Authenticate CI Claude review with an API key in a main-only environment

[seathatflowsinourveins]

Scope

• What this PR changes: CI Claude review (claude-pr-review.yml, claude-pr-toolkit-review.yml, harness-audit.yml) authenticates with an Anthropic API key, the environment secret ANTHROPIC_API_KEY of the main-only claude-review environment, instead of workload identity federation. This follows the owner's ruling of 2026-10-10 (about 13:44Z, relayed by the command center, paraphrased): use the keys; federation stays unconfigured. Its acceptance dispatch, run 38056354892, was refused like the runs of 10-08.
• Base commit: e1c88ff3d (main after Fence the headless /skill-doctor run #925).
• Lane: lane:foundation.
• Owned paths touched: the three workflows; tests/test_workflow_hardening.py, tests/test_workflow_policy.py, tests/test_claude_pr_review_workflow.py, tests/test_claude_pr_toolkit_review_workflow.py, tests/test_claude_harness_audit_bounds.py, tests/test_claude_federation_diagnostics.py; four decision records; docs/github-automation.md; manifests/evidence.json.

What changed:

• Each workflow passes anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} and no federation input.
• The job that uses the key declares environment: claude-review, and no job holds id-token: write.
• All three pass github_token, so the pinned action requests no GitHub OIDC token.
• Unchanged: dispatch and schedule on main only, the owner and first-attempt guards, the bounds step, the daily ceiling, the read-only tools, the job summary as the only output, and Retain Claude federation diagnostics and pinned vendor documentation #961's error_class logic.

The secret:

• ANTHROPIC_API_KEY holds the inventory entry anthropic-api-3, the cold spare, so CI spend stays separate from the local worker's api-4.
• The command center set it on the owner's explicit OK, through credential_run.py, with the value on stdin only. It was first a repository secret (2026-10-10T13:49:43Z), then an environment secret of claude-review (2026-10-10T13:55:05Z); the repository copy was deleted.
• Read back by me at 14:11Z: the environment's deployment branch policy allows main only, the environment holds the secret, and the repository has no secret of that name.

Policy and tests:

• The federation exemption and the three id-token: write write grants leave tests/test_workflow_policy.py.
• New tests.test_workflow_hardening.ClaudeApiKeyAuthTests requires:
  • the secret once per workflow;
  • the key-using job in the claude-review environment, and no other job in one;
  • no federation input, no id-token and no pull request trigger;
  • the secret in no other workflow.
• It fails on main's workflows (6 failures before the environment requirement was added, 3 for the environment test alone) and passes here.
• Retain Claude federation diagnostics and pinned vendor documentation #961's federation-diagnostics record is marked superseded for CI review. Its vendor snapshots stay retained and tested, and its two workflow-header tests now require the API-key environment and no federation claim.

SOTA sources

• Claude Code GitHub Actions, https://docs.claude.com/en/docs/claude-code/github-actions (read 2026-10-10T13:48Z):
  • the anthropic_api_key input with ${{ secrets.ANTHROPIC_API_KEY }};
  • workload identity federation as the alternative to a stored key;
  • id-token: write needed for the default GitHub App authentication and for the federation exchange.
• anthropics/claude-code-action at 2dca132ff0e0c4094ce6048b422c6915a071210b (v1.0.247):
  • action.yml:67-89 (the anthropic_api_key, federation and github_token inputs);
  • src/github/token.ts:160-168 (no OIDC request when github_token is given);
  • base-action/src/workload-identity.ts:43-47 (federation only when its inputs are set).
• GitHub Docs, Managing environments for deployment (read 2026-10-10T14:35Z; a job that references an environment must follow its protection rules, deployment branches included, before running or accessing its secrets): https://docs.github.com/en/actions/managing-workflow-runs-and-deployments/managing-deployments/managing-environments-for-deployment.
• zizmor 1.30.1 secrets-outside-env audit, auditor persona: on main it reports six findings in these three files; here, none.

Evidence-class table

Claim	Evidence class	Command / receipt
The three workflows use the key from the claude-review environment, carry no federation input, hold no id-token, and have no pull request trigger; no other workflow names the secret	synthetic	tests.test_workflow_hardening.ClaudeApiKeyAuthTests (fails on main's workflows, passes here)
With github_token passed, the pinned action requests no OIDC token	source_review	claude-code-action@2dca132f, files above
The environment allows main only and holds the secret; the repository has no secret of that name	native_proven	gh api repos/…/environments/claude-review and its deployment-branch-policies; gh secret list --env claude-review; gh secret list (names and times only, 14:11Z)
A review authenticates and runs on the key	—	not yet run: the command center's acceptance dispatch after landing (a successful review, total_cost_usd > 0, non-empty modelUsage)

Local commands run

$ python3 -m unittest <the 65 test modules that name these workflows, federation, the policy or manifests/evidence.json>   # TMPDIR on /var/tmp, at the rebased head
Ran 4266 tests, OK (skipped=44)
$ python3 scripts/validate.py
exit 0 (70 components, 11404 hashed files)
$ actionlint .github/workflows/*.yml
exit 0
$ zizmor 1.30.1 --offline --persona {regular,pedantic,auditor} on the three workflows
No findings
$ gitleaks git --log-opts="$(git merge-base origin/main HEAD)..HEAD" --config .gitleaks.toml --redact
no leaks found

Decision record

docs/decisions/2026-10-08-claude-actions-pr-review.md, "Authentication by API key (the owner's ruling, 2026-10-10)". Short dated notes in 2026-10-04-ci-least-privilege.md (federation exemption withdrawn), 2026-10-08-claude-actions-harness-audit-bounds.md, 2026-10-09-claude-actions-pr-toolkit-review.md and 2026-10-10-claude-federation-diagnostics.md.

🤖 Generated with Claude Code

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.