Replace gh-aw workflow with claude-code-action for vault secrets#2544
Merged
Replace gh-aw workflow with claude-code-action for vault secrets#2544
Conversation
Replaces the gh-aw (GitHub Agentic Workflow) with a plain GitHub Actions workflow using anthropics/claude-code-action@v1. This solves vault-sourced secret handling where gh-aw's compiler hardcodes ${{ secrets.ANTHROPIC_API_KEY }} (empty with vault), blocking both the agent and detection jobs. The new workflow:
- Passes vault-exported ANTHROPIC_API_KEY directly to claude-code-action via ${{ env.ANTHROPIC_API_KEY }}
- Enables use_commit_signing for secure API-based commits to the PR branch
- Restricts git tools to read-only operations (log, diff, show, status)
- Eliminates the 6-job pipeline (detection, safe_outputs, conclusion) with claude-code-action's native PR commenting
- Passes zizmor security audit (pedantic mode)
- Maintains all OBI analysis capabilities with explicit safety constraints
Closes gh-aw limitations with vault while improving security via minimal permissions and read-only git access.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The action's built-in OIDC exchange requires the Claude Code GitHub App (github.com/apps/claude) to be installed on the repo. Instead, use grafana's create-github-app-token to get a token from grafana-beyla-bot (same pattern as bot_sync-obi-submodule.yml) and pass it via github_token to bypass the built-in app authentication. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2544 +/- ##
==========================================
+ Coverage 48.62% 48.68% +0.06%
==========================================
Files 53 53
Lines 4027 4028 +1
==========================================
+ Hits 1958 1961 +3
+ Misses 1934 1933 -1
+ Partials 135 134 -1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces the gh-aw (GitHub Agentic Workflow) with a plain GitHub Actions workflow using
anthropics/claude-code-action@v1. This solves a fundamental incompatibility with HashiCorp Vault-sourced secrets (example failure).Problem: gh-aw's compiler hardcodes
${{ secrets.ANTHROPIC_API_KEY }}in validate and execution steps. When secrets come from Vault (exported to$GITHUB_ENV), GitHub Actions step-levelenv:takes precedence, overriding the vault value with empty. This broke both the agent job and the auto-generated detection job.Solution: Pass vault-exported secrets directly to claude-code-action via
${{ env.ANTHROPIC_API_KEY }}. The new workflow:use_commit_signingfor secure API-based commits to PR branchesFiles changed: Deleted 1226 lines (gh-aw source + compiled output), added 109 lines (new workflow).
🤖 Generated with Claude Code
Requires: