You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The single-developer CI wedge is still valid — but enforcement context matters.
Anthropic's February 19–20, 2026 ToS update explicitly banned OAuth tokens from Claude Free/Pro/Max subscriptions in any third-party tool, including the Agent SDK. April 4, 2026 marked actual enforcement: subscriptions no longer cover third-party agent harnesses (OpenClaw being the highest-profile casualty). The context matters because this plugin's entire value proposition rests on a carve-out that survived: the official claude setup-token → CLAUDE_CODE_OAUTH_TOKEN path for personal CI is explicitly documented and permitted at code.claude.com/docs/en/authentication.
The test Anthropic now applies publicly: "one human, one subscription, one beneficiary." Single-developer personal repos using CLAUDE_CODE_OAUTH_TOKEN as a repo secret remain safe. Multi-tenant products, team pooling without Team seats, and anything that resells Claude or runs on someone else's behalf are banned.
One nuance to watch: Anthropic's own code.claude.com/docs/en/github-actions documents anthropics/claude-code-action with only ANTHROPIC_API_KEY — no mention of the OAuth path. The OAuth-for-CI route is only documented in the authentication page. This gap creates onboarding confusion and remains the best argument for this plugin existing: it navigates that gap on behalf of the user.
No new policy changes this week beyond the April 4 enforcement that is now settled.
Claude Code Plugin Ecosystem
Significant ecosystem growth; two feature additions directly relevant to this plugin.
Claude Code shipped --plugin-url (fetch a plugin archive from URL for the current session) and updated --plugin-dir to accept .zip archives. Both are useful for distributing this plugin without requiring marketplace listing — internal artifact stores or a GitHub release attachment now suffice.
The official Anthropic-managed directory is at anthropics/claude-plugins-official. As of May 2026, hesreallyhim/awesome-claude-code (36.8k stars) remains the canonical community index; quemsah/awesome-claude-plugins now indexes 15,134 plugin repos by automated crawl. obra/superpowers (94k stars) was officially accepted into the Anthropic skills marketplace in April — the first community framework to reach first-class status.
anthropics/claude-code-action shipped v1.0 GA with breaking input changes from the beta:
Beta input
v1.0 input
direct_prompt
prompt
mode: "tag"
(auto-detected, removed)
custom_instructions
claude_args: --append-system-prompt
max_turns
claude_args: --max-turns
Any install documentation that references anthropics/claude-code-action@beta inputs is now stale.
Claude Code Auto Mode shipped with subagent safety checks: outbound validation before delegation, return checks on agent execution history to detect prompt injection. Relevant for the agent-team catalog pattern this repo ships.
gh-aw Upstream Activity
Latest release: v0.71.5 (May 5, 2026). One fix directly affects this repo's compiled workflows.
This repo's version gap
.github/aw/actions-lock.json (verified at line 23–27) pins:
The retired-for-billing range is v0.68.4–v0.71.3. v0.68.3 is one patch below the retired floor — technically not retired, but it misses every improvement shipped across v0.68.4 through v0.71.5. The most operationally important fix in that span:
v0.71.5: CLAUDE_CODE_DISABLE_FAST_MODE=1 is now automatically injected to prevent mid-session crashes introduced by Claude Code 2.1.120+. Without this, workflows using the claude engine crash with "Fast mode unavailable" mid-run. All three compiled lock files in this repo (daily-repo-status, update-docs, weekly-research) are affected.
Other notable changes since v0.68.3
pre-agent-steps frontmatter field — run custom GitHub Actions steps before the agent starts (auth, env setup). Directly useful for the OAuth token setup this plugin performs.
engine.bare: true — skip loading AGENTS.md; clean for triage/reporting workflows.
OpenCode engine — engine: opencode is now a first-class option alongside claude, copilot, codex.
MCP config relocation — .mcp.json (repo root) moved to .github/mcp.json. Any future MCP config this repo ships should use the new path.
persist-credentials: false codemod — gh aw fix --write now auto-remediates actions/checkout steps missing this flag.
Frontmatter defaults raised — max-runs now defaults to 100, max-effective-tokens to 25M; both fields now accept GitHub Actions expressions.
Token optimization guide — .github/aw/token-optimization.md added with DataOps, cli-proxy, inline sub-agents, and A/B experiment (experiments.prompt_style) techniques.
Five new workflow templates shipped: approach-validator, test-quality-sentinel, refactoring-cadence, architecture-guardian, design-decision-gate. These governance/quality templates are a strong fit for solo founders who need architectural guardrails without a full team. The /discover-workflows skill's catalog awareness should include these.
Competitive Landscape
No direct "workflow discovery" competitor found. Indirect pressure from two directions.
A community OAuth GitHub Action (grll/claude-code-action with claude_access_token / claude_refresh_token inputs) has emerged to fill the gap that anthropics/claude-code-action@v1 left by documenting only ANTHROPIC_API_KEY. It targets the same audience as this plugin's OAuth install path, without the full discovery/install flow. Upstream issue anthropics/claude-code-action#727 requests official refresh token support for Max subscribers — if Anthropic ships that, the community OAuth action may be absorbed upstream, removing one competitor.
Peli's Agent Factory (showcasing 50+ specialized agentic workflows) continues to be the closest thing to a workflow discovery catalog, but has no install automation — it's a showcase, not a plugin.
No fork of gh-aw that re-adds OAuth in ways that violate ToS was found. zircote/aw-author had no public activity indexed this week.
Subscription-backed CI Signals
Community confusion is at high tide; no new policy tightening.
The $1,800 accidental API billing incident circulating in community posts (dev thought they were on a subscription path; ANTHROPIC_API_KEY in shell environment took precedence per Claude Code's auth precedence order) illustrates that the authentication precedence chain confuses developers. The order is: cloud provider → ANTHROPIC_AUTH_TOKEN → ANTHROPIC_API_KEY → apiKeyHelper → CLAUDE_CODE_OAUTH_TOKEN. An ANTHROPIC_API_KEY set anywhere in the environment silently overrides the OAuth token. This plugin's auth.md handles this correctly (it guides users to avoid this), but it's worth making the precedence table more prominent.
No new Anthropic policy moves since April 4 enforcement. The settled state: personal single-dev CI is safe; everything else is API key territory.
Strategic Suggestions
1. Run gh aw update to bring compiled lock files to v0.71.5.
The compiled workflows (daily-repo-status.lock.yml, update-docs.lock.yml, weekly-research.lock.yml) were generated from v0.68.3. The CLAUDE_CODE_DISABLE_FAST_MODE=1 fix in v0.71.5 is needed to prevent mid-session crashes on Claude Code 2.1.120+. Without it, these workflows will fail intermittently when Claude's server-side fast-mode flag is toggled on. Running gh aw update regenerates all lock files and updates actions-lock.json to v0.71.5. This is also a credibility signal — the repo that teaches people to install gh-aw workflows should itself be running the current version.
2. Add auth precedence table to auth.md with explicit "watch out" for ANTHROPIC_API_KEY in environment.
The $1,800 billing incident is not a fringe case — it happens when a developer has ANTHROPIC_API_KEY exported in their shell profile and the GitHub Actions secret inherits it via env:. auth.md (skills/install-workflow/auth.md) already has solid ToS boundary language, but adding a one-line callout — "if ANTHROPIC_API_KEY is set anywhere in the Actions environment, it silently overrides CLAUDE_CODE_OAUTH_TOKEN" — would prevent support confusion and reinforce the plugin's value as an expert guide.
3. Expand /discover-workflows catalog awareness to include the five new governance templates from githubnext/agentics.
approach-validator, test-quality-sentinel, refactoring-cadence, architecture-guardian, design-decision-gate shipped in April and are not yet in the skill's recommendation set. Solo founders with growing codebases are exactly the audience for "architecture guardian on a budget." These are also portfolio-differentiating recommendations — most CI tools don't surface governance workflows to individual developers.
Enjoyable Anecdote
gh-aw's own release notes for v0.71.5 carry a footer: "Generated by Release · ● 1.7M" — that's 1.7 million tokens consumed by an agentic workflow to write the changelog. One of the fixes in that release: the Claude engine no longer crashes mid-session with "Fast mode unavailable." The changelog describing the fix was itself written by the Claude engine running against the version that fixed the crash. The repo used gh-aw to ship gh-aw, burned 1.7M tokens doing it, and the most critical line item was "we stopped crashing." Ouroboros in production.
Research audit trail
Web search queries
Anthropic Claude Code OAuth token policy subscription CI 2026
Claude Code plugin marketplace new plugins May 2026
gh-aw githubnext agentic workflows release 2026
anthropic claude code action workflow automation competing tools 2026
Claude subscription token CI GitHub Actions community discussion 2026
AI tooling engineer hiring Claude Anthropic ecosystem portfolio 2026
githubnext agentics catalog new workflows added April May 2026
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
-
Anthropic Platform Signals
The single-developer CI wedge is still valid — but enforcement context matters.
Anthropic's February 19–20, 2026 ToS update explicitly banned OAuth tokens from Claude Free/Pro/Max subscriptions in any third-party tool, including the Agent SDK. April 4, 2026 marked actual enforcement: subscriptions no longer cover third-party agent harnesses (OpenClaw being the highest-profile casualty). The context matters because this plugin's entire value proposition rests on a carve-out that survived: the official
claude setup-token→CLAUDE_CODE_OAUTH_TOKENpath for personal CI is explicitly documented and permitted atcode.claude.com/docs/en/authentication.The test Anthropic now applies publicly: "one human, one subscription, one beneficiary." Single-developer personal repos using
CLAUDE_CODE_OAUTH_TOKENas a repo secret remain safe. Multi-tenant products, team pooling without Team seats, and anything that resells Claude or runs on someone else's behalf are banned.One nuance to watch: Anthropic's own
code.claude.com/docs/en/github-actionsdocumentsanthropics/claude-code-actionwith onlyANTHROPIC_API_KEY— no mention of the OAuth path. The OAuth-for-CI route is only documented in the authentication page. This gap creates onboarding confusion and remains the best argument for this plugin existing: it navigates that gap on behalf of the user.No new policy changes this week beyond the April 4 enforcement that is now settled.
Claude Code Plugin Ecosystem
Significant ecosystem growth; two feature additions directly relevant to this plugin.
Claude Code shipped
--plugin-url(fetch a plugin archive from URL for the current session) and updated--plugin-dirto accept.ziparchives. Both are useful for distributing this plugin without requiring marketplace listing — internal artifact stores or a GitHub release attachment now suffice.The official Anthropic-managed directory is at
anthropics/claude-plugins-official. As of May 2026,hesreallyhim/awesome-claude-code(36.8k stars) remains the canonical community index;quemsah/awesome-claude-pluginsnow indexes 15,134 plugin repos by automated crawl.obra/superpowers(94k stars) was officially accepted into the Anthropic skills marketplace in April — the first community framework to reach first-class status.anthropics/claude-code-actionshipped v1.0 GA with breaking input changes from the beta:direct_promptpromptmode: "tag"custom_instructionsclaude_args: --append-system-promptmax_turnsclaude_args: --max-turnsAny install documentation that references
anthropics/claude-code-action@betainputs is now stale.Claude Code Auto Mode shipped with subagent safety checks: outbound validation before delegation, return checks on agent execution history to detect prompt injection. Relevant for the agent-team catalog pattern this repo ships.
gh-awUpstream ActivityLatest release: v0.71.5 (May 5, 2026). One fix directly affects this repo's compiled workflows.
This repo's version gap
.github/aw/actions-lock.json(verified at line 23–27) pins:The retired-for-billing range is v0.68.4–v0.71.3.
v0.68.3is one patch below the retired floor — technically not retired, but it misses every improvement shipped across v0.68.4 through v0.71.5. The most operationally important fix in that span:Other notable changes since v0.68.3
pre-agent-stepsfrontmatter field — run custom GitHub Actions steps before the agent starts (auth, env setup). Directly useful for the OAuth token setup this plugin performs.engine.bare: true— skip loadingAGENTS.md; clean for triage/reporting workflows.engine: opencodeis now a first-class option alongsideclaude,copilot,codex..mcp.json(repo root) moved to.github/mcp.json. Any future MCP config this repo ships should use the new path.persist-credentials: falsecodemod —gh aw fix --writenow auto-remediatesactions/checkoutsteps missing this flag.max-runsnow defaults to 100,max-effective-tokensto 25M; both fields now accept GitHub Actions expressions..github/aw/token-optimization.mdadded with DataOps, cli-proxy, inline sub-agents, and A/B experiment (experiments.prompt_style) techniques.githubnext/agenticscatalog additions (April 2026)Five new workflow templates shipped:
approach-validator,test-quality-sentinel,refactoring-cadence,architecture-guardian,design-decision-gate. These governance/quality templates are a strong fit for solo founders who need architectural guardrails without a full team. The/discover-workflowsskill's catalog awareness should include these.Competitive Landscape
No direct "workflow discovery" competitor found. Indirect pressure from two directions.
A community OAuth GitHub Action (
grll/claude-code-actionwithclaude_access_token/claude_refresh_tokeninputs) has emerged to fill the gap thatanthropics/claude-code-action@v1left by documenting onlyANTHROPIC_API_KEY. It targets the same audience as this plugin's OAuth install path, without the full discovery/install flow. Upstream issueanthropics/claude-code-action#727requests official refresh token support for Max subscribers — if Anthropic ships that, the community OAuth action may be absorbed upstream, removing one competitor.Peli's Agent Factory (showcasing 50+ specialized agentic workflows) continues to be the closest thing to a workflow discovery catalog, but has no install automation — it's a showcase, not a plugin.
No fork of
gh-awthat re-adds OAuth in ways that violate ToS was found.zircote/aw-authorhad no public activity indexed this week.Subscription-backed CI Signals
Community confusion is at high tide; no new policy tightening.
The $1,800 accidental API billing incident circulating in community posts (dev thought they were on a subscription path;
ANTHROPIC_API_KEYin shell environment took precedence per Claude Code's auth precedence order) illustrates that the authentication precedence chain confuses developers. The order is: cloud provider →ANTHROPIC_AUTH_TOKEN→ANTHROPIC_API_KEY→apiKeyHelper→CLAUDE_CODE_OAUTH_TOKEN. AnANTHROPIC_API_KEYset anywhere in the environment silently overrides the OAuth token. This plugin'sauth.mdhandles this correctly (it guides users to avoid this), but it's worth making the precedence table more prominent.No new Anthropic policy moves since April 4 enforcement. The settled state: personal single-dev CI is safe; everything else is API key territory.
Strategic Suggestions
1. Run
gh aw updateto bring compiled lock files to v0.71.5.The compiled workflows (
daily-repo-status.lock.yml,update-docs.lock.yml,weekly-research.lock.yml) were generated from v0.68.3. TheCLAUDE_CODE_DISABLE_FAST_MODE=1fix in v0.71.5 is needed to prevent mid-session crashes on Claude Code 2.1.120+. Without it, these workflows will fail intermittently when Claude's server-side fast-mode flag is toggled on. Runninggh aw updateregenerates all lock files and updatesactions-lock.jsonto v0.71.5. This is also a credibility signal — the repo that teaches people to install gh-aw workflows should itself be running the current version.2. Add auth precedence table to
auth.mdwith explicit "watch out" forANTHROPIC_API_KEYin environment.The $1,800 billing incident is not a fringe case — it happens when a developer has
ANTHROPIC_API_KEYexported in their shell profile and the GitHub Actions secret inherits it viaenv:.auth.md(skills/install-workflow/auth.md) already has solid ToS boundary language, but adding a one-line callout — "ifANTHROPIC_API_KEYis set anywhere in the Actions environment, it silently overridesCLAUDE_CODE_OAUTH_TOKEN" — would prevent support confusion and reinforce the plugin's value as an expert guide.3. Expand
/discover-workflowscatalog awareness to include the five new governance templates fromgithubnext/agentics.approach-validator,test-quality-sentinel,refactoring-cadence,architecture-guardian,design-decision-gateshipped in April and are not yet in the skill's recommendation set. Solo founders with growing codebases are exactly the audience for "architecture guardian on a budget." These are also portfolio-differentiating recommendations — most CI tools don't surface governance workflows to individual developers.Enjoyable Anecdote
gh-aw's own release notes for v0.71.5 carry a footer: "Generated by Release · ● 1.7M" — that's 1.7 million tokens consumed by an agentic workflow to write the changelog. One of the fixes in that release: the Claude engine no longer crashes mid-session with "Fast mode unavailable." The changelog describing the fix was itself written by the Claude engine running against the version that fixed the crash. The repo used gh-aw to ship gh-aw, burned 1.7M tokens doing it, and the most critical line item was "we stopped crashing." Ouroboros in production.
Research audit trail
Web search queries
Anthropic Claude Code OAuth token policy subscription CI 2026Claude Code plugin marketplace new plugins May 2026gh-aw githubnext agentic workflows release 2026anthropic claude code action workflow automation competing tools 2026Claude subscription token CI GitHub Actions community discussion 2026AI tooling engineer hiring Claude Anthropic ecosystem portfolio 2026githubnext agentics catalog new workflows added April May 2026hesreallyhim awesome-claude-code plugin trends skills 2026"aw-author" OR "workflow discovery" OR "agentic workflow install" tool 2026URLs fetched
https://github.github.com/gh-aw/blog/2026-04-20-weekly-update/https://code.claude.com/docs/en/authenticationhttps://code.claude.com/docs/en/github-actionsBash commands executed
None.
MCP tools used
mcp__github__get_latest_release—github/gh-aw(confirmed v0.71.5, read full release notes)mcp__github__list_issues—github/gh-aw(open issues, most recently updated)mcp__github__list_pull_requests—github/gh-aw(recent merged PRs, May 11 activity)mcp__github__list_pull_requests—anthropics/claude-code-action(recent merged PRs)mcp__github__list_discussions—verkyyi/github-agent-runner(confirmed no existing May 11 discussion)mcp__github__list_discussion_categories—verkyyi/github-agent-runner(retrieved category IDs)Local file reads
/home/runner/work/github-agent-runner/github-agent-runner/.github/aw/actions-lock.json(confirmed v0.68.3 pin)Beta Was this translation helpful? Give feedback.
All reactions