llm: Route GitHub Packages credential through $GITHUB_ENV in SDK-eval workflow - #7268
Conversation
… workflow PR #7267's compile-verification step 401'd resolving com.bitwarden:sdk-android even though the job's GITHUB_TOKEN carries packages:read, identical to the permissions/token setup build.yml and test.yml use successfully for the same package. The difference is that this workflow runs gradle through Claude's Bash tool inside claude-code-action's composite action, whose CLI-launching step's own env: block shadows the calling workflow's job-level env — the action's own action.yml documents this and directs callers to $GITHUB_ENV. GITHUB_TOKEN set on the outer step's env: never reached the subprocess. Route the token through a prior step writing to $GITHUB_ENV instead, which propagates it past the shadowing and matches how test.yml, build.yml, and sdlc-sdk-update.yml already pass this same token.
github-actions
Bot
added
the
t:llm
🤖 Bitwarden Claude Code ReviewOverall Assessment: APPROVE Reviewed the single-file change to Code Review DetailsNo findings. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #7268 +/- ##
=======================================
Coverage 86.25% 86.25%
=======================================
Files 891 891
Lines 65294 65294
Branches 9808 9808
=======================================
Hits 56320 56320
Misses 5472 5472
Partials 3502 3502
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
2 participants
🎟️ Tracking
#7267 — the SDK-eval workflow's compile-verification step failed to authenticate against GitHub Packages on that PR.
📔 Objective
The compile-verification step in the SDK-eval workflow 401'd resolving
com.bitwarden:sdk-android, even though the job'sGITHUB_TOKENcarriespackages:readidentical to the workingbuild.yml/test.ymlsetup.claude-code-action's CLI-launching step shadows the calling workflow's env, per its ownaction.yml, soGITHUB_TOKENset on the outer step never reached the Gradle process Claude's Bash tool spawned. Routing the token through$GITHUB_ENVpropagates it past that shadowing, matching how every other workflow in this repo already passes this token.