ClaudeCommentNot executed· 1 caveat

@claude assistant via Workload Identity Federation (no long-lived API key)

The standard @claude assistant for issues, PR comments and reviews, but it signs in with GitHub OIDC (Workload Identity Federation) instead of a long-lived ANTHROPIC_API_KEY secret. It needs a one-time federation setup in the Claude Console.

issue_comment / pull_request_review_comment containing @claude (+ issues: opened, assigned; reviews)

Copy agent prompt Get the YAML Source ↗

How it works

From event to result

Trigger: GitHub starts a run when someone comments on a pull request review, someone comments on an issue, or an issue is opened or assigned.
Agent: Claude Code, via anthropics/claude-code-action.
What it does: The standard @claude assistant for issues, PR comments and reviews, but it signs in with GitHub OIDC (Workload Identity Federation) instead of a long-lived ANTHROPIC_API_KEY secret. It needs a one-time federation setup in the Claude Console.
What you get: This listing does not state a pull request or a comment. Read the prompt, and treat the result as not executed.

Setup

Where to paste this

Create .github/workflows/claude-code-action-claude-wif.yml
Paste the workflow below into that file. The notes beside the YAML are not part of the file.
This file does not name a repository secret. If the engine needs a credential, the name is not written here. Check that engine’s docs before you add one.

Let your agent do it

Copy a prompt for Claude Code, Codex, or Cursor.

Paste it into your coding agent in this repo. It does the setup and asks before anything leaves your machine.

Runs the same job in your agent session, on the plan you are signed in with. No API key, no Action.

Do the job of the "@claude assistant via Workload Identity Federation (no long-lived API key)" workflow from AgentFlows (https://agentflows.sh/flows/claude-code-action-claude-wif) right here, in this session, using the plan I'm signed in with. No API key and no GitHub Action.

What it does: The standard @claude assistant for issues, PR comments and reviews, but it signs in with GitHub OIDC (Workload Identity Federation) instead of a long-lived ANTHROPIC_API_KEY secret. It needs a one-time federation setup in the Claude Console.

The workflow normally runs on: issue_comment / pull_request_review_comment containing @claude (+ issues: opened, assigned; reviews). Instead, ask me which pull request, issue, or branch to work on, then follow these instructions:

```text
The standard @claude assistant for issues, PR comments and reviews, but it signs in with GitHub OIDC (Workload Identity Federation) instead of a long-lived ANTHROPIC_API_KEY secret. It needs a one-time federation setup in the Claude Console.
```

Use the gh CLI for anything on GitHub, and show me what you plan to post or change before you do it.

The file

Workflow YAML

Copy the file as-is. The notes beside each block explain it.

.github/workflows/claude-code-action-claude-wif.yml

Name

The name GitHub shows in the Actions tab. The file path is under Where to paste this.

1name: Claude Code (Workload Identity Federation)23# Authenticates to the Claude API by exchanging the workflow's GitHub OIDC4# token for a short-lived access token — no ANTHROPIC_API_KEY secret needed.5# One-time Console setup (issuer, service account, federation rule):6# https://platform.claude.com/docs/en/manage-claude/workload-identity-federation7# See also docs/setup.md#workload-identity-federation in this repository.8

Trigger

GitHub starts a run when someone comments on a pull request review, someone comments on an issue, or an issue is opened or assigned.

9on:10  issue_comment:11    types: [created]12  pull_request_review_comment:13    types: [created]14  issues:15    types: [opened, assigned]16  pull_request_review:17    types: [submitted]18

Jobs

Each job is one runner. The steps inside it run top to bottom.

19jobs:20  claude:21    if: |22      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||23      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||24      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||25      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))26    runs-on: ubuntu-latest

Permissions

This token may push commits, comment on pull requests and open them, and comment on issues and change labels. Anything not listed is not granted.

27    permissions:28      contents: write29      pull-requests: write30      issues: write31      id-token: write # Required: used to fetch the GitHub OIDC token for the federation exchange32      actions: read # Required for Claude to read CI results on PRs

Steps

These steps run in order on that job.

33    steps:34      - name: Checkout repository35        uses: actions/checkout@v636        with:37          fetch-depth: 13839      - name: Run Claude Code40        id: claude

Agent

Runs Claude Code with anthropics/claude-code-action@v1. Inputs: anthropic_federation_rule_id; anthropic_organization_id; anthropic_service_account_id.

41        uses: anthropics/claude-code-action@v142        with:43          # These values are identifiers, not secrets — they can live directly44          # in the workflow file or in repository variables.45          anthropic_federation_rule_id: fdrl_xxxxxxxxxxxx46          anthropic_organization_id: 00000000-0000-0000-0000-00000000000047          anthropic_service_account_id: svac_xxxxxxxxxxxx4849          # Optional: only needed when the federation rule targets more than50          # one workspace.51          # anthropic_workspace_id: wrkspc_xxxxxxxxxxxx5253          # Optional: audience requested on the GitHub OIDC token. Defaults to54          # https://api.anthropic.com — only set this if your federation rule55          # expects a different audience.56          # anthropic_oidc_audience: https://example.com/custom-audience

Keep going

More workflows

All workflows

ClaudePull request
01
Claude auto PR review
Copied from the official Solutions Guide basic example (prompt shortened).
pull_request: opened, synchronize
Est. cost per run~$0.18Checked Oct 16, 2026
Not executed
ClaudePull request
02
Claude PR review with progress tracking
`track_progress: true` posts a checkbox tracking comment (per Solutions Guide).
pull_request: opened, synchronize, ready_for_review, reopened
Est. cost per run~$0.22Checked Oct 16, 2026
Not executed
ClaudeComment
03
@claude mention assistant on issues and PRs
No `prompt` → the action runs in tag/interactive mode and responds to the comment. `trigger_phrase` default is `@claude` (usage.md).
issue_comment / pull_request_review_comment containing @claude
Est. cost per run~$0.27Checked Oct 16, 2026
Not executed· 1 caveat