NO-JIRA: test Claude Code WIF auth in GitHub Actions#8588
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
the
jira/valid-reference
|
@bryan-cox: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds a new GitHub Actions workflow (claude-wif-test.yaml) that triggers on changes to that workflow file and via manual dispatch. The workflow grants OIDC permissions, then runs a job which checks out the repo, authenticates to GCP using Workload Identity Federation via google-github-actions/auth@v2, installs Claude Code, sets Vertex-related environment variables, and runs sequenceDiagram
participant GitHub as GitHub Actions
participant Runner as Actions Runner
participant Auth as google-github-actions/auth@v2
participant GCP as GCP Workload Identity Provider
participant Installer as Claude install script
participant Claude as Claude CLI
participant Vertex as Vertex AI
GitHub->>Runner: trigger (pull_request or workflow_dispatch)
Runner->>Auth: request id-token (OIDC)
Auth->>GCP: exchange token for service account credentials
Runner->>Installer: install Claude Code
Runner->>Claude: run `claude --version` and prompt (Vertex envs)
Claude->>Vertex: call Vertex AI (when enabled)
Sequence Diagram(s)sequenceDiagram
participant GitHub as GitHub Actions
participant Runner as Actions Runner
participant Checkout as actions/checkout
participant Auth as google-github-actions/auth@v2
participant GCP as GCP Workload Identity Provider
participant Installer as Claude install script
participant Claude as Claude CLI
participant Vertex as Vertex AI
GitHub->>Runner: trigger (pull_request_target or workflow_dispatch)
Runner->>Checkout: checkout PR head SHA
Runner->>Auth: request id-token (OIDC)
Auth->>GCP: exchange id-token for service account credentials
Runner->>Installer: install Claude Code
Runner->>Claude: run `claude --version` and prompt (with Vertex envs)
Claude->>Vertex: call Vertex AI (when enabled)
🚥 Pre-merge checks | ✅ 12✅ Passed checks (12 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
area/ci-tooling
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bryan-cox The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
approved
bryan-cox
force-pushed
the
test-arc-runners
branch
2 times, most recently
from
3da80c4 to
690af6c
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/claude-wif-test.yaml (1)
16-16: ⚡ Quick winPin action to SHA and disable credential persistence.
Static analysis flags two issues:
- Action is pinned to a version tag (
v4) rather than a commit SHA, which is a supply chain risk- Missing
persist-credentials: falseto prevent credential leakage🔒 Suggested fix
- - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/claude-wif-test.yaml at line 16, Replace the unpinned checkout action and enable non-persistent credentials: change the "uses: actions/checkout@v4" reference to a fixed commit SHA (e.g., "uses: actions/checkout@<commit-sha>") and add a with: block containing "persist-credentials: false" (so the checkout step uses the SHA and includes persist-credentials: false) to prevent credential leakage.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/claude-wif-test.yaml:
- Around line 19-22: Replace the unpinned GitHub Action reference
"google-github-actions/auth@v2" with the specific commit SHA
"google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed" so the
workload identity federation auth step is pinned to the exact commit; update the
uses entry accordingly where "google-github-actions/auth@v2" appears.
---
Nitpick comments:
In @.github/workflows/claude-wif-test.yaml:
- Line 16: Replace the unpinned checkout action and enable non-persistent
credentials: change the "uses: actions/checkout@v4" reference to a fixed commit
SHA (e.g., "uses: actions/checkout@<commit-sha>") and add a with: block
containing "persist-credentials: false" (so the checkout step uses the SHA and
includes persist-credentials: false) to prevent credential leakage.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: e91777cc-8038-4135-9ea0-4f7186a9f32d
📒 Files selected for processing (2)
.github/workflows/claude-wif-test.yamlhack/github-actions-runner/README.md
Codecov Report✅ All modified and coverable lines are covered by tests. Please upload reports for the commit c431e17 to get more accurate results. Additional details and impacted files@@ Coverage Diff @@
## main #8588 +/- ##
==========================================
+ Coverage 40.41% 40.53% +0.12%
==========================================
Files 755 755
Lines 93235 93235
==========================================
+ Hits 37679 37794 +115
+ Misses 52854 52740 -114
+ Partials 2702 2701 -1 see 3 files with indirect coverage changes
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/claude-wif-test.yaml:
- Line 16: Update the checkout step that uses
actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 to disable credential
persistence by adding persist-credentials: false to that step; locate the
checkout usage (the line with "uses:
actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5") and add the
persist-credentials: false key under it so the GITHUB_TOKEN is not written to
local git config after checkout.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 914228fc-0f08-4a25-adb7-1c6402ce1fc6
📒 Files selected for processing (1)
.github/workflows/claude-wif-test.yaml
|
I have all the evidence needed. Here is the analysis: Test Failure Analysis CompleteJob Information
Test Failure AnalysisErrorSummaryThe GCP Workload Identity Federation (WIF) authentication step failed because GitHub Actions refuses to issue OIDC identity tokens for workflows triggered by Root CauseGitHub Actions security policy for fork PRs blocks OIDC token issuance. The workflow at
This is not a workflow misconfiguration. The Recommendations
Evidence
|
bryan-cox
force-pushed
the
test-arc-runners
branch
from
690af6c to
3d3a94c
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/claude-wif-test.yaml (1)
16-16: ⚡ Quick winDrop checkout unless a later step actually needs repo files.
Nothing in this job reads the repository, so checking out the PR just widens the workspace trust boundary before the credentialed steps run.
✂️ Minimal change
- - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/claude-wif-test.yaml at line 16, The workflow currently runs a uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 step even though no later step in this job needs repository files; remove that uses: actions/checkout... step from the job (or gate it behind a conditional if you later add repo-dependent steps) so the job does not unnecessarily checkout the repo and widen the workspace trust boundary.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/claude-wif-test.yaml:
- Around line 25-28: The "Install Claude Code" step currently pipes an unpinned
installer (curl | sh) which runs after WIF auth; change it to either (A)
download a specific pinned release of the Claude installer/binary and validate
its SHA256 from Anthropic's signed manifest.json (and verify the manifest
signature with GPG) before extracting/installing, or (B) move the "Install
Claude Code" step to run before the WIF auth step so the installer runs without
provisioned credentials; update the step named "Install Claude Code" and any
related environment/path handling (echo "$HOME/.local/bin" >> $GITHUB_PATH)
accordingly and ensure the workflow fails if signature/checksum verification
does not pass.
- Around line 2-6: Workflow currently triggers credentialed flows on
pull_request (on: pull_request) which can expose WIF/OIDC tokens; change the
trigger to manual-only (remove or disable on: pull_request and keep
workflow_dispatch) or add a guard at job level (e.g., require github.event_name
== 'workflow_dispatch' and exclude forked PRs by checking
github.event.pull_request.head.repo.full_name == github.repository) so no OIDC
token is minted for untrusted runs; additionally, when creating the GCP Workload
Identity Federation trust, constrain the allowed assertion.sub to the
workflow_dispatch-style subject (and optionally repository_owner) so
pull_request-shaped subjects are rejected; and if the workflow downloads and
runs remote installers (curl ... | sh), pin the artifact to a specific digest
and verify signatures before executing to reduce supply-chain risk.
---
Nitpick comments:
In @.github/workflows/claude-wif-test.yaml:
- Line 16: The workflow currently runs a uses:
actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 step even though no
later step in this job needs repository files; remove that uses:
actions/checkout... step from the job (or gate it behind a conditional if you
later add repo-dependent steps) so the job does not unnecessarily checkout the
repo and widen the workspace trust boundary.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 10c1fe6e-dac4-40d4-9638-f87022abdd59
📒 Files selected for processing (1)
.github/workflows/claude-wif-test.yaml
bryan-cox
force-pushed
the
test-arc-runners
branch
6 times, most recently
from
5d51185 to
ae2233b
Compare
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
bryan-cox
force-pushed
the
test-arc-runners
branch
from
ae2233b to
c431e17
Compare
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
|
@bryan-cox: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/lgtm |
|
Pipeline controller notification No second-stage tests were triggered for this PR. This can happen when:
Use |
|
/verified bypass |
openshift-ci-robot
added
the
verified
|
@bryan-cox: The DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/test-wif |
3 participants
Summary
itpc-identity-pool) instead of service account keysHow it works
google-github-actions/auth@v2exchanges it with GCP's WIF pool for temporary credentialsPrerequisites
openshiftorg must be in the WIF provider'srepository_ownerallowlistroles/aiplatform.usergranted to the principalSet on the target GCP projectTest plan
🤖 Generated with Claude Code
Summary by CodeRabbit