在您的 AWS 账户中创建信任配置，遵循 AWS 创建 OIDC 身份提供商指南：

• 添加一个 GitHub OIDC 身份提供商，提供商 URL 为 https://token.actions.githubusercontent.com，受众为 sts.amazonaws.com
• 创建一个由该提供商作为 Web 身份信任的 IAM 角色，并附加来自 IAM 配置 的作用域调用策略，该策略授予 bedrock:InvokeModel、bedrock:InvokeModelWithResponseStream、bedrock:ListInferenceProfiles 和 bedrock:GetInferenceProfile，以及两个 aws-marketplace 订阅操作
• 使用主题条件（例如 repo:your-org/your-repo:*）将角色的信任策略限制在您的存储库。有关声明格式，请参阅 GitHub 的 OIDC 加固指南

记下角色的 ARN。您将在下一步中将其添加为密钥。

在您的 Google Cloud 项目中创建联合资源，遵循 Workload Identity Federation 文档：

• 启用三个 API：IAM Credentials、Security Token Service (STS) 和 Agent Platform API，其服务名称为 aiplatform.googleapis.com
• 创建一个 Workload Identity Pool，其中包含一个 GitHub OIDC 提供商，其颁发者为 https://token.actions.githubusercontent.com，并添加一个属性条件，将池限制在您的存储库
• 创建一个仅具有 Vertex AI User 角色（即 roles/aiplatform.user）的专用服务账户，并允许池模拟它

记下提供商的完整资源名称和服务账户的电子邮件地址。您将在下一步中将它们添加为密钥。

创建一个 Microsoft Entra 应用程序，其中包含您的存储库的联合凭证，遵循 Microsoft 的 GitHub Actions 身份验证指南：

• 注册一个 Microsoft Entra 应用程序，并添加一个联合身份凭证，该凭证信任 GitHub 向您的存储库颁发的令牌。用户分配的托管身份可以代替应用程序。两者都有您在下面记下的客户端 ID
• 在您的 Foundry 资源上为应用程序分配 Azure AI User 角色。有关更窄的自定义角色，请参阅 Azure RBAC 配置

记下应用程序的客户端 ID、您的租户 ID 和您的订阅 ID。您将在下一步中将它们添加为密钥。

将 aws-region 值替换为您自己的值。凭证步骤将其导出为 AWS_REGION 供作业的其余部分使用。

name: Claude PR Action

permissions:
contents: write
pull-requests: write
issues: write
id-token: write

on:
issue_comment:
types: [created]
pull_request_review_comment:
types: [created]
issues:
types: [opened]

jobs:
claude-pr:
if: |
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v6

- name: Generate GitHub App token
id: app-token
uses: actions/create-github-app-token@v2
with:
app-id: ${{ secrets.APP_ID }}
private-key: ${{ secrets.APP_PRIVATE_KEY }}

- name: Configure AWS Credentials (OIDC)
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
aws-region: us-west-2

- uses: anthropics/claude-code-action@v1
with:
github_token: ${{ steps.app-token.outputs.token }}
use_bedrock: "true"
claude_args: '--model us.anthropic.claude-sonnet-4-6'

将 CLOUD_ML_REGION 值替换为您自己的值。您无需硬编码项目 ID，因为工作流从 auth 步骤的输出中读取它。

name: Claude PR Action

permissions:
contents: write
pull-requests: write
issues: write
id-token: write

on:
issue_comment:
types: [created]
pull_request_review_comment:
types: [created]
issues:
types: [opened]

jobs:
claude-pr:
if: |
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v6

- name: Generate GitHub App token
id: app-token
uses: actions/create-github-app-token@v2
with:
app-id: ${{ secrets.APP_ID }}
private-key: ${{ secrets.APP_PRIVATE_KEY }}

- name: Authenticate to Google Cloud
id: auth
uses: google-github-actions/auth@v2
with:
workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}

- uses: anthropics/claude-code-action@v1
with:
github_token: ${{ steps.app-token.outputs.token }}
use_vertex: "true"
claude_args: '--model claude-sonnet-5'
env:
ANTHROPIC_VERTEX_PROJECT_ID: ${{ steps.auth.outputs.project_id }}
CLOUD_ML_REGION: us-east5

将 your-resource-name 替换为您的 Foundry 资源名称。Claude Code 从它构建端点 URL。azure/login 步骤使用工作流的 OIDC 令牌登录，Claude Code 通过 Azure 默认凭证链 获取凭证。

name: Claude PR Action

permissions:
contents: write
pull-requests: write
issues: write
id-token: write

on:
issue_comment:
types: [created]
pull_request_review_comment:
types: [created]
issues:
types: [opened]

jobs:
claude-pr:
if: |
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v6

- name: Generate GitHub App token
id: app-token
uses: actions/create-github-app-token@v2
with:
app-id: ${{ secrets.APP_ID }}
private-key: ${{ secrets.APP_PRIVATE_KEY }}

- name: Authenticate to Azure
uses: azure/login@v2
with:
client-id: ${{ secrets.AZURE_CLIENT_ID }}
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

- uses: anthropics/claude-code-action@v1
with:
github_token: ${{ steps.app-token.outputs.token }}
use_foundry: "true"
claude_args: '--model claude-sonnet-5'
env:
ANTHROPIC_FOUNDRY_RESOURCE: your-resource-name