From 173fccb6e411fb42f14469be5fa225cf05fe312e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 6 Sep 2026 01:42:24 +0000 Subject: [PATCH 1/3] chore(deps): bump anthropics/claude-code-action Bumps the github-actions group with 1 update in the / directory: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action). Updates `anthropics/claude-code-action` from 1.0.210 to 1.0.215 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/a874e9ecd7bb36efdad65429c6b35815f5a08f10...ef8bb1e43bf303cff727a1dd0b8837029fe982a2) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.214 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/claude.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 377c68b24..5f5c5bb6d 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -71,7 +71,7 @@ jobs: fetch-depth: 1 - name: Run Claude Code if: ${{ env.CLAUDE_CODE_OAUTH_TOKEN != '' }} - uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10 # v1.0.210 + uses: anthropics/claude-code-action@ef8bb1e43bf303cff727a1dd0b8837029fe982a2 # v1.0.215 with: # The action's default trigger phrase is "@claude"; it reads the # triggering comment/review and acts on the current PR head. From 2df2db0b5a6402b5f9b7e46ccf0313a4341a069d Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 6 Sep 2026 12:53:37 +0000 Subject: [PATCH 2/3] ci: add reviewed pin for anthropics/claude-code-action v1.0.215 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes "Static PR checks" (check:github-actions) on the dependabot bump from v1.0.210 to v1.0.215. Diff v1.0.210...v1.0.215 upstream is only Claude Code (2.1.251->2.1.260) and Agent SDK (0.3.251->0.3.260) version bumps in action.yml/run.ts/package.json/bun.lock — no change to permissions, secrets handling, or the action's trust boundary. Verified against the upstream repo directly (git diff between the two pinned commits). Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_019KtaqjrGBF8ZC9hKTb9Bri --- scripts/github-action-pins.mjs | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/scripts/github-action-pins.mjs b/scripts/github-action-pins.mjs index 3d4d591e2..b6e680950 100644 --- a/scripts/github-action-pins.mjs +++ b/scripts/github-action-pins.mjs @@ -51,6 +51,12 @@ const reviewedActionPins = new Map([ // encoded branch names in GitHub links, and .gitattributes — no change // to permissions, secrets handling, or the action's trust boundary. ["a874e9ecd7bb36efdad65429c6b35815f5a08f10", "v1.0.210"], + // Reviewed 2026-09-06 for PR #2647 (Dependabot github-actions group): + // annotated tag v1.0.215 peels to this commit. Diff v1.0.210...v1.0.215 + // is only Claude Code (2.1.251->2.1.260) and Agent SDK (0.3.251->0.3.260) + // version bumps in action.yml/run.ts/package.json/bun.lock — no change + // to permissions, secrets handling, or the action's trust boundary. + ["ef8bb1e43bf303cff727a1dd0b8837029fe982a2", "v1.0.215"], ]), ], // Reviewed 2026-08-13 for the credential-isolated Run PR operator: annotated From 58d844796dd2240c53ad38eb02eb50f5a38a73c3 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 6 Sep 2026 12:54:50 +0000 Subject: [PATCH 3/3] ledger: record Run PR sweep review for PR #2647 Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_019KtaqjrGBF8ZC9hKTb9Bri --- ...a2f142a902b7b827c4174a89110aa0e17889c30b17eae50500d.record.md | 1 + 1 file changed, 1 insertion(+) create mode 100644 docs/branch-review-records/7592e6cdace9aa2f142a902b7b827c4174a89110aa0e17889c30b17eae50500d.record.md diff --git a/docs/branch-review-records/7592e6cdace9aa2f142a902b7b827c4174a89110aa0e17889c30b17eae50500d.record.md b/docs/branch-review-records/7592e6cdace9aa2f142a902b7b827c4174a89110aa0e17889c30b17eae50500d.record.md new file mode 100644 index 000000000..7e691cb5a --- /dev/null +++ b/docs/branch-review-records/7592e6cdace9aa2f142a902b7b827c4174a89110aa0e17889c30b17eae50500d.record.md @@ -0,0 +1 @@ +| 2026-09-06 | dependabot/github_actions/github-actions-91ab6ea131 (PR #2647) | 2df2db0b5a6402b5f9b7e46ccf0313a4341a069d | Run PR sweep: CI fix | Static PR checks fixed: check:github-actions failed because the reviewed-SHA allowlist did not include the bumped anthropics/claude-code-action commit (v1.0.210 -> v1.0.215). Verified the upstream diff between the two pinned commits directly (git diff on a fresh clone of anthropics/claude-code-action): only Claude Code/Agent SDK version-number bumps, no permissions/secrets/trust-boundary change. Added the reviewed allowlist entry. No unresolved review threads. | npm run check:github-actions (passed); npx vitest run tests/github-action-pins.test.ts (7 passed); no provider-backed checks run |