Skip to content

Commit 2d644b4

Browse files
lroollelroolle
committed
chore(ci): update workflows for stricter auth and Bedrock integration
- Restrict Claude triggers to repo owners, members, collaborators - Switch Claude actions to use Bedrock and Sonnet 4 via AWS OIDC - Add GitHub App token generation for secure checkout and API calls - Simplify Docker build cache config in release workflow - Add note on CLAUDE_CONFIG_DIR and fix gcloud config symlink in entrypoint
1 parent 72389a2 commit 2d644b4

4 files changed

Lines changed: 66 additions & 20 deletions

File tree

‎.github/workflows/claude-code-review.yml‎

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,31 +17,52 @@ jobs:
1717
github.event_name == 'pull_request' ||
1818
(github.event_name == 'issue_comment' &&
1919
github.event.issue.pull_request &&
20-
contains(github.event.comment.body, '@claude'))
20+
contains(github.event.comment.body, '@claude') &&
21+
(github.actor == github.repository_owner ||
22+
contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)))
2123
2224
runs-on: ubuntu-latest
2325
permissions:
2426
contents: read
2527
pull-requests: write
2628
issues: write
2729
id-token: write
30+
env:
31+
AWS_REGION: us-west-2
2832

2933
steps:
34+
- name: Generate GitHub App token
35+
id: app-token
36+
uses: actions/create-github-app-token@v2
37+
with:
38+
app-id: ${{ secrets.APP_ID }}
39+
private-key: ${{ secrets.APP_PRIVATE_KEY }}
40+
3041
- name: Checkout repository
3142
uses: actions/checkout@v4
3243
with:
44+
token: ${{ steps.app-token.outputs.token }}
3345
fetch-depth: 0
3446
ref: ${{ github.event.pull_request.head.sha || github.event.pull_request.merge_commit_sha }}
3547

48+
- name: Configure AWS Credentials (OIDC)
49+
uses: aws-actions/configure-aws-credentials@v4
50+
with:
51+
role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
52+
aws-region: us-west-2
53+
3654
- name: Run Claude Code Review
3755
id: claude-review
3856
uses: anthropics/claude-code-action@beta
57+
env:
58+
CLAUDE_CODE_MAX_OUTPUT_TOKENS: 8192
3959
with:
40-
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
41-
github_token: ${{ secrets.GITHUB_TOKEN }}
60+
use_bedrock: "true"
61+
model: "us.anthropic.claude-sonnet-4-20250514-v1:0"
62+
github_token: ${{ steps.app-token.outputs.token }}
4263

43-
# Optional: Specify model (defaults to Claude Sonnet 4, uncomment for Claude Opus 4)
44-
# model: "claude-opus-4-20250514"
64+
# Optional: Specify different Bedrock model (uncomment for Claude Opus 4)
65+
# model: "us.anthropic.claude-opus-4-20250514-v1:0"
4566

4667
# Direct prompt for automated review (no @claude mention needed)
4768
direct_prompt: |

‎.github/workflows/claude.yml‎

Lines changed: 36 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -13,30 +13,59 @@ on:
1313
jobs:
1414
claude:
1515
if: |
16-
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
17-
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
18-
(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
19-
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
16+
(
17+
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
18+
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
19+
(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
20+
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
21+
) && (
22+
github.actor == github.repository_owner ||
23+
(github.event_name == 'issue_comment' && contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)) ||
24+
(github.event_name == 'pull_request_review_comment' && contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)) ||
25+
(github.event_name == 'pull_request_review' && contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.review.author_association)) ||
26+
(github.event_name == 'issues' && contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.issue.author_association))
27+
)
2028
runs-on: ubuntu-latest
2129
permissions:
2230
contents: read
2331
pull-requests: read
2432
issues: read
2533
id-token: write
34+
env:
35+
AWS_REGION: us-west-2
36+
2637
steps:
38+
- name: Generate GitHub App token
39+
id: app-token
40+
uses: actions/create-github-app-token@v2
41+
with:
42+
app-id: ${{ secrets.APP_ID }}
43+
private-key: ${{ secrets.APP_PRIVATE_KEY }}
44+
2745
- name: Checkout repository
2846
uses: actions/checkout@v4
2947
with:
48+
token: ${{ steps.app-token.outputs.token }}
3049
fetch-depth: 1
3150

51+
- name: Configure AWS Credentials (OIDC)
52+
uses: aws-actions/configure-aws-credentials@v4
53+
with:
54+
role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
55+
aws-region: us-west-2
56+
3257
- name: Run Claude Code
3358
id: claude
3459
uses: anthropics/claude-code-action@beta
60+
env:
61+
CLAUDE_CODE_MAX_OUTPUT_TOKENS: 8192
3562
with:
36-
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
63+
use_bedrock: "true"
64+
model: "us.anthropic.claude-sonnet-4-20250514-v1:0"
65+
github_token: ${{ steps.app-token.outputs.token }}
3766

38-
# Optional: Specify model (defaults to Claude Sonnet 4, uncomment for Claude Opus 4)
39-
# model: "claude-opus-4-20250514"
67+
# Optional: Specify different Bedrock model (uncomment for Claude Opus 4)
68+
# model: "us.anthropic.claude-opus-4-20250514-v1:0"
4069

4170
# Optional: Customize the trigger phrase (default: @claude)
4271
# trigger_phrase: "/claude"

‎.github/workflows/release.yml‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -56,12 +56,8 @@ jobs:
5656
push: true
5757
tags: ${{ steps.meta.outputs.tags }}
5858
labels: ${{ steps.meta.outputs.labels }}
59-
cache-from: |
60-
type=gha
61-
type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
62-
cache-to: |
63-
type=gha,mode=max
64-
type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
59+
cache-from: type=gha
60+
cache-to: type=gha,mode=max
6561

6662
release:
6763
name: Create GitHub Release

‎docker-entrypoint.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,7 @@ setup_nonroot_user() {
9292
# Make /root fully accessible - Claude needs permissions to work
9393
chmod 755 /root 2>/dev/null || true
9494

95+
# TODO: claude does support CLAUDE_CONFIG_DIR
9596
# Essential: Handle .claude directory
9697
if [ -d "/root/.claude" ]; then
9798
[ "$VERBOSE" = "true" ] && echo "[entrypoint] linking .claude"
@@ -111,7 +112,6 @@ setup_nonroot_user() {
111112
[ "$VERBOSE" = "true" ] && echo "[entrypoint] linking .config/gcloud"
112113
mkdir -p "$CLAUDE_HOME/.config"
113114
chmod -R 755 /root/.config/gcloud 2>/dev/null || true
114-
ln -sfn /root/.config/gcloud "$CLAUDE_HOME/.config/gcloud"
115115
fi
116116

117117
# Common: AWS credentials
@@ -128,7 +128,7 @@ setup_nonroot_user() {
128128
if [ -e "$item" ] && [ "$item" != "/root/." ] && [ "$item" != "/root/.." ]; then
129129
basename_item=$(basename "$item")
130130
case "$basename_item" in
131-
.claude | .aws | .config)
131+
.claude | .aws )
132132
continue
133133
;;
134134
*)

0 commit comments

Comments
 (0)