engine.auth schema rejects Anthropic WIF fields — #35937 acceptance criterion 6 unfulfilled

[benissimo]

Problem

#35937's acceptance criterion 6 was not actually verified by #35939:

• Integration test: Claude WIF workflow compiles without requiring ANTHROPIC_API_KEY secret

gh aw compile rejects the documented YAML at schema validation, before the new parser code ever runs.

Reproduction

The most recent released gh-aw is v0.76.1 (2026-05-26), which predates PR #35939 (merged 2026-05-30). To verify the gap exists in code that does include PR #35939's parser changes, I built gh-aw directly from main:

$ git rev-parse HEAD
b1ae2f1...   # main, with PR #35939 merged as a465cab
$ go build -o /tmp/gh-aw-main ./cmd/gh-aw

Workflow .github/workflows/wif-schema-test.md (using the shape from #35937's "Wire through" section and PR #35939's example):

---
on:
  workflow_dispatch:

permissions:
  contents: read
  id-token: write

engine:
  id: claude
  auth:
    type: github-oidc
    provider: anthropic
    federation-rule-id: fdrl_test
    organization-id: org_test
    service-account-id: svac_test
    workspace-id: ws_test

network: defaults

timeout-minutes: 5
---

# Schema test

Echo "ok".

$ /tmp/gh-aw-main compile wif-schema-test
✗ Compiled 1 workflow(s): 1 error(s) across 1 failed workflow(s), 0 warning(s)

✗ Failed workflows:
  ✗ wif-schema-test.md

wif-schema-test.md (1 error(s)):
  🟡 MEDIUM PRIORITY:
    1. .github/workflows/wif-schema-test.md:13:5: error: Unknown properties: federation-rule-id, organization-id, provider, service-account-id, workspace-id
10 |   id: claude
11 |   auth:
12 |     type: github-oidc
13 |     provider: anthropic
         ^^^^^^^^
14 |     federation-rule-id: fdrl_test
15 |     organization-id: org_test
16 |     service-account-id: svac_test
       → Fix this configuration issue and re-run `gh aw compile`.
✗ compilation failed

Unambiguously a schema-validation error — the error message names all five new fields explicitly. PR #35939's parseEngineAuthConfig extensions can't be exercised because the schema validator rejects the YAML upstream of them.

Root cause

pkg/parser/schemas/main_workflow_schema.json, at $defs.engine_config.oneOf[1].properties.auth:

{
  "properties": {
    "type": {...},
    "audience": {...},
    "azure-tenant-id": {...},
    "azure-client-id": {...},
    "azure-scope": {...},
    "azure-cloud": {...}
  },
  "additionalProperties": false
}

PR #35939 added five new fields the Go parser reads (provider, federation-rule-id, organization-id, service-account-id, workspace-id) but did not update the JSON schema. additionalProperties: false rejects them.

PR #35939's tests (engine_config_test.go, claude_engine_test.go, etc.) call parseEngineAuthConfig directly with map[string]any fixtures, which bypasses schema validation — so the gap was invisible in CI. The branch had no schema commit; the ADR (docs/adr/35939-anthropic-wif-support-in-compiler.md) doesn't reference the schema either, despite explicitly weighing schema-validation tradeoffs in its rejected-alternatives section.

Suggested fix

Either:

1. Add provider, federation-rule-id, organization-id, service-account-id, workspace-id to the engine.auth schema's properties, or
2. Restructure with oneOf / if-then branches on provider to validate Azure-only vs Anthropic-only field sets distinctly (mirrors how gh-aw-firewall's awf-config-schema.json is structured post–PR #4012).

Plus an end-to-end compile-test fixture so acceptance criterion 6 is genuinely covered going forward — a regression test that takes the YAML above through gh aw compile and asserts exit 0.

Related

• #35937 — original issue closed by feat: Anthropic WIF support in EngineAuthConfig and ClaudeEngine #35939; criterion 6 unfulfilled
• #35561 — earlier issue; same scope
• github/gh-aw-firewall#4012 — reference for the schema shape on the firewall side
• Working POC: https://gist.github.com/benissimo/340e7cfb5fdd102c5cd8d39cf91bcc32

cc @pelikhan @lpcox (per prior threads on this work).

[benissimo]

(Superseded — the cleaner reproduction is now in the issue body.)

[pelikhan]

We need to mint a release to catch up with docs