From db659c29519c64e57194f7122d0b99593f53641a Mon Sep 17 00:00:00 2001 From: jnasbyupgrade Date: Sat, 29 Aug 2026 17:44:39 -0500 Subject: [PATCH] ci: pin claude-code-action to a SHA in claude-code-review.yml This job runs as pull_request_target with pull-requests: write, so a moved upstream tag must not silently change what code runs -- the same reasoning already applied to github-script's pin in ci.yml/protect-label.yml (see those comments). claude-code-action was the one action in this trust class still tracking a mutable tag (@v1) instead of a SHA. `actions/checkout` and claude.yml's own claude-code-action@v1 stay on tags deliberately (existing comments: "so upstream fixes are picked up automatically") -- checkout only reads the base branch, and claude.yml runs under a much narrower trust boundary (actor-gated, read-only permissions), not pull_request_target with write access. This change doesn't touch either. Related changes in pgxntool-test: - Same fix, same rationale, mirrored in its own claude-code-review.yml Co-Authored-By: Claude --- .github/workflows/claude-code-review.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index b9524af..b9fcfe2 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -100,7 +100,10 @@ jobs: - name: Run Claude Code Review if: steps.gate.outputs.decision == 'run' - uses: anthropics/claude-code-action@v1 + # Pinned to an immutable SHA: this job runs as pull_request_target with + # pull-requests: write, so a moved upstream tag must not change what + # runs -- same rationale as github-script's pin in ci.yml/protect-label.yml. + uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10 # v1 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} # Provide github_token so the action uses it directly for GitHub API