Add verified Claude Code install composite action

[stbenjam]

Summary

• Adds a reusable composite action at .github/actions/install-claude-code/ that installs a pinned Claude Code version with full integrity verification
• Imports the Anthropic GPG key and verifies its fingerprint
• Downloads the signed manifest.json and verifies its GPG signature
• Downloads the binary and validates its SHA-256 checksum against the manifest
• Verifies the installed version matches the requested version

Usage

- uses: ./.github/actions/install-claude-code
  with:
    version: "2.1.150"

This replaces curl -fsSL https://claude.ai/install.sh | bash with Claude Code's documented integrity flow.

Test plan

• Use from a workflow that needs Claude Code CLI (e.g. tag-plugin-versions after merging Add workflow to tag plugin versions for dependency resolution #497)
• Verify GPG fingerprint check catches a bad key
• Verify SHA-256 check catches a corrupted binary

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Added a new GitHub Actions composite action to enhance the CI/CD pipeline with automated installation and verification checks, ensuring secure and reliable build processes.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: stbenjam

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• .github/OWNERS [stbenjam]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

Walkthrough

This PR adds a new GitHub composite action that securely installs a specified Claude Code version. The action enforces integrity through GPG key verification, manifest signature validation, platform detection, and SHA-256 checksum verification before installation. It then confirms the installed version and cleans up temporary artifacts.

Changes

Claude Code Installation Action with Integrity Verification

Layer / File(s)

Summary

Installation Action with Integrity Verification .github/actions/install-claude-code/action.yml

Composite action accepts a version input and performs secure installation: imports and fingerprint-verifies an Anthropic GPG key, downloads and GPG-verifies manifest.json and its .sig file, detects CPU architecture with uname -m, downloads the corresponding binary, extracts expected SHA-256 from manifest via inline Python, validates checksum against downloaded binary, installs to $HOME/.local/bin/claude, updates GITHUB_PATH, verifies installed version matches input, and removes manifest artifacts.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Suggested labels

approved, lgtm

Suggested reviewers

• LiangquanLi930
• theobarberbany

🚥 Pre-merge checks | ✅ 10

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically summarizes the main change: addition of a verified Claude Code install composite action for GitHub workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No Real People Names In Style References	✅ Passed	The PR adds a GitHub composite action for installing Claude Code. No real person names appear as style references, in plugin commands, or documentation.
No Assumed Git Remote Names	✅ Passed	The new action file contains no git commands or hardcoded remote names; it only performs Claude Code binary verification and installation.
Git Push Safety Rules	✅ Passed	The PR adds a GitHub composite action for installing Claude Code with integrity verification. The file contains no git push commands, force pushes, or pushes to main/master branches.
No Untrusted Mcp Servers	✅ Passed	PR adds a Claude Code install action that uses official Anthropic downloads and GPG verification; no MCP server installations or untrusted package sources are introduced.
Ai-Helpers Overlap Detection	✅ Passed	PR only adds .github/actions/install-claude-code/action.yml, which is not an ai-helpers file. Check Phase 1 explicitly skips non-ai-helpers modifications.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}