v0.82.10 regression: imported engine definition rejects Anthropic WIF auth (mapping treated as sequence)

[benissimo]

Summary

Since v0.82.10, an engine: block that is pulled in from an imported file can no longer carry an Anthropic Workload Identity Federation (WIF) auth: configuration. The same auth: block works when written inline in the main workflow. This is a regression — it worked on every release up to and including v0.82.9.

The imported-file code path now rejects the WIF auth: mapping with:

error: failed to register engine definition from included file: failed to parse engine definition:
[2:21] mapping was used where sequence is expected
   1 | auth:
>  2 |   federation-rule-id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
   3 |   organization-id: ...
   4 |   provider: anthropic
   5 |   service-account-id: ...

Reproduction

.github/workflows/shared/wif-engine.md (imported fragment):

---
engine:
  id: claude
  auth:
    type: github-oidc
    provider: anthropic
    federation-rule-id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
    organization-id: cb16d48f-...
    service-account-id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
    workspace-id: wrkspc_...
---

.github/workflows/test.md:

---
on:
  workflow_dispatch:
permissions:
  contents: read
  id-token: write
imports:
  - shared/wif-engine.md
network: defaults
timeout-minutes: 5
---
# Test
Echo ok.

gh aw compile test → the error above.

Observed behavior across shapes (all on v0.82.14)

Engine location / auth: shape	Result
Imported, auth: as a mapping (the documented WIF shape)	hard compile error (mapping was used where sequence is expected)
Imported, auth: wrapped as a single-item list	compiles, but the WIF config is silently dropped — the lock emits a Validate ANTHROPIC_API_KEY secret step and no AWF_AUTH_* env vars, i.e. it falls back to static API-key auth
Inline (engine block in the main workflow), auth: as a mapping	works — lock contains AWF_AUTH_ANTHROPIC_FEDERATION_RULE_ID, AWF_AUTH_ANTHROPIC_ORGANIZATION_ID, AWF_AUTH_ANTHROPIC_SERVICE_ACCOUNT_ID, AWF_AUTH_ANTHROPIC_WORKSPACE_ID, AWF_AUTH_PROVIDER: anthropic, AWF_AUTH_TYPE: github-oidc

The list-wrapped variant compiling-but-silently-downgrading-auth is arguably worse than the hard error, because a workflow that expected WIF would run against a (possibly absent) ANTHROPIC_API_KEY with no signal that federation was dropped.

Version bisection

Compiled the identical imported-mapping repro against release binaries:

Version	Result
v0.80.9, v0.81.6, v0.82.0, v0.82.5, v0.82.7, v0.82.9	✅ compiles, WIF present in lock
v0.82.10, v0.82.11, v0.82.13, v0.82.14	❌ mapping was used where sequence is expected

The break lands exactly at v0.82.10, which shipped the declarative custom-engine frontmatter / behavior-defined engine model (#44465). It looks like imported engine definitions are now parsed via the behavior-defined-engine path (parseAuthDefinition), whose auth is an array of OAuth-style secret bindings (strategy / token-url / client-id / …). That model has no representation for the Anthropic WIF fields (federation-rule-id, organization-id, service-account-id, workspace-id), whereas the inline path (parseEngineAuthConfig) still accepts the WIF auth: object.

Notably, gh aw fix --list-codemods has no codemod for this change, unlike other intended field migrations — which suggests the regression to the imported path was unintended rather than a deliberate deprecation.

Impact

Any repo that centralizes its engine + WIF auth in a single imported fragment (a common pattern for "auth config in exactly one place, ${{ vars.* }}-driven, no per-repo recompile") breaks on upgrade to v0.82.10+. The only working option today is to inline the engine block into every workflow, which defeats the single-source-of-truth reason for importing it.

Ask

Restore parity so an imported engine definition accepts the same engine.auth object (including Anthropic WIF fields) that inline engines accept — or, if imported engines are intentionally moving to the behavior-defined model, provide a supported way to express Anthropic WIF there plus a gh aw fix codemod for the migration.

---

Filed via Claude Code — https://claude.ai/code/session_01NcsmxPYx6jhLFWYWR1tYD6