Build agents

Inputs, outputs, and secrets

What a run is handed, what it hands on, and where a model key lives.

A run is handed inputs.name from a dispatch, secrets.ANTHROPIC_API_KEY from the repository, and needs.build.outputs.tag from an earlier job.

The model key

An agent takes one model credential, and it lives on GitHub as an Actions secret on the repository or the organization.

  • ANTHROPIC_API_KEY for an API key, or CLAUDE_CODE_OAUTH_TOKEN for a Claude subscription.
  • Both are inputs on the same step, and each template names the one it expects.
  • Repo Fleet never holds it, and never sees a model call.
- uses: anthropics/claude-code-action@v1
  with:
    anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}

The run's own token

  • GitHub mints one for every run, read as secrets.GITHUB_TOKEN and scoped by the workflow's permissions.
  • Grant what the agent needs and no more: contents: write to push, pull-requests: write to open one, issues: write to comment.
  • It dies with the run, so there is nothing to rotate.

Inputs and outputs

  • workflow_dispatch declares inputs, each with a type and a default, and Start a run offers them as fields.
  • Reading one is ${{ inputs.name }}, anywhere in the job.
  • A step writes an output, the job declares it, and a later job reads ${{ needs.build.outputs.tag }}.
  • The reading job must name the other in needs, or the value arrives empty and nothing says why.

Rules that catch people

  • A secret is masked in the log, not hidden. A command that reshapes the value still prints it.
  • An input is not a secret. It is printed in the run's own log.
  • A pull request from a fork gets no secrets, so a stranger cannot run an agent that needs the key.
  • A secret is never read back. Once saved on GitHub, only a run can use it.