From bcf02fc53b27455e27b9a870fd0d2f7f373a9c62 Mon Sep 17 00:00:00 2001
From: "useotto-dev[bot]" <222508897+useotto-dev[bot]@users.noreply.github.com>
Date: Thu, 9 Jul 2026 20:14:51 -0700
Subject: [PATCH] ci: pin anthropics/claude-code-action to exact SHA (v1.0.170)

Callers with selected-actions allowlists can only allow exact-SHA
patterns; the moving v1 tag cannot be allowlisted safely.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/claude.yml          | 2 +-
 .github/workflows/code-review.yml     | 2 +-
 .github/workflows/issue-followup.yml  | 2 +-
 .github/workflows/issue-implement.yml | 2 +-
 .github/workflows/issue-triage.yml    | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 94d50c5..e757d2d 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -35,7 +35,7 @@ jobs:
           fetch-depth: 0
 
       - name: Run Claude Code
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@536f2c32a39763739000b0e1ac69ca2647d97ce9 # v1.0.170
         with:
           claude_code_oauth_token: ${{ secrets.claude_code_oauth_token }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/code-review.yml b/.github/workflows/code-review.yml
index ba57038..0042f65 100644
--- a/.github/workflows/code-review.yml
+++ b/.github/workflows/code-review.yml
@@ -81,7 +81,7 @@ jobs:
             core.setOutput('check_run_id', check.data.id);
 
       - name: Claude Code Review
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@536f2c32a39763739000b0e1ac69ca2647d97ce9 # v1.0.170
         with:
           claude_code_oauth_token: ${{ secrets.claude_code_oauth_token }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/issue-followup.yml b/.github/workflows/issue-followup.yml
index 96b76a1..116fe48 100644
--- a/.github/workflows/issue-followup.yml
+++ b/.github/workflows/issue-followup.yml
@@ -44,7 +44,7 @@ jobs:
           fetch-depth: 0
 
       - name: Process Follow-up
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@536f2c32a39763739000b0e1ac69ca2647d97ce9 # v1.0.170
         env:
           LINEAR_API_TOKEN:
             ${{ secrets.linear_api_token || secrets.LINEAR_API_TOKEN }}
diff --git a/.github/workflows/issue-implement.yml b/.github/workflows/issue-implement.yml
index a06c8d1..0e81f56 100644
--- a/.github/workflows/issue-implement.yml
+++ b/.github/workflows/issue-implement.yml
@@ -44,7 +44,7 @@ jobs:
           fetch-depth: 0
 
       - name: Implement Issue
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@536f2c32a39763739000b0e1ac69ca2647d97ce9 # v1.0.170
         env:
           LINEAR_API_TOKEN:
             ${{ secrets.linear_api_token || secrets.LINEAR_API_TOKEN }}
diff --git a/.github/workflows/issue-triage.yml b/.github/workflows/issue-triage.yml
index 09188b2..6836c8c 100644
--- a/.github/workflows/issue-triage.yml
+++ b/.github/workflows/issue-triage.yml
@@ -43,7 +43,7 @@ jobs:
           fetch-depth: 0
 
       - name: Triage Issue
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@536f2c32a39763739000b0e1ac69ca2647d97ce9 # v1.0.170
         env:
           LINEAR_API_TOKEN:
             ${{ secrets.linear_api_token || secrets.LINEAR_API_TOKEN }}