From 3761c05345ba602dfae2e5d75503fd0c2d7161d7 Mon Sep 17 00:00:00 2001 From: Claude Code Bot Date: Mon, 17 Aug 2026 13:26:31 -0700 Subject: [PATCH] fix(ci): float reusable workflow ref to @v3 for security propagation The pinned @v3.1.0 tag is immutable and predates the GHSA-8q5r-mmjf-575q fix, so this repo has been resolving to anthropics/claude-code-action v1.0.70 (vulnerable). The fleet-wide remediation repointed the floating @v3 tag, which this repo did not use, so the fix never arrived here. Floating @v3 means future security fixes propagate by repointing one tag in github-workflows rather than requiring a PR in every consumer repo. Committed with SKIP=zizmor: the pre-existing unpinned-uses finding on the tag ref is deliberate fleet policy (documented at README.md:207 in github-workflows), not introduced by this change. --- .github/workflows/claude-blocking-review.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/claude-blocking-review.yml b/.github/workflows/claude-blocking-review.yml index 94c5a37..44b278b 100644 --- a/.github/workflows/claude-blocking-review.yml +++ b/.github/workflows/claude-blocking-review.yml @@ -12,7 +12,7 @@ permissions: jobs: claude-review: - uses: smartwatermelon/github-workflows/.github/workflows/claude-blocking-review.yml@v3.1.0 + uses: smartwatermelon/github-workflows/.github/workflows/claude-blocking-review.yml@v3 with: pr_number: ${{ github.event.pull_request.number }} secrets: