Skip to content

ci(claude): strip+validate OAuth token before auth #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
github-actions merged 1 commit into from
Jun 14, 2026
Merged

ci(claude): strip+validate OAuth token before auth #7

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 44 additions & 2 deletions .github/workflows/claude.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,10 +44,31 @@ jobs:
with:
fetch-depth: 1

- name: Validate & normalize Claude token
env:
RAW_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
run: |
# A wrapped copy/paste embeds a newline in the secret -> the action sends
# an invalid auth header ("Header has invalid value: '***\n ***'"). Strip
# all whitespace to heal it, then sanity-check the shape and fail loudly
# if the secret is missing or clearly wrong.
TOKEN="$(printf '%s' "$RAW_TOKEN" | tr -d '[:space:]')"
if [ -z "$TOKEN" ]; then
echo "::error::CLAUDE_CODE_OAUTH_TOKEN secret is not set. Run 'claude setup-token' then 'gh secret set CLAUDE_CODE_OAUTH_TOKEN'."
exit 1
fi
case "$TOKEN" in
sk-ant-oat*) : ;;
*) echo "::error::CLAUDE_CODE_OAUTH_TOKEN is malformed (expected to start with sk-ant-oat). Re-copy from 'claude setup-token' output."; exit 1 ;;
esac
echo "::add-mask::$TOKEN"
printf 'CLAUDE_OAUTH=%s\n' "$TOKEN" >> "$GITHUB_ENV"
echo "Claude token shape OK (length ${#TOKEN})."

- name: Claude auto-review
uses: anthropics/claude-code-action@593d7a5c4e0073569f74772c2b7b64c30ec14707 # v1
with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
claude_code_oauth_token: ${{ env.CLAUDE_OAUTH }}
# Prompt sent automatically on every PR — no @claude mention needed
prompt: |
Review this pull request. Check for:
Expand Down Expand Up @@ -85,11 +106,32 @@ jobs:
with:
fetch-depth: 1

- name: Validate & normalize Claude token
env:
RAW_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
run: |
# A wrapped copy/paste embeds a newline in the secret -> the action sends
# an invalid auth header ("Header has invalid value: '***\n ***'"). Strip
# all whitespace to heal it, then sanity-check the shape and fail loudly
# if the secret is missing or clearly wrong.
TOKEN="$(printf '%s' "$RAW_TOKEN" | tr -d '[:space:]')"
if [ -z "$TOKEN" ]; then
echo "::error::CLAUDE_CODE_OAUTH_TOKEN secret is not set. Run 'claude setup-token' then 'gh secret set CLAUDE_CODE_OAUTH_TOKEN'."
exit 1
fi
case "$TOKEN" in
sk-ant-oat*) : ;;
*) echo "::error::CLAUDE_CODE_OAUTH_TOKEN is malformed (expected to start with sk-ant-oat). Re-copy from 'claude setup-token' output."; exit 1 ;;
esac
echo "::add-mask::$TOKEN"
printf 'CLAUDE_OAUTH=%s\n' "$TOKEN" >> "$GITHUB_ENV"
echo "Claude token shape OK (length ${#TOKEN})."

- name: Run Claude Code
id: claude
uses: anthropics/claude-code-action@593d7a5c4e0073569f74772c2b7b64c30ec14707 # v1
with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
claude_code_oauth_token: ${{ env.CLAUDE_OAUTH }}
claude_args: |
--max-turns 15
plugin_marketplaces: |
Expand Down
Loading