feat(auth): make claude-api-key optional so the action can run keyless (NEX-2513)

[waleedzafar68]

Why

Every repo in the org is moving off static Anthropic API keys to workload identity federation (NEX-2513 step 2). This action is the last consumer that hard-fails without claude-api-key, so it alone keeps a static key alive in repo secrets.

What changes

Cherry-picks upstream anthropics/claude-code-security-review#116 by @ralphpina — open against an upstream main that has not moved since 2026-02-11, so we carry it here.

• action.yml — claude-api-key becomes required: false, and the scan step unsets an empty ANTHROPIC_API_KEY instead of exiting 1. An empty-but-set value outranks keyless auth, so the unset is what makes federation reachable at all. It sits in the same run: block as the scan, so it covers both the python process and the claude it spawns.
• claudecode/claude_api_client.py — construct Anthropic() with no key when none is present and let the SDK resolve environment credentials, instead of raising ValueError.
• claudecode/github_action_audit.py — validate_claude_available() accepts a static credential or federation env, with an error message naming both.

Passing claude-api-key behaves exactly as before — this only adds a fallback path when it is absent.

Two fork-local fixes on top of the upstream patch:

• the conflict against our cost-metrics change (Report scan cost: Claude Code cost/usage envelope plus filter token usage #3) is resolved by keeping the keyless client construction and our usage / _record_usage block;
• logger.info("Claude API client initialized successfully") had ended up as the last statement of _record_usage in Report scan cost: Claude Code cost/usage envelope plus filter token usage #3, so it logged on every API response. Moved back into __init__.

How the caller authenticates

The action deliberately does not mint the OIDC token itself. The calling workflow (vuln-synthesis-agent/ai-security-scan) sets up federation the way anthropics/claude-code-action does: the GitHub OIDC token is written to a file with ANTHROPIC_IDENTITY_TOKEN_FILE pointing at it, plus a minimal profile under ANTHROPIC_CONFIG_DIR.

The profile is not cosmetic. A GitHub assertion carries a jti and our federation issuer has check_jti: true, so one assertion buys exactly one token exchange. This action starts more than one Anthropic client per run — the claude CLI (up to 3 retry processes in _run_claude_code) plus the Python false-positive filter — and resolving federation through a profile turns on the SDK's on-disk credentials cache so they share a single exchanged token. Bare env-var federation would 401 with jti_reused on the second consumer.

Verified

• py_compile on both changed modules, action.yml parses as valid YAML.
• Key-present path unchanged (same Anthropic(api_key=...) construction).
• The federated bearer itself is already proven against this org's rules: exchange 200, /v1/messages 200, /v1/messages/batches 200 — with no anthropic-beta: oauth-2025-04-20 header, confirming it is not required for a federated token.
• The keyless path end-to-end is validated by a real PR scan with no key on the consumer side, not by this repo's CI.

🤖 Generated with Claude Code