[pull] main from anthropics:main

.github/workflows/claude-link-review.yml

@@ -23,6 +23,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write # Anthropic Workload Identity Federation
     steps:
       - name: Set PR number
         id: pr-number
@@ -66,9 +67,14 @@ jobs:
 
       - name: Run Claude Link Review
         if: steps.changed-files.outputs.has_files == 'true'
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@bbfaf8e1ffe3e688f7ab65ceee78de241e24a238 # v1.0.132 (>=v1.0.130 for WIF inputs)
         with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          # Anthropic auth via Workload Identity Federation — the action
+          # exchanges this job's GitHub OIDC token (id-token: write above)
+          # for a short-lived access token instead of a static API key.
+          anthropic_federation_rule_id: fdrl_01SqmTwzmEE547mtaYN1mqHL
+          anthropic_organization_id: 1ec12c5c-6542-4da8-bf2f-c15919aef01c
+          anthropic_service_account_id: svac_01BHcCBa1UWFvNrHMqJjuaUZ
           github_token: ${{ secrets.GITHUB_TOKEN }}
           prompt: |
             /link-review

.github/workflows/claude-model-check.yml

@@ -17,6 +17,7 @@ on:
 permissions:
   contents: read
   pull-requests: write
+  id-token: write # Anthropic Workload Identity Federation
 
 jobs:
   model-check:
@@ -67,9 +68,14 @@ jobs:
 
       - name: Claude Model Validation
         if: steps.changed-files.outputs.has_files == 'true'
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@bbfaf8e1ffe3e688f7ab65ceee78de241e24a238 # v1.0.132 (>=v1.0.130 for WIF inputs)
         with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          # Anthropic auth via Workload Identity Federation — the action
+          # exchanges this job's GitHub OIDC token (id-token: write above)
+          # for a short-lived access token instead of a static API key.
+          anthropic_federation_rule_id: fdrl_01SqmTwzmEE547mtaYN1mqHL
+          anthropic_organization_id: 1ec12c5c-6542-4da8-bf2f-c15919aef01c
+          anthropic_service_account_id: svac_01BHcCBa1UWFvNrHMqJjuaUZ
           github_token: ${{ secrets.GITHUB_TOKEN }}
           prompt: |
             /model-check

.github/workflows/claude-pr-review.yml

@@ -24,6 +24,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write # Anthropic Workload Identity Federation
     steps:
       - name: Set PR number
         id: pr-number
@@ -41,9 +42,14 @@ jobs:
           ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/pull/{0}/head', inputs.pr_number) || '' }}
 
       - name: Run Claude PR Review
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@bbfaf8e1ffe3e688f7ab65ceee78de241e24a238 # v1.0.132 (>=v1.0.130 for WIF inputs)
         with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          # Anthropic auth via Workload Identity Federation — the action
+          # exchanges this job's GitHub OIDC token (id-token: write above)
+          # for a short-lived access token instead of a static API key.
+          anthropic_federation_rule_id: fdrl_01SqmTwzmEE547mtaYN1mqHL
+          anthropic_organization_id: 1ec12c5c-6542-4da8-bf2f-c15919aef01c
+          anthropic_service_account_id: svac_01BHcCBa1UWFvNrHMqJjuaUZ
           github_token: ${{ secrets.GITHUB_TOKEN }}
           prompt: |
             /review-pr-ci ${{ steps.pr-number.outputs.number }}

.github/workflows/lint-format.yml

@@ -17,6 +17,7 @@ on:
 permissions:
   contents: read
   pull-requests: write
+  id-token: write # Anthropic Workload Identity Federation
 
 jobs:
   lint-and-format:
@@ -117,9 +118,14 @@ jobs:
           github.event.pull_request.head.repo.full_name == github.repository &&
           (steps.format-check.outputs.has_format_issues == 'true' ||
            steps.lint-check.outputs.has_lint_issues == 'true')
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@bbfaf8e1ffe3e688f7ab65ceee78de241e24a238 # v1.0.132 (>=v1.0.130 for WIF inputs)
         with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          # Anthropic auth via Workload Identity Federation — the action
+          # exchanges this job's GitHub OIDC token (id-token: write above)
+          # for a short-lived access token instead of a static API key.
+          anthropic_federation_rule_id: fdrl_01SqmTwzmEE547mtaYN1mqHL
+          anthropic_organization_id: 1ec12c5c-6542-4da8-bf2f-c15919aef01c
+          anthropic_service_account_id: svac_01BHcCBa1UWFvNrHMqJjuaUZ
           github_token: ${{ secrets.GITHUB_TOKEN }}
           prompt: |
             The linting and formatting checks found issues.

.github/workflows/notebook-quality.yml

@@ -14,6 +14,7 @@ on:
 permissions:
   contents: read
   pull-requests: write
+  id-token: write # Anthropic Workload Identity Federation
 
 jobs:
   validate-notebooks:
@@ -55,9 +56,14 @@ jobs:
 
       - name: Summarize validation issues with Claude
         if: github.event_name == 'pull_request' && steps.validate.outputs.has_issues == 'true'
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@bbfaf8e1ffe3e688f7ab65ceee78de241e24a238 # v1.0.132 (>=v1.0.130 for WIF inputs)
         with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          # Anthropic auth via Workload Identity Federation — the action
+          # exchanges this job's GitHub OIDC token (id-token: write above)
+          # for a short-lived access token instead of a static API key.
+          anthropic_federation_rule_id: fdrl_01SqmTwzmEE547mtaYN1mqHL
+          anthropic_organization_id: 1ec12c5c-6542-4da8-bf2f-c15919aef01c
+          anthropic_service_account_id: svac_01BHcCBa1UWFvNrHMqJjuaUZ
           github_token: ${{ secrets.GITHUB_TOKEN }}
           prompt: |
             The notebook validation found these issues:
@@ -82,6 +88,11 @@ jobs:
           PR_NUMBER: ${{ github.event.pull_request.number }}
 
       # Only run API tests on main branch or for maintainers (costs money)
+      # TODO: this step still reads the static ANTHROPIC_API_KEY secret. The
+      # claude-code-action steps above use Workload Identity Federation; this
+      # direct-API step needs a separate inline OIDC mint+exchange (or the
+      # anthropic SDK's WIF env-var trio). Non-fatal in the meantime — each
+      # notebook execution failure is caught by the `|| echo` below.
       - name: Execute notebooks (API Testing)
         if: |
           github.event_name == 'push' || 

.github/workflows/notebook-tests.yml

@@ -16,6 +16,7 @@ on:
 permissions:
   contents: read
   pull-requests: write
+  id-token: write # Anthropic Workload Identity Federation
 
 jobs:
   test-notebooks:
@@ -126,9 +127,14 @@ jobs:
           github.event_name == 'pull_request' &&
           steps.changed-notebooks.outputs.has_notebooks == 'true' &&
           steps.structure-tests.outputs.has_failures == 'true'
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@bbfaf8e1ffe3e688f7ab65ceee78de241e24a238 # v1.0.132 (>=v1.0.130 for WIF inputs)
         with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          # Anthropic auth via Workload Identity Federation — the action
+          # exchanges this job's GitHub OIDC token (id-token: write above)
+          # for a short-lived access token instead of a static API key.
+          anthropic_federation_rule_id: fdrl_01SqmTwzmEE547mtaYN1mqHL
+          anthropic_organization_id: 1ec12c5c-6542-4da8-bf2f-c15919aef01c
+          anthropic_service_account_id: svac_01BHcCBa1UWFvNrHMqJjuaUZ
           github_token: ${{ secrets.GITHUB_TOKEN }}
           prompt: |
             The notebook tests found issues in the changed notebooks.
@@ -157,6 +163,11 @@ jobs:
         env:
           PR_NUMBER: ${{ github.event.pull_request.number }}
 
+      # TODO: this step still reads the static ANTHROPIC_API_KEY secret. The
+      # claude-code-action step above uses Workload Identity Federation; this
+      # direct-API step needs a separate inline OIDC mint+exchange (or the
+      # anthropic SDK's WIF env-var trio). Gracefully skips when the secret
+      # is absent (the `[ -z "$ANTHROPIC_API_KEY" ]` guard below).
       - name: Run notebook execution tests (maintainers only)
         id: execution-tests
         if: |