按照 AWS 建立 OIDC 身分識別提供者指南，在您的 AWS 帳戶中建立信任設定：

• 新增 GitHub OIDC 身分識別提供者，提供者 URL 為 https://token.actions.githubusercontent.com，對象為 sts.amazonaws.com
• 建立由該提供者信任的 IAM 角色作為網路身分識別，並附加來自 IAM 設定 的範圍調用原則，該原則授予 bedrock:InvokeModel、bedrock:InvokeModelWithResponseStream、bedrock:ListInferenceProfiles 和 bedrock:GetInferenceProfile，以及兩個 aws-marketplace 訂閱動作
• 使用主體條件（例如 repo:your-org/your-repo:*）將角色的信任原則限制在您的儲存庫。請參閱 GitHub 的 OIDC 強化指南以了解聲明格式

記下角色的 ARN。您將在下一步中將其新增為密鑰。

按照 Workload Identity Federation 文件，在您的 Google Cloud 專案中建立聯盟資源：

• 啟用三個 API：IAM Credentials、Security Token Service (STS) 和 Agent Platform API，其服務名稱為 aiplatform.googleapis.com
• 建立 Workload Identity Pool，其中包含 GitHub OIDC 提供者，其簽發者為 https://token.actions.githubusercontent.com，並新增將池限制在您的儲存庫的屬性條件
• 建立專用服務帳戶，僅具有 Vertex AI User 角色（即 roles/aiplatform.user），並允許池模擬它

記下提供者的完整資源名稱和服務帳戶的電子郵件地址。您將在下一步中將它們新增為密鑰。

按照 Microsoft 從 GitHub Actions 驗證指南，建立具有儲存庫聯盟認證的 Microsoft Entra 應用程式：

• 註冊 Microsoft Entra 應用程式並新增聯盟身分識別認證，該認證信任 GitHub 向您的儲存庫發出的權杖。使用者指派的受管身分識別可以代替應用程式。兩者都有您在下面記下的用戶端 ID
• 在您的 Foundry 資源上為應用程式指派 Azure AI User 角色。請參閱 Azure RBAC 設定以了解更窄的自訂角色

記下應用程式的用戶端 ID、您的租用戶 ID 和您的訂閱 ID。您將在下一步中將它們新增為密鑰。

將 aws-region 值替換為您自己的值。認證步驟會將其匯出為 AWS_REGION，供工作的其餘部分使用。

name: Claude PR Action

permissions:
contents: write
pull-requests: write
issues: write
id-token: write

on:
issue_comment:
types: [created]
pull_request_review_comment:
types: [created]
issues:
types: [opened]

jobs:
claude-pr:
if: |
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v6

- name: Generate GitHub App token
id: app-token
uses: actions/create-github-app-token@v2
with:
app-id: ${{ secrets.APP_ID }}
private-key: ${{ secrets.APP_PRIVATE_KEY }}

- name: Configure AWS Credentials (OIDC)
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
aws-region: us-west-2

- uses: anthropics/claude-code-action@v1
with:
github_token: ${{ steps.app-token.outputs.token }}
use_bedrock: "true"
claude_args: '--model us.anthropic.claude-sonnet-4-6'

將 CLOUD_ML_REGION 值替換為您自己的值。您無需硬編碼專案 ID，因為工作流程會從 auth 步驟的輸出中讀取它。

name: Claude PR Action

permissions:
contents: write
pull-requests: write
issues: write
id-token: write

on:
issue_comment:
types: [created]
pull_request_review_comment:
types: [created]
issues:
types: [opened]

jobs:
claude-pr:
if: |
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v6

- name: Generate GitHub App token
id: app-token
uses: actions/create-github-app-token@v2
with:
app-id: ${{ secrets.APP_ID }}
private-key: ${{ secrets.APP_PRIVATE_KEY }}

- name: Authenticate to Google Cloud
id: auth
uses: google-github-actions/auth@v2
with:
workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}

- uses: anthropics/claude-code-action@v1
with:
github_token: ${{ steps.app-token.outputs.token }}
use_vertex: "true"
claude_args: '--model claude-sonnet-5'
env:
ANTHROPIC_VERTEX_PROJECT_ID: ${{ steps.auth.outputs.project_id }}
CLOUD_ML_REGION: us-east5

將 your-resource-name 替換為您的 Foundry 資源名稱。Claude Code 會從中建立端點 URL。azure/login 步驟使用工作流程的 OIDC 權杖登入，Claude Code 透過 Azure 預設認證鏈取得認證。

name: Claude PR Action

permissions:
contents: write
pull-requests: write
issues: write
id-token: write

on:
issue_comment:
types: [created]
pull_request_review_comment:
types: [created]
issues:
types: [opened]

jobs:
claude-pr:
if: |
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v6

- name: Generate GitHub App token
id: app-token
uses: actions/create-github-app-token@v2
with:
app-id: ${{ secrets.APP_ID }}
private-key: ${{ secrets.APP_PRIVATE_KEY }}

- name: Authenticate to Azure
uses: azure/login@v2
with:
client-id: ${{ secrets.AZURE_CLIENT_ID }}
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

- uses: anthropics/claude-code-action@v1
with:
github_token: ${{ steps.app-token.outputs.token }}
use_foundry: "true"
claude_args: '--model claude-sonnet-5'
env:
ANTHROPIC_FOUNDRY_RESOURCE: your-resource-name