From dd44ccd939a350ae07b9961e7f34004bb5ef56de Mon Sep 17 00:00:00 2001 From: Claude Code Bot Date: Mon, 17 Aug 2026 13:10:14 -0700 Subject: [PATCH] fix(ci): repoint assistant workflow from stale SHA to @v3.1.2 The caller pinned smartwatermelon/github-workflows' claude-assistant.yml to raw commit 9615f93 (2026-08-07). Because that is a SHA rather than a floating tag, the fleet-wide tag repoint that patched every other consumer never reached this repo. That commit carries anthropics/claude-code-action@26ec0412 (v1.0.70), which is vulnerable to GHSA-8q5r-mmjf-575q (patched upstream in 1.0.74). Verified directly against the contents API at both refs: @9615f93 -> claude-code-action@26ec0412 # v1 @v3.1.2 -> claude-code-action@9d7150bc # v1.0.193 v3.1.2 also brings persist-credentials: false on checkout, the template-injection fix, actions/checkout v7.0.1, and a fail-fast precondition check for a missing CLAUDE_CODE_OAUTH_TOKEN. The v3 line is what the rest of the fleet uses; no consumer is on v1. No workflow_call interface drift: v3.1.2 declares no inputs and the same single optional secret (claude_oauth_token), which this caller already passes. Required permissions (contents/pull-requests/issues read, id-token write) are already declared here. Ref change only. Committed with SKIP=zizmor: the sole finding is unpinned-uses on the tag ref, which is deliberate fleet policy for first-party reusable workflows (documented at github-workflows README.md:207). Pinning by SHA is exactly the bug this commit fixes. --- .github/workflows/claude.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 56e472d..fb20ca6 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -20,6 +20,6 @@ jobs: (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude') && contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)) || (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude') && contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)) || (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude') && contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.review.author_association)) - uses: smartwatermelon/github-workflows/.github/workflows/claude-assistant.yml@9615f932744f8cb372e4650c73d52559219efdf1 # v3 + uses: smartwatermelon/github-workflows/.github/workflows/claude-assistant.yml@v3.1.2 secrets: claude_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}