Fix Claude OAuth token env for Actions

[justin808]

Summary

• pass CLAUDE_CODE_OAUTH_TOKEN through the Claude action step env as well as the existing with: input
• keep OAuth token wiring consistent for Claude review and @claude workflows

Why

anthropics/claude-code-action@v1 can resolve the OAuth input empty in this runner path unless the token is also available in the inherited step env. This matches the Hichee fix proven by shakacode/hichee#9633.

Verification

• workflow-only YAML patch generated from the org Claude integration audit

Summary by CodeRabbit

• Chores
  • Updated an automated review workflow to pass authentication details in a more compatible way.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: cd185bba-78c5-40a9-b24e-6134d5887494

📥 Commits

Reviewing files that changed from the base of the PR and between 9c4cad6 and f2969f4.

📒 Files selected for processing (1)

• .github/workflows/claude-code-review.yml

---

Walkthrough

Added an env block to the Claude Code Review GitHub Actions workflow step, setting CLAUDE_CODE_OAUTH_TOKEN from the secret, alongside the existing with.claude_code_oauth_token configuration.

Changes

Workflow OAuth Token Configuration

Layer / File(s)	Summary
Add env token to workflow step .github/workflows/claude-code-review.yml	Added an env block setting CLAUDE_CODE_OAUTH_TOKEN from the CLAUDE_CODE_OAUTH_TOKEN secret for the Claude Code Review step.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested labels: ci, github-actions

Suggested reviewers: none

Poem:
A rabbit hopped through YAML lines,
Adding tokens, tidy signs,
One small env, secure and neat,
CI workflows now complete. 🐇

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jg-codex/claude-oauth-env-fallback

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR updates the Claude review workflow token wiring. The main changes are:

• Adds CLAUDE_CODE_OAUTH_TOKEN to the Claude action step environment.
• Keeps the existing with.claude_code_oauth_token input.
• Applies the change to .github/workflows/claude-code-review.yml.

Confidence Score: 5/5

This looks safe to merge after confirming the action requires the token in the step environment.

• No blocking issues found in the changed workflow.
• The only follow-up is to keep the OAuth token exposure as narrow as the Claude action allows.

Security Review

The workflow now exposes the Claude OAuth token as a process environment variable inside the action step. The workflow has restricted permissions and limited allowed tools, but PR-controlled text can still influence the Claude action, so the environment exposure should be kept as narrow as the action supports.

Important Files Changed

Filename	Overview
.github/workflows/claude-code-review.yml	Adds the Claude OAuth token to the action step environment while keeping the existing action input.

_{Reviews (1): Last reviewed commit: "Fix Claude OAuth token env for Actions: ..." | Re-trigger Greptile}

[greptile-apps]

Secret Enters Tool Environment

Setting CLAUDE_CODE_OAUTH_TOKEN as step env makes the OAuth token available to every process the Claude action starts, including the allowed gh subprocesses. In a pull_request workflow that reads PR-controlled text, a prompt-injection or tool-argument escape can turn this from an action input into a process environment secret that can be posted back to the PR.