PROVIDER"]; !exists {
+			config.Env["AWF_AUTH_PROVIDER"] = config.Auth.Provider
+		}
+	}
+	if config.Auth.AnthropicFederationRuleID != "" {
+		if _, exists := config.Env["AWF_AUTH_ANTHROPIC_FEDERATION_RULE_ID"]; !exists {
+			config.Env["AWF_AUTH_ANTHROPIC_FEDERATION_RULE_ID"] = config.Auth.AnthropicFederationRuleID
+		}
+	}
+	if config.Auth.AnthropicOrganizationID != "" {
+		if _, exists := config.Env["AWF_AUTH_ANTHROPIC_ORGANIZATION_ID"]; !exists {
+			config.Env["AWF_AUTH_ANTHROPIC_ORGANIZATION_ID"] = config.Auth.AnthropicOrganizationID
+		}
+	}
+	if config.Auth.AnthropicServiceAccountID != "" {
+		if _, exists := config.Env["AWF_AUTH_ANTHROPIC_SERVICE_ACCOUNT_ID"]; !exists {
+			config.Env["AWF_AUTH_ANTHROPIC_SERVICE_ACCOUNT_ID"] = config.Auth.AnthropicServiceAccountID
+		}
+	}
+	if config.Auth.AnthropicWorkspaceID != "" {
+		if _, exists := config.Env["AWF_AUTH_ANTHROPIC_WORKSPACE_ID"]; !exists {
+			config.Env["AWF_AUTH_ANTHROPIC_WORKSPACE_ID"] = config.Auth.AnthropicWorkspaceID
+		}
+	}
 }
 
 // parseRequestShape converts a raw request config map (from engine.provider.request) into

pkg/workflow/engine_config_test.go

@@ -438,6 +438,40 @@ func TestExtractEngineConfig_EngineEnvTakesPrecedenceOverEngineAuth(t *testing.T
 	assert.Equal(t, "from-engine-env", config.Env["AWF_AUTH_OIDC_AUDIENCE"])
 }
 
+func TestExtractEngineConfig_AnthropicWIFMapsToAWFEnv(t *testing.T) {
+	compiler := NewCompiler()
+	_, config := compiler.ExtractEngineConfig(map[string]any{
+		"engine": map[string]any{
+			"id": "claude",
+			"auth": map[string]any{
+				"type":               "github-oidc",
+				"provider":           "anthropic",
+				"federation-rule-id": "fr_01ABC",
+				"organization-id":    "org_01XYZ",
+				"service-account-id": "sa_01DEF",
+				"workspace-id":       "ws_01GHI",
+			},
+		},
+	})
+
+	assert.NotNil(t, config)
+	if assert.NotNil(t, config.Auth) {
+		assert.Equal(t, "github-oidc", config.Auth.Type)
+		assert.Equal(t, "anthropic", config.Auth.Provider)
+		assert.Equal(t, "fr_01ABC", config.Auth.AnthropicFederationRuleID)
+		assert.Equal(t, "org_01XYZ", config.Auth.AnthropicOrganizationID)
+		assert.Equal(t, "sa_01DEF", config.Auth.AnthropicServiceAccountID)
+		assert.Equal(t, "ws_01GHI", config.Auth.AnthropicWorkspaceID)
+	}
+
+	assert.Equal(t, "github-oidc", config.Env["AWF_AUTH_TYPE"])
+	assert.Equal(t, "anthropic", config.Env["AWF_AUTH_PROVIDER"])
+	assert.Equal(t, "fr_01ABC", config.Env["AWF_AUTH_ANTHROPIC_FEDERATION_RULE_ID"])
+	assert.Equal(t, "org_01XYZ", config.Env["AWF_AUTH_ANTHROPIC_ORGANIZATION_ID"])
+	assert.Equal(t, "sa_01DEF", config.Env["AWF_AUTH_ANTHROPIC_SERVICE_ACCOUNT_ID"])
+	assert.Equal(t, "ws_01GHI", config.Env["AWF_AUTH_ANTHROPIC_WORKSPACE_ID"])
+}
+
 func TestCompileWorkflowWithExtendedEngine(t *testing.T) {
 	// Create temporary directory for test files
 	tmpDir := testutil.TempDir(t, "extended-engine-test")

pkg/workflow/engine_helpers_secrets_test.go

@@ -221,6 +221,45 @@ func TestGetRequiredSecretNames_Claude(t *testing.T) {
 		assert.Contains(t, secrets, "ANTHROPIC_API_KEY")
 		assert.Contains(t, secrets, "MCP_GATEWAY_API_KEY")
 	})
+
+	t.Run("WIF: skips ANTHROPIC_API_KEY when github-oidc+anthropic configured", func(t *testing.T) {
+		workflowData := &WorkflowData{
+			Tools:       map[string]any{},
+			ParsedTools: &ToolsConfig{},
+			EngineConfig: &EngineConfig{
+				Auth: &EngineAuthConfig{
+					Type:     "github-oidc",
+					Provider: "anthropic",
+				},
+			},
+		}
+
+		secrets := engine.GetRequiredSecretNames(workflowData)
+
+		assert.NotContains(t, secrets, "ANTHROPIC_API_KEY")
+	})
+
+	t.Run("WIF: still includes MCP secrets when WIF and MCP both configured", func(t *testing.T) {
+		workflowData := &WorkflowData{
+			Tools: map[string]any{
+				"github": map[string]any{},
+			},
+			ParsedTools: &ToolsConfig{
+				GitHub: &GitHubToolConfig{},
+			},
+			EngineConfig: &EngineConfig{
+				Auth: &EngineAuthConfig{
+					Type:     "github-oidc",
+					Provider: "anthropic",
+				},
+			},
+		}
+
+		secrets := engine.GetRequiredSecretNames(workflowData)
+
+		assert.NotContains(t, secrets, "ANTHROPIC_API_KEY")
+		assert.Contains(t, secrets, "MCP_GATEWAY_API_KEY")
+	})
 }
 
 // TestGetRequiredSecretNames_Codex tests CodexEngine.GetRequiredSecretNames

pkg/workflow/secret_validation_test.go

@@ -111,6 +111,23 @@ func TestClaudeEngineHasSecretValidation(t *testing.T) {
 	}
 }
 
+func TestClaudeEngineWIFSkipsSecretValidation(t *testing.T) {
+	engine := NewClaudeEngine()
+	workflowData := &WorkflowData{
+		EngineConfig: &EngineConfig{
+			Auth: &EngineAuthConfig{
+				Type:     "github-oidc",
+				Provider: "anthropic",
+			},
+		},
+	}
+
+	step := engine.GetSecretValidationStep(workflowData)
+	if len(step) != 0 {
+		t.Errorf("Expected empty secret validation step for Anthropic WIF, got %d entries", len(step))
+	}
+}
+
 func TestCopilotEngineHasSecretValidation(t *testing.T) {
 	engine := NewCopilotEngine()
 	workflowData := &WorkflowData{}