fix(ci): add missing ANTHROPIC_API_KEY to detection job

[Claude]

The detection job was failing with "Not logged in · Please run /login" because the Claude Code CLI execution step was missing the ANTHROPIC_API_KEY environment variable.

Root Cause

The detection job validates that ANTHROPIC_API_KEY exists (line 1091) but was not passing it to the Claude CLI execution environment. When CLAUDE_CODE_OAUTH_TOKEN is empty, Claude Code CLI falls back to ANTHROPIC_API_KEY for authentication, but the variable was unavailable in the execution context.

Changes

• Added ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} to the detection job's "Execute Claude Code CLI" step environment block (line 1125)
• Matches the existing configuration in the agent job (line 791)

- name: Execute Claude Code CLI
  run: |
    claude --print --disable-slash-commands ...
  env:
    ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}  # Added
    CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
    # ... other env vars

[Copilot]

Pull request overview

Fixes the smoke-test GitHub Actions workflow so the threat detection (“detection”) job can authenticate Claude Code CLI using ANTHROPIC_API_KEY when CLAUDE_CODE_OAUTH_TOKEN is unset, matching the already-working agent job configuration.

Changes:

• Adds ANTHROPIC_API_KEY to the detection job’s “Execute Claude Code CLI” step env: block.
• Aligns detection job runtime env propagation with the agent job (which already passes the key).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.