Merge pull request #160 from ModelMirrorAI/ci/agentic-workflows-anthropic-api-key

ci: authenticate agentic workflows via Anthropic API key

Author: modelmirror

.github/workflows/run-dev.yml

@@ -91,8 +91,21 @@ jobs:
           ISSUE_TITLE: ${{ github.event.issue.title }}
           ISSUE_BODY: ${{ github.event.issue.body }}
         with:
-          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          # Auth is the Anthropic API key (pay-per-token): automated pipeline
+          # inference is API-metered by design (see docs/budget.md). For a
+          # local/interactive fallback, swap this for
+          # `claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}`.
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           github_token: ${{ steps.app-token.outputs.token }}
+          # The API key's default prompt-cache TTL is only 5 minutes, which would
+          # expire across a long dev run's tool-use turns; pin the 1-hour TTL so the
+          # stable prefix (AGENTS.md + prompt) keeps its cache-read discount.
+          settings: |
+            {
+              "env": {
+                "ENABLE_PROMPT_CACHING_1H": "1"
+              }
+            }
           prompt: |
             Read .github/prompts/dev.md and AGENTS.md, then complete the `run:dev`
             development task described in the issue (number in ISSUE_NUMBER, title in

.github/workflows/run-evaluate.yml

@@ -177,18 +177,18 @@ jobs:
           EVALUATOR_ID: ${{ matrix.evaluator_id }}
           RUN_ID: ${{ matrix.run_id }}
         with:
-          # Auth is the Claude Max subscription (OAuth) today. To move to the
-          # Anthropic API later, replace this line with
-          # `anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}`; the cache
-          # settings below already cover that switch.
-          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          # Auth is the Anthropic API key (pay-per-token): automated pipeline
+          # inference is API-metered by design (see docs/budget.md), and per
+          # Anthropic policy the Max subscription OAuth token is for interactive
+          # Claude Code / claude.ai, not CI. For a local/interactive fallback,
+          # swap this for `claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}`.
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           github_token: ${{ steps.agent-token.outputs.token }}
           # Prompt caching is automatic: the stable prefix (AGENTS.md + the
           # prompt template + schema) is cached across the run's tool-use turns.
-          # OAuth requests the 1-hour cache TTL for free; setting it explicitly
-          # keeps that TTL (and the cache-read discount priced in
-          # fedcourtsai.pricing) once auth moves to an API key — whose default
-          # would otherwise fall to 5 minutes and expire the cache mid-run.
+          # The API key's default cache TTL is only 5 minutes, which would expire
+          # mid-run, so ENABLE_PROMPT_CACHING_1H below pins the 1-hour TTL (and the
+          # cache-read discount priced in fedcourtsai.pricing).
           settings: |
             {
               "env": {

.github/workflows/run-predict.yml

@@ -176,18 +176,18 @@ jobs:
           RUN_ID: ${{ matrix.run_id }}
           COURTLISTENER_API_TOKEN: ${{ secrets.COURTLISTENER_API_TOKEN }}
         with:
-          # Auth is the Claude Max subscription (OAuth) today. To move to the
-          # Anthropic API later, replace this line with
-          # `anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}`; the cache
-          # settings below already cover that switch.
-          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          # Auth is the Anthropic API key (pay-per-token): automated pipeline
+          # inference is API-metered by design (see docs/budget.md), and per
+          # Anthropic policy the Max subscription OAuth token is for interactive
+          # Claude Code / claude.ai, not CI. For a local/interactive fallback,
+          # swap this for `claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}`.
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           github_token: ${{ steps.agent-token.outputs.token }}
           # Prompt caching is automatic: the stable prefix (AGENTS.md + the
           # prompt template + schema) is cached across the run's tool-use turns.
-          # OAuth requests the 1-hour cache TTL for free; setting it explicitly
-          # keeps that TTL (and the cache-read discount priced in
-          # fedcourtsai.pricing) once auth moves to an API key — whose default
-          # would otherwise fall to 5 minutes and expire the cache mid-run.
+          # The API key's default cache TTL is only 5 minutes, which would expire
+          # mid-run, so ENABLE_PROMPT_CACHING_1H below pins the 1-hour TTL (and the
+          # cache-read discount priced in fedcourtsai.pricing).
           settings: |
             {
               "env": {

.github/workflows/run-reconcile.yml

@@ -190,16 +190,17 @@ jobs:
           EVENT_IDS: ${{ matrix.events }}
           RUN_ID: ${{ matrix.run_id }}
         with:
-          # Auth is the Claude Max subscription (OAuth) today. To move to the
-          # Anthropic API later, replace this line with
-          # `anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}`; the cache
-          # settings below already cover that switch.
-          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          # Auth is the Anthropic API key (pay-per-token): automated pipeline
+          # inference is API-metered by design (see docs/budget.md), and per
+          # Anthropic policy the Max subscription OAuth token is for interactive
+          # Claude Code / claude.ai, not CI. For a local/interactive fallback,
+          # swap this for `claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}`.
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           github_token: ${{ steps.agent-token.outputs.token }}
           # Prompt caching is automatic: the stable prefix (AGENTS.md + the prompt
-          # template + schema) is cached across the run's tool-use turns. OAuth
-          # requests the 1-hour cache TTL for free; setting it explicitly keeps that
-          # TTL (and the cache-read discount) once auth moves to an API key.
+          # template + schema) is cached across the run's tool-use turns. The API
+          # key's default cache TTL is only 5 minutes, so ENABLE_PROMPT_CACHING_1H
+          # below pins the 1-hour TTL (and the cache-read discount).
           settings: |
             {
               "env": {