From 782eff637ae04ff9b59be395f0f02cd286af6894 Mon Sep 17 00:00:00 2001 From: Claude Code Bot Date: Wed, 29 Apr 2026 14:40:45 -0700 Subject: [PATCH] chore(security): SHA-pin actions in claude-blocking-review.yml MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Brings claude-blocking-review.yml in line with claude-assistant.yml, which has been SHA-pinning these same two actions. Tag-pinning was flagged in the 2026-04-29 GitHub Actions audit (against patterns in nesbitt.io/2026/04/28/github-actions-is-the-weakest-link). Pinned to the same SHAs already used in claude-assistant.yml: - actions/checkout@v4 → 34e114876b0b11c390a56381ad16ebd13914f8d5 - anthropics/claude-code-action@v1 → 26ec041249acb0a944c0a47b6c0c13f05dbc5b44 This is a reusable workflow consumed via @v3 by all 26 sister repos. The pin doesn't shift the semver contract for callers — only what the runner resolves the third-party `uses:` lines to inside the v3 release. Tag comments preserved so Dependabot keeps the SHAs current. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/claude-blocking-review.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/claude-blocking-review.yml b/.github/workflows/claude-blocking-review.yml index f4f640d..e2376b0 100644 --- a/.github/workflows/claude-blocking-review.yml +++ b/.github/workflows/claude-blocking-review.yml @@ -87,7 +87,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: fetch-depth: 1 @@ -339,7 +339,7 @@ jobs: if: steps.doc-check.outputs.skip != 'true' timeout-minutes: ${{ fromJSON(steps.estimate.outputs.timeout_minutes) }} continue-on-error: true # infrastructure failure must not block merges - uses: anthropics/claude-code-action@v1 + uses: anthropics/claude-code-action@26ec041249acb0a944c0a47b6c0c13f05dbc5b44 # v1 with: # claude-code-action rejects non-User actors unless explicitly allowed. # Callers use this on pull_request events that fire for bot-opened PRs