llm: Pre-fetch the SDK artifact before Claude runs in SDK-eval workflow - #7270
Conversation
The evaluation's compile step could not resolve com.bitwarden:sdk-android and failed with 401 Unauthorized. claude-code-action resolves its own GitHub token and assigns it to GITHUB_TOKEN and GH_TOKEN in the environment it hands Claude's Bash tool, so no value the workflow places in that environment reaches Gradle, and the token it substitutes carries no packages:read grant for the SDK package. Resolving the dependency in a plain shell step ahead of Claude populates the Gradle module cache, so the compile Claude runs reads the fixed SDK version from cache and needs no credential of its own. continue-on-error keeps a real compile break flowing through to Claude instead of ending the job, since diagnosing that break is the evaluation's purpose. Because that also tolerates a resolution or toolchain failure, which would leave the cache cold and the evaluation reporting an authentication error as though the bump caused it, a following step asserts the artifact is actually cached and fails loudly when it is not. This keeps secrets.GITHUB_TOKEN out of every surface the agent can read, which matters on a public repository, and leaves the action's own token handling alone so the sticky evaluation comment keeps updating in place rather than posting a new comment per bump.
authenticator declares no product flavors, so the flavored task name does not exist there, and Gradle rejects an unknown task before running anything.
github-actions
Bot
added
the
t:llm
Claude Configuration Validation — PR #7270Scope: one changed file, The entire diff is one line. Step 3 (line 33) changed from: to: Verdict: approve. No critical or major issues. The change is factually correct and an 1. Plugin Validation — SKIPPED (not applicable)No plugin directories changed. There is no 2. Skill Review — RUN
Correctness of the changed line — CONFIRMED CORRECT
Naming both tasks explicitly also removes a real failure mode: a reader expanding the old Structure and quality checks — PASS
FindingsMINOR / warning — line 45 says "task" (singular) but step 3 now runs two tasks Step 10 reads "Verify with the same compile task used in step 3." After this change step 3 invokes Remediation: pluralize, or inline the command so the step survives reordering: MINOR / warning — Verified: 103 files under This is a pre-existing gap, not introduced here, but the PR is already editing this exact line so (or add a sentence to step 10 noting that test compilation must also be checked). Optional for 3. Configuration & Security Review — RUNUsed the Security scan — CLEAN
Pre-existing observations (out of this PR's diff — informational only)These are in unchanged parts of the file. Listing them for the maintainer; none should block this
Summary
Errors (must fix): none. Warnings (should fix, both optional for this PR): singular "task" wording at line 45; step 3/10 The one-line change was verified correct against |
🤖 Bitwarden Claude Code ReviewOverall Assessment: APPROVE This PR replaces the Code Review DetailsNo findings. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #7270 +/- ##
=======================================
Coverage 86.25% 86.25%
=======================================
Files 891 891
Lines 65294 65294
Branches 9808 9808
=======================================
Hits 56320 56320
Misses 5472 5472
Partials 3502 3502
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
2 participants
🎟️ Tracking
#7267 — the SDK-eval workflow's compile verification still could not authenticate to GitHub Packages after #7268.
📔 Objective
claude-code-actionassigns its own resolved GitHub token toGITHUB_TOKENandGH_TOKENin the environment it hands Claude's Bash tool, so no value the workflow places in that environment reaches Gradle, and the token it substitutes carries nopackages:readgrant for the SDK package. Resolving the dependency in a plain shell step ahead of Claude populates the Gradle module cache instead, so the compile Claude runs reads the fixed SDK version from cache and needs no credential of its own.continue-on-errorkeeps a real compile break flowing through to Claude, since diagnosing that break is the evaluation's purpose. Because that also tolerates a resolution or toolchain failure, which would leave the cache cold and the evaluation reporting an authentication error as though the bump caused it, a following step asserts the artifact is actually cached and fails loudly when it is not.This keeps
secrets.GITHUB_TOKENout of every surface the agent can read, which matters on a public repository, and leaves the action's own token handling alone so the sticky evaluation comment keeps updating in place.