Repository navigation
ci(review): use Anthropic workload identity federation, fall back to the stored key - #449
Merged
Merged
Conversation
…the stored key (#448) The Cora Review job exchanges its GitHub OIDC token for a short-lived Anthropic access token when the four ANTHROPIC_* federation identifiers are available, and sends it only to api.anthropic.com. Without them, or when the exchange fails, it uses the CORA_* secrets as before; an empty secret now fails the job. Adds the manual anthropic-wif-smoke workflow and documents the setup in CONTRIBUTING. Ported from codecoradev/cora-code#700.
🔍 Cora AI Code Review✅ No issues found. Code looks good! Review powered by cora-code · BYOK · MIT |
A manual run from any branch would need a federation rule that trusts every branch subject; pinning it to develop lets the rule allow exactly ref:refs/heads/develop.
Contributor
Author
|
On hold until codecoradev/cora-code#701 is fixed. The federation exchange works (run 40462794838 logs |
ajianaz
marked this pull request as draft
October 27, 2026 06:48
ajianaz
marked this pull request as ready for review
October 28, 2026 00:35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The Cora Review job exchanges its GitHub OIDC token for a short-lived Anthropic access token (workload identity federation) when
ANTHROPIC_FEDERATION_RULE_ID,ANTHROPIC_ORGANIZATION_ID,ANTHROPIC_SERVICE_ACCOUNT_IDandANTHROPIC_WORKSPACE_IDare available. Without them, or when the exchange fails, it uses theCORA_*secrets as before.Closes #448. Ported from codecoradev/cora-code#700.
Why
A stored API key can leak and does not expire; the exchanged token lives for one job.
Changes
.github/workflows/cora-review.yml:id-token: write; an exchange step (continue-on-error, warning only) that keeps the OIDC token in its own shell and exports only the short-lived token; a guard that fails the job when neither federation nor theCORA_*secrets are available; with a federation token, key, base URL (https://api.anthropic.com/v1) and model (ANTHROPIC_MODEL, defaultclaude-opus-5-5) switch together, so the token never goes toCORA_BASE_URL..github/workflows/anthropic-wif-smoke.yml: manual (workflow_dispatch) check of the exchange and a Bearer call to/v1/chat/completions; prints HTTP statuses only.CONTRIBUTING.md: credential setup, including the numeric-id subject prefix gotcha.Testing
should_block: false.pull_request, so this PR's own Cora Review run exercises the new workflow: the federated path if the Anthropic federation rule allowsrepo:codecoradev@<id>/tole@<id>:pull_request, otherwise the fallback with a warning.