From c99c72509c3c75659e7f408d721277ad59015187 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 20 Jul 2026 09:02:16 +0000 Subject: [PATCH 1/2] ci: authenticate @claude workflow with Claude subscription token Switch the @claude PR responder from ANTHROPIC_API_KEY (pay-per-use API billing) to CLAUDE_CODE_OAUTH_TOKEN, so runs are authenticated against a Claude subscription (Claude Code usage). The token is minted locally with `claude setup-token` and stored as the CLAUDE_CODE_OAUTH_TOKEN repository secret; the job still skips gracefully with a warning when the secret is absent. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_0164nBbEeLzQWWZqBn95o3MW --- .github/workflows/claude.yml | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 02225d27e..73fb3fe61 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -49,20 +49,23 @@ jobs: env: # Assigned to job env so a step-level `if` can detect an unconfigured # secret and skip gracefully instead of hard-failing the check. - ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} + # Authenticates against a Claude subscription (Claude Code usage) rather + # than pay-per-use API billing. Mint it locally with `claude setup-token` + # and store it as the CLAUDE_CODE_OAUTH_TOKEN repository secret. + CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} steps: - - name: Warn when the API key is not configured - if: ${{ env.ANTHROPIC_API_KEY == '' }} - run: echo "::warning title=Claude::ANTHROPIC_API_KEY secret is not configured; skipping. Add ANTHROPIC_API_KEY (or switch the action input to claude_code_oauth_token) in repository secrets so @claude mentions are handled." + - name: Warn when the OAuth token is not configured + if: ${{ env.CLAUDE_CODE_OAUTH_TOKEN == '' }} + run: echo "::warning title=Claude::CLAUDE_CODE_OAUTH_TOKEN secret is not configured; skipping. Generate it with 'claude setup-token' and add it as a repository secret so @claude mentions are handled by your Claude subscription." - name: Checkout repository - if: ${{ env.ANTHROPIC_API_KEY != '' }} + if: ${{ env.CLAUDE_CODE_OAUTH_TOKEN != '' }} uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 1 - name: Run Claude Code - if: ${{ env.ANTHROPIC_API_KEY != '' }} + if: ${{ env.CLAUDE_CODE_OAUTH_TOKEN != '' }} uses: anthropics/claude-code-action@af0559ee4f514d1ef21826982bed13f7edc3c35e # v1.0.178 with: # The action's default trigger phrase is "@claude"; it reads the # triggering comment/review and acts on the current PR head. - anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} + claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} From 1344a13ac891b49bc37f7cdbe0e23fcdf9c2778a Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 20 Jul 2026 09:08:16 +0000 Subject: [PATCH 2/2] docs(prompt): require freshness check before reusing a pre-provisioned worktree Tighten the worktree-per-task guidance in the /prompt skill so a pre-provisioned worktree is verified (current branch, clean git status, and merge base against the latest remote default branch) before it is trusted as fresh, instead of being used as-is. Addresses the CodeRabbit worktree-base finding from #959; the base could otherwise be stale. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_0164nBbEeLzQWWZqBn95o3MW --- .claude/skills/prompt/references/coding-workflow.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.claude/skills/prompt/references/coding-workflow.md b/.claude/skills/prompt/references/coding-workflow.md index 692d09a0c..010da13e7 100644 --- a/.claude/skills/prompt/references/coding-workflow.md +++ b/.claude/skills/prompt/references/coding-workflow.md @@ -18,7 +18,7 @@ Higher-priority instructions and the repository's own `AGENTS.md` / `CLAUDE.md` - Name the branch with a short kebab-case phrase that identifies the task, following the repository's existing prefix convention when one exists. - Inspect first: current branch, upstream, other worktrees, and `git status`. Never assume the branch or remote. - Do not commit directly to a protected or base branch (`main`, `master`, `develop`, `release/*`). If you find yourself on one, create the worktree/branch above before editing. -- If the environment already placed you in a dedicated per-task worktree on a fresh branch, use it as-is; do not nest another one. +- If the environment already placed you in a dedicated per-task worktree, verify it before trusting it as fresh: confirm the current branch, a clean `git status`, and that its merge base matches the latest remote default branch (`git fetch` first). Use it as-is only when those checks pass; otherwise create a new worktree and branch as above. Do not nest another worktree inside a verified one. - Preserve unrelated staged, unstaged, and untracked work. Do not stash, reset, clean, or discard changes you did not create. - Commit or push only when the task explicitly asks for it. Never force-push, rebase shared history, delete branches, or merge into a base branch without explicit confirmation.