fix(ci): claude.yml テンプレートに認証ガードを追加し未設定時のCI失敗を防止 by keito4 · Pull Request #1045 · keito4/config

keito4 · 2026-08-01T14:20:21Z

Why

認証シークレット (CLAUDE_CODE_OAUTH_TOKEN / ANTHROPIC_API_KEY / federation) が未設定のリポジトリで、@claude トリガーのたびに anthropics/claude-code-action が Environment variable validation failed で失敗し、GitHub Actions が赤くなっていた。OYKOT-jp 組織横断で多発。

What

テンプレート claude.yml に claude-code-review.yml と同じ Check Claude authentication ステップを追加し、Run Claude Code を if: steps.claude-auth.outputs.available == 'true' でガード。未設定時は skip（job成功=緑）になる。

How

downstream-template-auto-sync（ADR 0019）で各リポに伝播。既にOYKOT-jpの36リポには同等のガードを個別適用済みで、本PRはテンプレート正本を追従させ新規リポでの再発を防ぐもの。

Risk

低。トークン設定済みリポは従来どおり稼働、未設定リポは fail→skip に変わるのみ。YAML構文検証済み。

🤖 Generated with Claude Code

Summary by CodeRabbit

New Features
- Added support for detecting multiple Claude authentication methods.
- Claude execution now runs only when valid credentials are available.
- Added a notice when no Claude credentials are configured.

認証シークレット未設定時に anthropics/claude-code-action が検証エラーで失敗する問題をテンプレート側で恒久対応。claude-code-review.yml と同じ Check Claude authentication ステップを追加し、未設定時は Run Claude Code を skip して job を成功(緑)にする。 downstream 同期でOYKOT等の全リポに伝播する。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cursor · 2026-08-01T14:20:25Z

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

coderabbitai · 2026-08-01T14:20:49Z

Warning

Review limit reached

@keito4, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 50 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 60908fc5-9935-47a4-bcf3-8293515aeade

📥 Commits

Reviewing files that changed from the base of the PR and between 2e76648 and e543d2c.

📒 Files selected for processing (2)

.github/workflows/claude.yml
templates/workflows/claude.yml

📝 Walkthrough

Walkthrough

The Claude workflow checks OAuth, API-key, and paired federation credentials. It exposes authentication availability through a step output. Claude execution now requires available authentication and a draft pull request.

Changes

Claude authentication gating

Layer / File(s)	Summary
Authentication check and execution gate `.github/workflows/claude.yml`	The workflow checks supported Claude credentials, reports when credentials are unavailable, and runs Claude only when authentication is available and the pull request is a draft.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

keito4/config#16: Introduces the Claude workflow that this change updates.
keito4/config#167: Also modifies the Claude GitHub Actions workflow.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the authentication guard added to the Claude CI template and the prevention of failures when credentials are not configured.
Description check	✅ Passed	The description clearly explains the reason, changes, testing, propagation, and risk, but omits the template's Summary, Checklist, and Related sections.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/claude-yml-auth-guard

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2e766486ee

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-01T14:22:33Z

+        if: steps.claude-auth.outputs.available == 'true'
        if: steps.pr_draft.outputs.is_draft != 'true'


Merge the authentication and draft conditions

The newly added if duplicates the existing if key in the same step. prettier --check .github/workflows/claude.yml reports Map keys must be unique, so GitHub cannot load this workflow and every @claude trigger is disabled; combine both predicates into one expression.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-08-01T14:22:33Z

+             [ -n "$ANTHROPIC_API_KEY" ] ||
+             { [ -n "$ANTHROPIC_FEDERATION_RULE_ID" ] && [ -n "$ANTHROPIC_ORGANIZATION_ID" ]; }; then


Forward every accepted credential to the action

When a downstream repository has only ANTHROPIC_API_KEY or federation credentials, this guard emits available=true, but those variables are scoped to the shell step and the action still receives only claude_code_oauth_token. The analogous .github/workflows/claude-code-review.yml explicitly supplies all three action inputs, so these configurations will still fail authentication instead of being handled as promised.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-08-01T14:22:33Z

        with:
          fetch-depth: 1

+      - name: Check Claude authentication


Update the distributable workflow template too

This changes only the runnable workflow while templates/workflows/claude.yml remains unchanged. The checked script/check-workflow-template-sync.js treats that template as the source paired with this file, and npm run workflow:sync:check now fails; moreover, downstream synchronization will continue distributing the unguarded template, so the intended organization-wide fix will not propagate.

Useful? React with 👍 / 👎.

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/claude.yml:
- Around line 99-101: Merge the duplicate conditions on the “Run Claude Code”
workflow step into its existing single if expression, combining both predicates
with the appropriate logical operator. Remove the extra if key while preserving
both conditions and the step’s current behavior.
- Around line 90-92: Remove the duplicate if condition from the Run Claude Code
step and replace it with one combined condition requiring both
steps.claude-auth.outputs.available and steps.pr_draft.outputs.is_draft to
indicate the step should run, preserving the intended draft and authentication
gating.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: abcb3dad-7fae-4598-a1a3-5347f8294f25

📥 Commits

Reviewing files that changed from the base of the PR and between 6845638 and 2e76648.

📒 Files selected for processing (1)

.github/workflows/claude.yml

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

github-actions · 2026-08-02T07:49:04Z

🎉 This PR is included in version 1.131.2 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

keito4 self-assigned this Aug 1, 2026

chatgpt-codex-connector Bot reviewed Aug 1, 2026

View reviewed changes

coderabbitai Bot reviewed Aug 1, 2026

View reviewed changes

Comment thread .github/workflows/claude.yml

Comment thread .github/workflows/claude.yml Outdated

keito4 and others added 2 commits August 1, 2026 23:29

fix(ci): claude.yml の認証ガードを既存if条件と結合し重複keyを解消

60f018f

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

fix(ci): 配布テンプレート claude.yml に認証ガードを追加(sync整合)

e543d2c

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

keito4 merged commit 0be2df8 into main Aug 1, 2026
13 checks passed

keito4 deleted the fix/claude-yml-auth-guard branch August 1, 2026 14:33

coderabbitai Bot mentioned this pull request Aug 1, 2026

fix(ci): 変更なし@claudeタスクでPR作成ステップが失敗する問題を修正 #1046

Merged

github-actions Bot added the released リリース済み label Aug 2, 2026

Navigation Menu

fix(ci): claude.yml テンプレートに認証ガードを追加し未設定時のCI失敗を防止 - #1045

fix(ci): claude.yml テンプレートに認証ガードを追加し未設定時のCI失敗を防止#1045
keito4 merged 3 commits into
mainfrom
fix/claude-yml-auth-guard

keito4 commented Aug 1, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

cursor Bot commented Aug 1, 2026

Uh oh!

coderabbitai Bot commented Aug 1, 2026 •

edited

Loading

Review limit reached

Walkthrough

Changes

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Aug 1, 2026

Uh oh!

chatgpt-codex-connector Bot Aug 1, 2026

Uh oh!

chatgpt-codex-connector Bot Aug 1, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		if: steps.claude-auth.outputs.available == 'true'
		if: steps.pr_draft.outputs.is_draft != 'true'

		[ -n "$ANTHROPIC_API_KEY" ] \|\|
		{ [ -n "$ANTHROPIC_FEDERATION_RULE_ID" ] && [ -n "$ANTHROPIC_ORGANIZATION_ID" ]; }; then

Conversation

keito4 commented Aug 1, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What

How

Risk

Summary by CodeRabbit

Uh oh!

cursor Bot commented Aug 1, 2026

Uh oh!

coderabbitai Bot commented Aug 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 1, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Aug 1, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Aug 1, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

keito4 commented Aug 1, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 1, 2026 •

edited

Loading