Which Claude credential should public-repo CI lanes use: subscription token, API key or workload identity federation? #6968

Activity

1. kyle-sexton

   added

   wayfind: interviewWayfind decision item: contract/requirements call the user must make; human in the loop.Wayfind decision item: contract/requirements call the user must make; human in the loop.

   needs-humanHuman-in-the-loop required; autonomous sessions must not resolve items carrying this.Human-in-the-loop required; autonomous sessions must not resolve items carrying this.

   on Oct 11, 2026
2. kyle-sexton

   added a parent issue on Oct 11, 2026

   • Map: run the agent lanes at full Claude capacity #6958
3. github-actions

   added

   needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

   on Oct 11, 2026
4. kyle-sexton

   marked this as blocked on Oct 11, 2026

   • Write an ADR amending ADR 0037 to allow API keys from the operator's own linked Console orgs #6961
5. github-actions commented on Oct 11, 2026

   

   github-actionsBot

   on Oct 11, 2026 – with GitHub Actions

   Contributor

   More actions

   Thanks for the report. Automated triage handed this issue to a maintainer.

   _{Automated triage. A maintainer reviews it.}
6. kyle-sexton

   removed

   needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

   on Oct 12, 2026
7. kyle-sexton

   added the

   Task

   issue type on Oct 12, 2026
8. kyle-sexton commented on Oct 18, 2026

   

   kyle-sexton

   on Oct 18, 2026

   MemberAuthor

   More actions

   Decision recorded.

   Question: The claude-code-action lanes in this public repo need a Claude credential. Options: (a) keep the subscription OAuth token; (b) an API key; (c) workload identity federation (no stored secret).

   Owner's answer: (a), never an API key, and evaluate (c) separately. Unchanged and mostly settled already: accepted ADR 0062 says an Action lane "is never given a key", and the workflows use the OAuth token. Basis: docs/adr/0062-*.md:101-103; .github/workflows/pr-review-hosted.yml:153.

   The owner accepted this recommendation as item D18 of a 32-decision batch in an attended backlog-shaping session on 2026-10-18. The batch question: "Accept all 32 recommendations, including the four flagged above (D2 close the relearn, D26 cross-repo sync without per-repo confirm, D10 narrow hook, D23 delete guard only)?" The owner answered: "Accept all 32 (Recommended)".

   Posted by AI from the owner's answer in that session.
9. kyle-sexton commented on Oct 18, 2026

   

   kyle-sexton

   on Oct 18, 2026

   MemberAuthor

   More actions

   This was generated by AI during backlog shaping.

   Closing as not planned. Owner decision D18 (2026-10-18): keep the subscription OAuth token, never an API key. main already does this: ADR 0062:101-103 and .github/workflows/pr-review-hosted.yml:153-154. Workload identity federation is to be evaluated separately; no workflow or doc on origin/main uses it (grep of .github and docs finds only ADR 0038:35-38). The federation option is tracked separately in #7955.

   The owner approved this close in an attended backlog-shaping session on 2026-10-18 (question: "Close the 9 issues ...?"; answer: "Close all 9 (Recommended)").
10. kyle-sexton

    closed this as not plannedon Oct 18, 2026