Support keyless / environment-based authentication (Workload Identity Federation)

[ralphpina]

Summary

Makes claude-api-key optional so the action can authenticate keylessly via credentials the Anthropic SDK and Claude CLI already resolve from the environment — most importantly Workload Identity Federation (WIF), but also ANTHROPIC_AUTH_TOKEN, Amazon Bedrock / Google Vertex, or an ant profile.

Motivation

Organizations moving off static Anthropic API keys (to WIF / short-lived OIDC-exchanged tokens) can already run anthropics/claude-code-action keylessly — but not claude-code-security-review. It requires claude-api-key and hard-fails without it, which forces a static key to stay in repo secrets. On a repo that otherwise runs fully keyless, this one action blocks revoking the last static key.

What changed (all backward compatible)

1. action.yml — claude-api-key is now required: false. When no key is provided, the scan step unsets the (empty) ANTHROPIC_API_KEY — an empty-but-set value otherwise takes precedence over keyless auth in the SDK and breaks it.
2. claudecode/claude_api_client.py — when no explicit/env key is present, construct Anthropic() with no api_key and let the SDK auto-detect environment credentials, instead of raising ValueError.
3. claudecode/github_action_audit.py — validate_claude_available() accepts a static credential or WIF env (ANTHROPIC_FEDERATION_RULE_ID / ANTHROPIC_ORGANIZATION_ID / ANTHROPIC_SERVICE_ACCOUNT_ID) / ANTHROPIC_AUTH_TOKEN, with an updated error message.

Providing claude-api-key behaves exactly as before — this only adds a fallback path when it's absent.

Using keyless auth (WIF example)

The action deliberately does not mint the OIDC token itself (keeps it minimal and provider-agnostic); the calling workflow sets the WIF env before invoking it:

permissions:
  id-token: write   # allow minting the GitHub OIDC token
jobs:
  security-review:
    steps:
      - uses: anthropics/claude-code-security-review@<sha>
        # no claude-api-key
        env:
          ANTHROPIC_FEDERATION_RULE_ID: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
          ANTHROPIC_ORGANIZATION_ID:    ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
          ANTHROPIC_SERVICE_ACCOUNT_ID: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
          ANTHROPIC_IDENTITY_TOKEN:     ${{ steps.oidc.outputs.token }}  # GH OIDC token, audience https://api.anthropic.com

Testing

• py_compile on both changed modules ✅; action.yml parses as valid YAML ✅.
• Key-present path is unchanged (same Anthropic(api_key=...) construction, same validation result).
• ⚠️ I could not run the action's CI or a live WIF GitHub Actions run end-to-end in my environment — the keyless path needs a WIF-configured repo plus your CI to validate. Happy to iterate on anything.

🤖 Generated with Claude Code