ci: pass GitHub identity to Claude action

.github/actions/README.md

@@ -29,6 +29,7 @@ The `pr-review` action additionally accepts:
   When supplied, this token is the single identity for creating reviews,
   posting or updating status comments, and resolving addressed automated
   review threads.
+  The review action also forwards it to Claude Code for GitHub authentication instead of requesting a separate GitHub App token through OIDC.
   When omitted, publication uses the job token and leaves GitHub thread state
   unchanged.
 - `model` - optional, defaults to `claude-opus-4-7`.

.github/actions/claude-pr-review/action.yml

@@ -146,6 +146,7 @@ runs:
       continue-on-error: true
       uses: anthropics/claude-code-action@c3d45e8e941e1b2ad7b278c57482d9c5bf1f35b3 # v1
       with:
+        github_token: ${{ inputs.github_identity_token }}
         claude_code_oauth_token: ${{ inputs.claude_code_oauth_token }}
         allowed_bots: ${{ inputs.allowed_bots }}
         display_report: false
@@ -252,6 +253,7 @@ runs:
          steps.review.outputs.structured_output == '')
       uses: anthropics/claude-code-action@c3d45e8e941e1b2ad7b278c57482d9c5bf1f35b3 # v1
       with:
+        github_token: ${{ inputs.github_identity_token }}
         claude_code_oauth_token: ${{ inputs.claude_code_oauth_token }}
         allowed_bots: ${{ inputs.allowed_bots }}
         display_report: false

.github/actions/claude-pr-review/test_review_pipeline.py

@@ -127,6 +127,12 @@ def test_action_exposes_optional_github_identity_token(self):
         )
         # prepare (announce), publish, and report (retire on failure).
         self.assertEqual(action.count(identity_env), 3)
+        self.assertEqual(
+            action.count(
+                "github_token: ${{ inputs.github_identity_token }}"
+            ),
+            2,
+        )
         self.assertIn(
             "GH_RESOLVE_THREADS: "
             "${{ inputs.github_identity_token != '' }}",