From 214b5b9fee40bc38002db43f031f0b9a4f8ed4d0 Mon Sep 17 00:00:00 2001 From: jnasbyupgrade Date: Sat, 29 Aug 2026 17:44:45 -0500 Subject: [PATCH] ci: pin claude-code-action to a SHA in claude-code-review.yml Same fix, same rationale as pgxntool commit db659c2: this job runs as pull_request_target with pull-requests: write, so a moved upstream tag must not silently change what code runs -- matching the SHA-pin already used for github-script in pgxntool's ci.yml/protect-label.yml. claude-code-action was the one action in this trust class still tracking a mutable tag (@v1). `actions/checkout` here and claude.yml's own claude-code-action@v1 stay on tags deliberately (existing comments: "so upstream fixes are picked up automatically") -- this doesn't touch either. Co-Authored-By: Claude --- .github/workflows/claude-code-review.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index ff3a66d..1f4bcda 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -100,7 +100,11 @@ jobs: - name: Run Claude Code Review if: steps.gate.outputs.decision == 'run' - uses: anthropics/claude-code-action@v1 + # Pinned to an immutable SHA: this job runs as pull_request_target with + # pull-requests: write, so a moved upstream tag must not change what + # runs -- same rationale as github-script's pin in pgxntool's + # ci.yml/protect-label.yml. + uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10 # v1 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} # Provide github_token so the action uses it directly for GitHub API