Skip to content

fix(ci): claude.yml テンプレートに認証ガードを追加し未設定時のCI失敗を防止 #1045

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
keito4 merged 3 commits into from
Aug 1, 2026
Merged

fix(ci): claude.yml テンプレートに認証ガードを追加し未設定時のCI失敗を防止 #1045

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2e76648
fix(ci): claude.yml テンプレートに認証ガードを追加
keito4 Aug 1, 2026
60f018f
fix(ci): claude.yml の認証ガードを既存if条件と結合し重複keyを解消
keito4 Aug 1, 2026
e543d2c
fix(ci): 配布テンプレート claude.yml に認証ガードを追加(sync整合)
keito4 Aug 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 18 additions & 1 deletion .github/workflows/claude.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,9 +79,26 @@ jobs:
with:
fetch-depth: 1

- name: Check Claude authentication

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Update the distributable workflow template too

This changes only the runnable workflow while templates/workflows/claude.yml remains unchanged. The checked script/check-workflow-template-sync.js treats that template as the source paired with this file, and npm run workflow:sync:check now fails; moreover, downstream synchronization will continue distributing the unguarded template, so the intended organization-wide fix will not propagate.

Useful? React with 👍 / 👎.

id: claude-auth
env:
CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
ANTHROPIC_FEDERATION_RULE_ID: ${{ secrets.ANTHROPIC_FEDERATION_RULE_ID }}
ANTHROPIC_ORGANIZATION_ID: ${{ secrets.ANTHROPIC_ORGANIZATION_ID }}
run: |
if [ -n "$CLAUDE_CODE_OAUTH_TOKEN" ] ||
[ -n "$ANTHROPIC_API_KEY" ] ||
{ [ -n "$ANTHROPIC_FEDERATION_RULE_ID" ] && [ -n "$ANTHROPIC_ORGANIZATION_ID" ]; }; then
Comment on lines +91 to +92

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Forward every accepted credential to the action

When a downstream repository has only ANTHROPIC_API_KEY or federation credentials, this guard emits available=true, but those variables are scoped to the shell step and the action still receives only claude_code_oauth_token. The analogous .github/workflows/claude-code-review.yml explicitly supplies all three action inputs, so these configurations will still fail authentication instead of being handled as promised.

Useful? React with 👍 / 👎.

Comment thread
coderabbitai[bot] marked this conversation as resolved.
echo "available=true" >> "$GITHUB_OUTPUT"
else
echo "available=false" >> "$GITHUB_OUTPUT"
echo "::notice::Skipping Claude Code because no Claude authentication secret is configured."
fi

- name: Run Claude Code
id: claude
if: steps.pr_draft.outputs.is_draft != 'true'
if: steps.pr_draft.outputs.is_draft != 'true' && steps.claude-auth.outputs.available == 'true'
uses: anthropics/claude-code-action@a92e7c70a4da9793dc164451d829089dc057a464 # v1
with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
Expand Down
19 changes: 18 additions & 1 deletion templates/workflows/claude.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,9 +94,26 @@ jobs:
with:
fetch-depth: 1

- name: Check Claude authentication
id: claude-auth
env:
CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
ANTHROPIC_FEDERATION_RULE_ID: ${{ secrets.ANTHROPIC_FEDERATION_RULE_ID }}
ANTHROPIC_ORGANIZATION_ID: ${{ secrets.ANTHROPIC_ORGANIZATION_ID }}
run: |
if [ -n "$CLAUDE_CODE_OAUTH_TOKEN" ] ||
[ -n "$ANTHROPIC_API_KEY" ] ||
{ [ -n "$ANTHROPIC_FEDERATION_RULE_ID" ] && [ -n "$ANTHROPIC_ORGANIZATION_ID" ]; }; then
echo "available=true" >> "$GITHUB_OUTPUT"
else
echo "available=false" >> "$GITHUB_OUTPUT"
echo "::notice::Skipping Claude Code because no Claude authentication secret is configured."
fi

- name: Run Claude Code
id: claude
if: steps.pr_draft.outputs.is_draft != 'true'
if: steps.pr_draft.outputs.is_draft != 'true' && steps.claude-auth.outputs.available == 'true'
uses: anthropics/claude-code-action@a92e7c70a4da9793dc164451d829089dc057a464 # v1
with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
Expand Down
Loading