Skip to content

Claude review subscription accounts

The review workflow reads organization Actions variable CLAUDE_REVIEW_ACCOUNT after authorizing the request and before checkout or OAuth use:

Exact value Actions secret
A CLAUDE_CODE_OAUTH_TOKEN
B CLAUDE_CODE_OAUTH_TOKEN_B

Missing, blank, lowercase, whitespace-padded and unknown selectors fail. The selected secret must be available and nonblank, even if the other token exists. There is no default, fallback, quota rotation or automatic sign-in. Only the account label is logged; the step output contains the secret's name, never its value. Expired or otherwise invalid tokens still fail at Claude authentication.

To switch participating repositories, change only the value of the existing organization Actions variable to A or B, preserving its access policy. Do not replace either token. Preserve Chris's chosen selector during implementation and rollout. B and the selector were reported as already created and granted to all Claude review repositories; this change does not recreate them or alter access.

Avoid switching while reviews are queued or running. The validated secret name is retained for the run; request a new review when explicitly authorized, rather than relying on reruns to switch accounts. The issue_comment workflow runs from the default branch, so this change takes effect after merge. No application feature flag is added: the organization selector controls this review-only setting.

Metadata audit and limits (2026-10-16)

Read-only GitHub metadata inspection found:

  • The organization selector has all visibility and is visible to SyRF. Its value was not printed or changed.
  • Both organization secrets exist with selected visibility and include SyRF. An initial B audit lacked SyRF; Chris corrected the omission, and an ID-based recheck confirmed repository 297635372 was present. This agent made no access mutation.
  • Repository secret CLAUDE_CODE_OAUTH_TOKEN exists and shadows organization A. No repository B secret or CLAUDE_REVIEW_ACCOUNT variable override was found. The repository secret was left untouched; metadata cannot establish whether it holds the same account as organization A. Removing it requires a deliberate configuration decision, including consideration of the separate @claude workflow.
  • The review job declares no environment, so environment configuration cannot shadow its selected credentials. All 124 environments were inspected: no same-name secret or selector overrides were found.

No secret values were retrieved, copied or printed. Metadata proves configuration presence and access lists, not token validity or live OAuth execution. No paid review was requested. Organization-wide switching is only effective for migrated workflows; other repositories require their own changes.

Scope and validation

The only other Actions Claude consumer found in SyRF is .github/workflows/claude.yml. It handles general @claude requests and continues using CLAUDE_CODE_OAUTH_TOKEN. Its triggers, authority and credentials are unchanged.

The review authorization, trusted default-branch checkout, requested-head citation, model selection, specialist prompt, inline delivery, verdict verification, usage reporting, runner and timeout remain unchanged. Regression tests execute the actual inline selection and credential validation with synthetic inputs; they also retain the existing authorization and delivery tests:

node --test .github/scripts/test-claude-review-comment.cjs
bash .github/scripts/test-claude-agent-timeout-contract.sh
bash .github/scripts/validate-workflows.sh

The implementation follows the independently developed M3E Angular reference PR #6. GitHub documents context indexing and secret precedence.