Pin anthropics/claude-code-action to v1.0.88 to work around upstream ENOENT/tsconfig regression

[Copilot]

The Claude Code Review workflow fails on every PR. This PR addresses two stacked failure modes:

1. ENOENT / tsconfig.json regression in v1.0.89

Per upstream anthropics/claude-code-action#1187, #1205, and #1220, v1.0.89 introduced a regression where cpSync in restoreConfigFromBase crashes on symlinked sensitive paths and leaks an fd that surfaces as a secondary tsconfig.json "directory mismatch" error. Upstream recommends pinning to v1.0.88.

• .github/workflows/claude-code-review.yml: replace anthropics/claude-code-action@v1 with the SHA for v1.0.88.
• .github/workflows/claude.yml: same pin (same action, same bug).
• Inline comment on both usages pointing at the upstream issues.

uses: anthropics/claude-code-action@1eddb334cfa79fdb21ecbe2180ca1a016e8e7d47 # v1.0.88

2. 401 on bot-authored PRs (surfaced after the pin)

With v1.0.88 in place, the ENOENT error is gone, but the job now fails at the next step for bot-authored PRs:

App token exchange failed: 401 Unauthorized - User does not have write access on this repository

claude-code-action exchanges the workflow's OIDC token for a GitHub App installation token via Anthropic's server; the exchange gates on the OIDC actor's repo permissions. The allowed_bots input exists to let specific bots through without repo write, but v1.0.88 has a client-side bug (#1133; fix PRs #1144 / #1213 unmerged) that crashes on actors without a [bot] suffix. Copilot's actor login is Copilot (no suffix), so allowed_bots can't help here.

As a targeted workaround, gate the claude-review job on an if: that skips for Copilot and dependabot[bot]. Skipped jobs report as success for branch-protection purposes.

if: >-
  github.event.pull_request.user.login != 'Copilot' &&
  github.event.pull_request.user.login != 'dependabot[bot]'

Follow-up

Unpin and remove the if: guard once the first upstream release containing the fix for #1133/#1144/#1213 ships. A tracking issue will be opened alongside this PR.

[0xferit]

Tracking follow-up for re-enabling claude-review on bot-authored PRs: #107.

[Copilot]

Pull request overview

This PR stabilizes the repository’s Claude automation by pinning anthropics/claude-code-action to a known-good release (v1.0.88) to avoid an upstream regression, and adds a temporary job-level guard to prevent failures on bot-authored PRs.

Changes:

• Pin anthropics/claude-code-action to commit 1eddb334cfa79fdb21ecbe2180ca1a016e8e7d47 (v1.0.88) in both Claude workflows, with inline context and upstream issue references.
• Add a job-level if: condition in claude-code-review.yml to skip running on PRs authored by Copilot and dependabot[bot].

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/claude.yml	Pins anthropics/claude-code-action to v1.0.88 with inline rationale to avoid the v1.0.89 regression.
.github/workflows/claude-code-review.yml	Adds a bot-author skip guard for the claude-review job and pins the action to v1.0.88 with upstream references.