From 0eb0b1f98b25e9837e7919d5f0a3c15d030fbc8f Mon Sep 17 00:00:00 2001
From: "sadrbot[bot]" <346629323+sadrbot[bot]@users.noreply.github.com>
Date: Sun, 25 Oct 2026 09:20:29 +0000
Subject: [PATCH 1/2] sadr: pin the CI Python versions to exact releases

The test matrix floated on 3.10 and 3.15. Sadr pinned each leg to what it resolves to today: 3.10.22 and 3.15.1.

Signed-off-by: sadrbot[bot] <346629323+sadrbot[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 02329a7..0c54a9e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,7 +16,7 @@ jobs:
     strategy:
       matrix:
         # The oldest and the newest Python that the scripts support.
-        python: ["3.10", "3.15"]
+        python: ["3.10.22", "3.15.1"]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

From 32e9eb787a042b70f9f3e9187dc5778ca4deeba3 Mon Sep 17 00:00:00 2001
From: "sadrbot[bot]" <346629323+sadrbot[bot]@users.noreply.github.com>
Date: Sun, 25 Oct 2026 09:20:31 +0000
Subject: [PATCH 2/2] sadr: move claude-code-action to v1.0.252

Both releases since v1.0.250 only bump Claude Code and the Agent SDK. No input changed.

Signed-off-by: sadrbot[bot] <346629323+sadrbot[bot]@users.noreply.github.com>
---
 .github/workflows/org.yml | 2 +-
 .github/workflows/run.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/org.yml b/.github/workflows/org.yml
index 57a7eba..38b9a6e 100644
--- a/.github/workflows/org.yml
+++ b/.github/workflows/org.yml
@@ -222,7 +222,7 @@ jobs:
           # The credential helper supplies fresh tokens.
           persist-credentials: false
 
-      - uses: anthropics/claude-code-action@a26b07d8c778b0c43f64618e5fd29fd0f8af72e8 # v1.0.250
+      - uses: anthropics/claude-code-action@f27be6b65a4652f08a2ba3cff79114829b588967 # v1.0.252
         env:
           SEMGREP_APP_TOKEN: ${{ secrets.semgrep_app_token }}
           SADR_APP_TOKEN: ${{ steps.app.outputs.app-token }}
diff --git a/.github/workflows/run.yml b/.github/workflows/run.yml
index 101ec35..a502e92 100644
--- a/.github/workflows/run.yml
+++ b/.github/workflows/run.yml
@@ -158,7 +158,7 @@ jobs:
           git config --global user.name 'github-actions[bot]'
           git config --global user.email '41898282+github-actions[bot]@users.noreply.github.com'
 
-      - uses: anthropics/claude-code-action@a26b07d8c778b0c43f64618e5fd29fd0f8af72e8 # v1.0.250
+      - uses: anthropics/claude-code-action@f27be6b65a4652f08a2ba3cff79114829b588967 # v1.0.252
         env:
           SEMGREP_APP_TOKEN: ${{ secrets.semgrep_app_token }}
           SADR_APP_TOKEN: ${{ steps.app.outputs.app-token }}