fix: pass ANTHROPIC_API_KEY to validation in all Claude workflows

[Claude]

The Claude smoke test and other Claude-based workflows were failing at the secret validation step because ANTHROPIC_API_KEY was not passed to the validation script's environment.

Root Cause

The validate_multi_secret.sh script checks for either CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY, but only CLAUDE_CODE_OAUTH_TOKEN was in the step's env: section. Since the repository uses ANTHROPIC_API_KEY, validation failed.

Changes

• smoke-claude.lock.yml: Added ANTHROPIC_API_KEY to validation step env in agent and detection jobs
• secret-digger-claude.lock.yml: Added ANTHROPIC_API_KEY to validation step env in both jobs
• security-guard.lock.yml: Added ANTHROPIC_API_KEY to validation step env in both jobs

- name: Validate CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY secret
  env:
    CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+   ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

[github-actions]

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

[github-actions]

💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges...

[github-actions]

✅ Bun Build Test - PASS

Project	Install	Tests	Status
elysia	✅	1/1	PASS
hono	✅	1/1	PASS

Overall: PASS

All Bun projects successfully installed dependencies and passed tests.

AI generated by Build Test Bun

[github-actions]

Node.js Build Test Results ✅

All tests completed successfully!

Project	Install	Tests	Status
clsx	✅	PASS	PASS ✅
execa	✅	PASS	PASS ✅
p-limit	✅	PASS	PASS ✅

Overall: PASS ✅

All three Node.js projects built and tested successfully.

AI generated by Build Test Node.js

[github-actions]

Smoke Test Results

Last 2 Merged PRs:

• fix(agent): enable direct api-proxy access and remove api key from env #807: fix(agent): enable direct api-proxy access and remove api key from env
• fix(squid): handle bare hostnames without leading dot for api-proxy #805: fix(squid): handle bare hostnames without leading dot for api-proxy

Test Results:

• ✅ GitHub MCP: Retrieved 2 merged PRs
• ✅ Playwright: Verified GitHub homepage title contains "GitHub"
• ✅ File Writing: Created test file successfully
• ✅ Bash Tool: Verified file content

Overall Status: PASS

cc: @Claude @lpcox

AI generated by Smoke Copilot

[github-actions]

Build Test: Deno ✅

Project	Tests	Status
oak	1/1	✅ PASS
std	1/1	✅ PASS

Overall: ✅ PASS

All Deno tests completed successfully.

AI generated by Build Test Deno

[github-actions]

.NET Build Test Results

Project	Restore	Build	Run	Status
hello-world	✅	✅	✅	PASS
json-parse	✅	✅	✅	PASS

Overall: PASS ✅

All .NET projects restored, built, and ran successfully.

AI generated by Build Test .NET

[github-actions]

Rust Build Test Results

Project	Build	Tests	Status
fd	✅	1/1	PASS
zoxide	✅	1/1	PASS

Overall: PASS

All Rust projects built successfully and all tests passed.

AI generated by Build Test Rust

[github-actions]

Go Build Test Results ✅

All Go projects tested successfully!

Project	Download	Tests	Status
color	✅	1/1	PASS
env	✅	1/1	PASS
uuid	✅	1/1	PASS

Overall: PASS

All module downloads succeeded and all tests passed.

AI generated by Build Test Go

[github-actions]

C++ Build Test Results

Project	CMake	Build	Status
fmt	✅	✅	PASS
json	✅	✅	PASS

Overall: PASS ✅

All C++ projects successfully configured and built.

AI generated by Build Test C++

[github-actions]

Build Test: Java - Results

Project	Compile	Tests	Status
gson	✅	1/1	PASS
caffeine	✅	1/1	PASS

Overall: PASS

All Java Maven projects compiled and tested successfully through the AWF firewall.

AI generated by Build Test Java

[Copilot]

Pull request overview

Updates Claude-based GitHub Actions workflows to correctly pass ANTHROPIC_API_KEY into the validate_multi_secret.sh step environment, aligning the validation script’s expectations with how secrets are configured in this repo.

Changes:

• Add ANTHROPIC_API_KEY to the validation step env: in the Claude smoke workflow (agent + detection jobs).
• Add ANTHROPIC_API_KEY to the validation step env: in the Secret Digger (Claude) workflow (both jobs).
• Add ANTHROPIC_API_KEY to the validation step env: in the Security Guard workflow (both jobs).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
.github/workflows/smoke-claude.lock.yml	Passes ANTHROPIC_API_KEY into the Claude secret validation step for both agent and detection jobs.
.github/workflows/security-guard.lock.yml	Passes ANTHROPIC_API_KEY into the Claude secret validation step for both jobs.
.github/workflows/secret-digger-claude.lock.yml	Passes ANTHROPIC_API_KEY into the Claude secret validation step for both jobs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This change passes ANTHROPIC_API_KEY into the validation step, but later steps that actually invoke claude in this workflow still only provide CLAUDE_CODE_OAUTH_TOKEN in their env: blocks. If the repo is configured with ANTHROPIC_API_KEY (and not CLAUDE_CODE_OAUTH_TOKEN), the workflow will likely proceed past validation and then fail when claude runs without credentials. Consider also wiring ANTHROPIC_API_KEY into the Execute Claude Code CLI step env (and any other step that needs auth), similar to how the Codex workflows pass both keys after validation.

See below for a potential fix:

      - name: Validate CLAUDE_CODE_OAUTH_TOKEN secret
        id: validate-secret
        run: /opt/gh-aw/actions/validate_multi_secret.sh CLAUDE_CODE_OAUTH_TOKEN 'Claude Code' https://github.github.com/gh-aw/reference/engines/#anthropic-claude-code
        env:
          CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
      - name: Setup Node.js
        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
        with:
        with:

[Copilot]

ANTHROPIC_API_KEY is now passed to the secret-validation step, but the subsequent step(s) that run claude in this workflow still only set CLAUDE_CODE_OAUTH_TOKEN in env:. If CLAUDE_CODE_OAUTH_TOKEN is unset and the repo relies on ANTHROPIC_API_KEY, validation will pass but the workflow can still fail at runtime due to missing auth. Consider passing ANTHROPIC_API_KEY to the Execute Claude Code CLI step env as well (and/or using a fallback expression) to keep validation aligned with runtime configuration.

See below for a potential fix:

      - name: Validate CLAUDE_CODE_OAUTH_TOKEN secret
        id: validate-secret
        run: /opt/gh-aw/actions/validate_multi_secret.sh CLAUDE_CODE_OAUTH_TOKEN 'Claude Code' https://github.github.com/gh-aw/reference/engines/#anthropic-claude-code
        env:
          CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
      - name: Setup Node.js
        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0

[Copilot]

This adds ANTHROPIC_API_KEY to the validation step env, but later steps that execute claude in this workflow only export CLAUDE_CODE_OAUTH_TOKEN. If the repository is configured with ANTHROPIC_API_KEY (as implied by the validation arguments), the workflow may still fail when claude runs without that key. Consider also passing ANTHROPIC_API_KEY into the Execute Claude Code CLI step env (both the agent and detection jobs, if applicable).

See below for a potential fix:

      - name: Validate CLAUDE_CODE_OAUTH_TOKEN secret
        id: validate-secret
        run: /opt/gh-aw/actions/validate_multi_secret.sh CLAUDE_CODE_OAUTH_TOKEN 'Claude Code' https://github.github.com/gh-aw/reference/engines/#anthropic-claude-code
        env:
          CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
      - name: Setup Node.js
        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0