Use Claude Code GitHub Actions with cloud providers changedgithub-actions-cloud-providers
Nearest release: v2.1.273, published 3 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 15 Sep 2026 21:21 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 30 Oct 2026 18:07 UTC.
Upstream edited
Recorded here
Lines+198added
Lines−198removed
From line
55
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits8to this page, all time
The whole hunk
from line 55, old and new numbered
/
from line 55
5555
5656Configure your cloud to trust the OIDC token that GitHub issues to the workflow, so each workflow run gets short-lived cloud credentials. The bullets in each tab summarize what to create, and each tab links the cloud vendor's own guide for the console-level steps.
5757
58**Amazon Bedrock**
58> [tab] Amazon Bedrock
59>
60> Create the trust configuration in your AWS account, following the [AWS guide to creating OIDC identity providers](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html):
61>
62> * Add a GitHub OIDC identity provider with provider URL `https://token.actions.githubusercontent.com` and audience `sts.amazonaws.com`
63> * Create an IAM role trusted by that provider as a web identity, and attach the scoped invocation policy from [IAM configuration](https://code.claude.com/docs/en/amazon-bedrock.md#iam-configuration), which grants `bedrock:InvokeModel`, `bedrock:InvokeModelWithResponseStream`, `bedrock:ListInferenceProfiles`, and `bedrock:GetInferenceProfile`, along with two `aws-marketplace` subscription actions
64> * Limit the role's trust policy to your repository with a subject condition such as `repo:your-org/your-repo:*`. See [GitHub's OIDC hardening guide](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect) for the claim format
65>
66> Note the role's ARN. You add it as a secret in the next step.
5967
60Create the trust configuration in your AWS account, following the [AWS guide to creating OIDC identity providers](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html):
68> [tab] Google Cloud's Agent Platform
69>
70> Create the federation resources in your Google Cloud project, following the [Workload Identity Federation documentation](https://cloud.google.com/iam/docs/workload-identity-federation):
71>
72> * Enable three APIs: IAM Credentials, Security Token Service (STS), and the Agent Platform API, whose service name is `aiplatform.googleapis.com`
73> * Create a Workload Identity Pool with a GitHub OIDC provider whose issuer is `https://token.actions.githubusercontent.com`, and add an attribute condition that limits the pool to your repository
74> * Create a dedicated service account with only the `Vertex AI User` role, which is `roles/aiplatform.user`, and allow the pool to impersonate it
75>
76> Note the provider's full resource name and the service account's email address. You add them as secrets in the next step.
6177
62* Add a GitHub OIDC identity provider with provider URL `https://token.actions.githubusercontent.com` and audience `sts.amazonaws.com`
63* Create an IAM role trusted by that provider as a web identity, and attach the scoped invocation policy from [IAM configuration](https://code.claude.com/docs/en/amazon-bedrock.md#iam-configuration), which grants `bedrock:InvokeModel`, `bedrock:InvokeModelWithResponseStream`, `bedrock:ListInferenceProfiles`, and `bedrock:GetInferenceProfile`, along with two `aws-marketplace` subscription actions
64* Limit the role's trust policy to your repository with a subject condition such as `repo:your-org/your-repo:*`. See [GitHub's OIDC hardening guide](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect) for the claim format
78> [tab] Microsoft Foundry
79>
80> Create a Microsoft Entra application with a federated credential for your repository, following [Microsoft's guide to authenticating from GitHub Actions](https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure-openid-connect):
81>
82> * Register a Microsoft Entra application and add a federated identity credential that trusts tokens GitHub issues to your repository. A user-assigned managed identity works in place of an application. Both have the client ID you note below
83> * Assign the application the `Azure AI User` role on your Foundry resource. See [Azure RBAC configuration](https://code.claude.com/docs/en/microsoft-foundry.md#azure-rbac-configuration) for a narrower custom role
84>
85> Note the application's client ID, your tenant ID, and your subscription ID. You add them as secrets in the next step.
6586
66Note the role's ARN. You add it as a secret in the next step.
67
68**Google Cloud's Agent Platform**
69
70Create the federation resources in your Google Cloud project, following the [Workload Identity Federation documentation](https://cloud.google.com/iam/docs/workload-identity-federation):
71
72* Enable three APIs: IAM Credentials, Security Token Service (STS), and the Agent Platform API, whose service name is `aiplatform.googleapis.com`
73* Create a Workload Identity Pool with a GitHub OIDC provider whose issuer is `https://token.actions.githubusercontent.com`, and add an attribute condition that limits the pool to your repository
74* Create a dedicated service account with only the `Vertex AI User` role, which is `roles/aiplatform.user`, and allow the pool to impersonate it
75
76Note the provider's full resource name and the service account's email address. You add them as secrets in the next step.
77
78**Microsoft Foundry**
79
80Create a Microsoft Entra application with a federated credential for your repository, following [Microsoft's guide to authenticating from GitHub Actions](https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure-openid-connect):
81
82* Register a Microsoft Entra application and add a federated identity credential that trusts tokens GitHub issues to your repository. A user-assigned managed identity works in place of an application. Both have the client ID you note below
83* Assign the application the `Azure AI User` role on your Foundry resource. See [Azure RBAC configuration](https://code.claude.com/docs/en/microsoft-foundry.md#azure-rbac-configuration) for a narrower custom role
84
85Note the application's client ID, your tenant ID, and your subscription ID. You add them as secrets in the next step.
86
8787**3. Add repository secrets**
8888
8989In the repository where the Claude Code GitHub Action runs, add the secrets for your provider, plus the two app secrets if you created a custom GitHub App in the first step. See GitHub's guide to [using secrets in GitHub Actions](https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions).
from line 112
112112>
113113> On public repositories, a comment containing the trigger phrase from any user starts this workflow. The credential steps run before the Claude Code GitHub Action checks the commenter's write access, so the action rejects unauthorized users only after the workflow has generated an App token and signed in to your cloud provider, which leaves audit-log entries and consumes Actions minutes. To avoid those runs, add a step that verifies the commenter's write access before the credential steps.
114114
115**Amazon Bedrock**
115> [tab] Amazon Bedrock
116>
117> Replace the `aws-region` value with your own. The credentials step exports it as `AWS_REGION` for the rest of the job.
118>
119> ```yaml theme={null}
120> name: Claude PR Action
121>
122> permissions:
123> contents: write
124> pull-requests: write
125> issues: write
126> id-token: write
127>
128> on:
129> issue_comment:
130> types: [created]
131> pull_request_review_comment:
132> types: [created]
133> issues:
134> types: [opened]
135>
136> jobs:
137> claude-pr:
138> if: |
139> (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
140> (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
141> (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
142> runs-on: ubuntu-latest
143> steps:
144> - name: Checkout repository
145> uses: actions/checkout@v6
146>
147> - name: Generate GitHub App token
148> id: app-token
149> uses: actions/create-github-app-token@v2
150> with:
151> app-id: ${{ secrets.APP_ID }}
152> private-key: ${{ secrets.APP_PRIVATE_KEY }}
153>
154> - name: Configure AWS Credentials (OIDC)
155> uses: aws-actions/configure-aws-credentials@v4
156> with:
157> role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
158> aws-region: us-west-2
159>
160> - uses: anthropics/claude-code-action@v1
161> with:
162> github_token: ${{ steps.app-token.outputs.token }}
163> use_bedrock: "true"
164> claude_args: '--model us.anthropic.claude-sonnet-4-6'
165> ```
166>
167> > [!TIP]
168> >
169> > Bedrock model IDs include a cross-region inference profile prefix such as `us.`. Use the prefix for the region group where you granted model access.
116170
117Replace the `aws-region` value with your own. The credentials step exports it as `AWS_REGION` for the rest of the job.
118
119```yaml theme={null}
120name: Claude PR Action
121
122permissions:
123 contents: write
124 pull-requests: write
125 issues: write
126 id-token: write
127
128on:
129 issue_comment:
130 types: [created]
131 pull_request_review_comment:
132 types: [created]
133 issues:
134 types: [opened]
135
136jobs:
137 claude-pr:
138 if: |
139 (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
140 (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
141 (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
142 runs-on: ubuntu-latest
143 steps:
144 - name: Checkout repository
145 uses: actions/checkout@v6
146
147 - name: Generate GitHub App token
148 id: app-token
149 uses: actions/create-github-app-token@v2
150 with:
151 app-id: ${{ secrets.APP_ID }}
152 private-key: ${{ secrets.APP_PRIVATE_KEY }}
153
154 - name: Configure AWS Credentials (OIDC)
155 uses: aws-actions/configure-aws-credentials@v4
156 with:
157 role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
158 aws-region: us-west-2
159
160 - uses: anthropics/claude-code-action@v1
161 with:
162 github_token: ${{ steps.app-token.outputs.token }}
163 use_bedrock: "true"
164 claude_args: '--model us.anthropic.claude-sonnet-4-6'
165```
166
167> [!TIP]
171> [tab] Google Cloud's Agent Platform
168172>
169> Bedrock model IDs include a cross-region inference profile prefix such as `us.`. Use the prefix for the region group where you granted model access.
173> Replace the `CLOUD_ML_REGION` value with your own. You don't need to hardcode the project ID, because the workflow reads it from the `auth` step's output.
174>
175> ```yaml theme={null}
176> name: Claude PR Action
177>
178> permissions:
179> contents: write
180> pull-requests: write
181> issues: write
182> id-token: write
183>
184> on:
185> issue_comment:
186> types: [created]
187> pull_request_review_comment:
188> types: [created]
189> issues:
190> types: [opened]
191>
192> jobs:
193> claude-pr:
194> if: |
195> (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
196> (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
197> (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
198> runs-on: ubuntu-latest
199> steps:
200> - name: Checkout repository
201> uses: actions/checkout@v6
202>
203> - name: Generate GitHub App token
204> id: app-token
205> uses: actions/create-github-app-token@v2
206> with:
207> app-id: ${{ secrets.APP_ID }}
208> private-key: ${{ secrets.APP_PRIVATE_KEY }}
209>
210> - name: Authenticate to Google Cloud
211> id: auth
212> uses: google-github-actions/auth@v2
213> with:
214> workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
215> service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
216>
217> - uses: anthropics/claude-code-action@v1
218> with:
219> github_token: ${{ steps.app-token.outputs.token }}
220> use_vertex: "true"
221> claude_args: '--model claude-sonnet-5'
222> env:
223> ANTHROPIC_VERTEX_PROJECT_ID: ${{ steps.auth.outputs.project_id }}
224> CLOUD_ML_REGION: us-east5
225> ```
170226
171**Google Cloud's Agent Platform**
172
173Replace the `CLOUD_ML_REGION` value with your own. You don't need to hardcode the project ID, because the workflow reads it from the `auth` step's output.
174
175```yaml theme={null}
176name: Claude PR Action
177
178permissions:
179 contents: write
180 pull-requests: write
181 issues: write
182 id-token: write
183
184on:
185 issue_comment:
186 types: [created]
187 pull_request_review_comment:
188 types: [created]
189 issues:
190 types: [opened]
191
192jobs:
193 claude-pr:
194 if: |
195 (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
196 (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
197 (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
198 runs-on: ubuntu-latest
199 steps:
200 - name: Checkout repository
201 uses: actions/checkout@v6
202
203 - name: Generate GitHub App token
204 id: app-token
205 uses: actions/create-github-app-token@v2
206 with:
207 app-id: ${{ secrets.APP_ID }}
208 private-key: ${{ secrets.APP_PRIVATE_KEY }}
209
210 - name: Authenticate to Google Cloud
211 id: auth
212 uses: google-github-actions/auth@v2
213 with:
214 workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
215 service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
216
217 - uses: anthropics/claude-code-action@v1
218 with:
219 github_token: ${{ steps.app-token.outputs.token }}
220 use_vertex: "true"
221 claude_args: '--model claude-sonnet-5'
222 env:
223 ANTHROPIC_VERTEX_PROJECT_ID: ${{ steps.auth.outputs.project_id }}
224 CLOUD_ML_REGION: us-east5
225```
226
227**Microsoft Foundry**
228
229Replace `your-resource-name` with your Foundry resource name. Claude Code builds the endpoint URL from it. The `azure/login` step signs in with the workflow's OIDC token, and Claude Code picks up the credentials through the Azure [default credential chain](https://learn.microsoft.com/en-us/azure/developer/javascript/sdk/authentication/credential-chains#defaultazurecredential-overview).
230
231```yaml theme={null}
232name: Claude PR Action
233
234permissions:
235 contents: write
236 pull-requests: write
237 issues: write
238 id-token: write
239
240on:
241 issue_comment:
242 types: [created]
243 pull_request_review_comment:
244 types: [created]
245 issues:
246 types: [opened]
247
248jobs:
249 claude-pr:
250 if: |
251 (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
252 (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
253 (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
254 runs-on: ubuntu-latest
255 steps:
256 - name: Checkout repository
257 uses: actions/checkout@v6
258
259 - name: Generate GitHub App token
260 id: app-token
261 uses: actions/create-github-app-token@v2
262 with:
263 app-id: ${{ secrets.APP_ID }}
264 private-key: ${{ secrets.APP_PRIVATE_KEY }}
265
266 - name: Authenticate to Azure
267 uses: azure/login@v2
268 with:
269 client-id: ${{ secrets.AZURE_CLIENT_ID }}
270 tenant-id: ${{ secrets.AZURE_TENANT_ID }}
271 subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
272
273 - uses: anthropics/claude-code-action@v1
274 with:
275 github_token: ${{ steps.app-token.outputs.token }}
276 use_foundry: "true"
277 claude_args: '--model claude-sonnet-5'
278 env:
279 ANTHROPIC_FOUNDRY_RESOURCE: your-resource-name
280```
281
282> [!TIP]
227> [tab] Microsoft Foundry
283228>
284> Use a model ID that matches a Claude deployment in your Foundry resource. See [Claude Code on Microsoft Foundry](https://code.claude.com/docs/en/microsoft-foundry.md) for model configuration and version pinning.
229> Replace `your-resource-name` with your Foundry resource name. Claude Code builds the endpoint URL from it. The `azure/login` step signs in with the workflow's OIDC token, and Claude Code picks up the credentials through the Azure [default credential chain](https://learn.microsoft.com/en-us/azure/developer/javascript/sdk/authentication/credential-chains#defaultazurecredential-overview).
230>
231> ```yaml theme={null}
232> name: Claude PR Action
233>
234> permissions:
235> contents: write
236> pull-requests: write
237> issues: write
238> id-token: write
239>
240> on:
241> issue_comment:
242> types: [created]
243> pull_request_review_comment:
244> types: [created]
245> issues:
246> types: [opened]
247>
248> jobs:
249> claude-pr:
250> if: |
251> (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
252> (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
253> (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
254> runs-on: ubuntu-latest
255> steps:
256> - name: Checkout repository
257> uses: actions/checkout@v6
258>
259> - name: Generate GitHub App token
260> id: app-token
261> uses: actions/create-github-app-token@v2
262> with:
263> app-id: ${{ secrets.APP_ID }}
264> private-key: ${{ secrets.APP_PRIVATE_KEY }}
265>
266> - name: Authenticate to Azure
267> uses: azure/login@v2
268> with:
269> client-id: ${{ secrets.AZURE_CLIENT_ID }}
270> tenant-id: ${{ secrets.AZURE_TENANT_ID }}
271> subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
272>
273> - uses: anthropics/claude-code-action@v1
274> with:
275> github_token: ${{ steps.app-token.outputs.token }}
276> use_foundry: "true"
277> claude_args: '--model claude-sonnet-5'
278> env:
279> ANTHROPIC_FOUNDRY_RESOURCE: your-resource-name
280> ```
281>
282> > [!TIP]
283> >
284> > Use a model ID that matches a Claude deployment in your Foundry resource. See [Claude Code on Microsoft Foundry](https://code.claude.com/docs/en/microsoft-foundry.md) for model configuration and version pinning.
285285
286286With any provider, you can bound run length and cost by adding `--max-turns` to `claude_args`. See [Manage costs](https://code.claude.com/docs/en/github-actions.md#manage-costs).
287287
No line in this hunk matches that.