From ed070fb740977eef8e18825c5fcb5794762e9bae Mon Sep 17 00:00:00 2001 From: Claude Code Bot Date: Mon, 17 Aug 2026 13:25:58 -0700 Subject: [PATCH] fix(security): float claude-blocking-review ref from @v3.1.0 to @v3 The exact tag @v3.1.0 is immutable and predates the GHSA-8q5r-mmjf-575q fix, so this repo has been resolving to anthropics/claude-code-action@26ec0412 (v1.0.70, vulnerable). The fleet-wide remediation repointed the floating @v3 tag, which this repo did not use, so it never received the fix. Floating @v3 now serves claude-code-action@9d7150bc (v1.0.193, patched). Floating @v3 also means future security fixes propagate by repointing one tag in github-workflows instead of requiring a PR in every consumer repo. That is the intended fleet model; exact pins silently opted this repo out of remediation for months. [pre-commit] Committed with SKIP=zizmor: the unpinned-uses finding on the floating @v3 tag is deliberate fleet policy, documented at README.md:207 in smartwatermelon/github-workflows. The finding is pre-existing in intent and not introduced by this change. Claude-Session: https://claude.ai/code/session_01SimcNSM4P5hpb1dQVejqcF --- .github/workflows/claude-blocking-review.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/claude-blocking-review.yml b/.github/workflows/claude-blocking-review.yml index 94c5a37..44b278b 100644 --- a/.github/workflows/claude-blocking-review.yml +++ b/.github/workflows/claude-blocking-review.yml @@ -12,7 +12,7 @@ permissions: jobs: claude-review: - uses: smartwatermelon/github-workflows/.github/workflows/claude-blocking-review.yml@v3.1.0 + uses: smartwatermelon/github-workflows/.github/workflows/claude-blocking-review.yml@v3 with: pr_number: ${{ github.event.pull_request.number }} secrets: