RepoJournal
Anthropic @anthropics
141 wires and counting

$ follow Anthropic

Keep up with Anthropic in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-25
stories 10
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

WORKLOAD IDENTITY FEDERATION ROLLS OUT ACROSS PLUGIN ECOSYSTEM

By RepoJournal · Filed · About Anthropic · Composed from the cited sources · methodology

zenexer-ant iainmcgin
2 people shipped this
zenexer-ant @zenexer-ant 2 cited iainmcgin @iainmcgin 1 cited

Static API keys are getting ripped out of GitHub Actions across the plugin suite as Anthropic moves the entire CI/CD auth layer to short-lived tokens.

The migration is orchestrated in three layers: anthropics/claude-plugins-community shipped the core federation inputs [1] that let the scan-plugins action mint GitHub OIDC tokens and exchange them for short-lived bearers without touching a static key. Two dependent repos followed immediately. anthropics/knowledge-work-plugins [2] and anthropics/claude-plugins-official [3] both migrated their scan-plugins workflows to use WIF instead of ANTHROPIC_API_KEY repo secrets, now pinned to the community action's pending merge. anthropics/claude-cookbooks went wider [4], converting all 6 claude-code-action workflows (link-review, model-check, pr-review, lint-format, notebook-quality, notebook-tests) to the same federation pattern in a single commit. All repos now grant id-token: write permissions to their jobs. The federation rule stays pinned to each repository, so leaked tokens are worthless without context. This is the right pattern: no more long-lived keys in GitHub settings, no more audit nightmares when someone has to rotate. On the Rust side, anthropics/buffa landed idiomatic UpperCamelCase enum aliases [5] that let developers write RuleLevel::High instead of RuleLevel::RULE_LEVEL_HIGH while keeping proto names as definitive variants. Small quality-of-life win for generated code.

Action items

References

  1. [1] scan-plugins: add Workload Identity Federation auth inputs ↗ anthropics/claude-plugins-community
  2. [2] ci: migrate scan-plugins.yml to Workload Identity Federation auth (#248) ↗ anthropics/knowledge-work-plugins
  3. [3] ci: migrate scan-plugins.yml to Workload Identity Federation auth (#1991) ↗ anthropics/claude-plugins-official
  4. [4] ci: migrate claude-code-action workflows to Workload Identity Federation ↗ anthropics/claude-cookbooks
  5. [5] codegen: idiomatic UpperCamelCase enum aliases ↗ anthropics/buffa

$ ls anthropics/reviews/ # the step-back reads

the week in review Sonnet 5.5 becomes the default model the month in review Sandbox and SDK holes dominate Anthropic's September
Full archive → Weekly reviews →

Quick answers

What shipped in Anthropic on May 25, 2026?
Static API keys are getting ripped out of GitHub Actions across the plugin suite as Anthropic moves the entire CI/CD auth layer to short-lived tokens. In total, 5 commits and 5 pull requests landed.
Who contributed to Anthropic on May 25, 2026?
2 developers shipped this update, including zenexer-ant and iainmcgin.
What were the notable Anthropic updates?
scan-plugins: add Workload Identity Federation auth inputs, ci: migrate scan-plugins.yml to Workload Identity Federation auth (#248), and ci: migrate scan-plugins.yml to Workload Identity Federation auth (#1991).
♥

$ log @anthropics --recent

Python and Java SDKs take claude-haiku-5-5, typed computer and browser tool calls 49 shipped sandbox-runtime drops connections on invalid upstream status, buffa tightens its parsers 111 shipped Claude Code symlink TOCTOU allows arbitrary file write 15 shipped Sandbox path entries stop silently dropping bracketed directories 6 shipped

$ log --all # elsewhere on the wire

@openclaw OpenClaw fixes premature approval expiry, embedding readiness, and startup integrity proofs Agentic Coding Cline drops dead CLI flags, gemini-cli fixes auth retry loop, Gemini adds OTLP headers

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.