fix(deps): update anthropics/claude-code-action action to v1.0.133

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
anthropics/claude-code-action	action	patch	v1.0.93 → v1.0.133	v1.0.141 (+7)

---

Release Notes

anthropics/claude-code-action (anthropics/claude-code-action)

v1.0.133

Compare Source

What's Changed

• Use workload identity federation for Claude auth in CI workflows by @​ashwin-ant in #​1344

Full Changelog: anthropics/claude-code-action@v1...v1.0.133

v1.0.132

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.132

v1.0.131

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.131

v1.0.130

Compare Source

What's Changed

• Add Workload Identity Federation (OIDC) authentication support by @​ashwin-ant in #​1338

Full Changelog: anthropics/claude-code-action@v1...v1.0.130

v1.0.129

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.129

v1.0.128

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.128

v1.0.127

Compare Source

What's Changed

• Refactor allowed_bots actor resolution by @​ashwin-ant in #​1330

Full Changelog: anthropics/claude-code-action@v1...v1.0.127

v1.0.126

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.126

v1.0.125

Compare Source

What's Changed

• Simplify comment tool instructions in prompt by @​ashwin-ant in #​1328

Full Changelog: anthropics/claude-code-action@v1...v1.0.125

v1.0.124

Compare Source

What's Changed

• fix: add parentheses to fix operator precedence in co-author check by @​FuturizeRush in #​1199
• Strengthen simplified tag-mode prompt (USE_SIMPLE_PROMPT) by @​ashwin-ant in #​1313
• Fix prettier formatting in create-prompt by @​ashwin-ant in #​1325

New Contributors

• @​FuturizeRush made their first contribution in #​1199

Full Changelog: anthropics/claude-code-action@v1...v1.0.124

v1.0.123

Compare Source

What's Changed

• fix: allow , in branch names by @​bugbubug in #​1310
• fix: dereference symlinks when snapshotting sensitive paths to .claude-pr/ by @​matanbaruch in #​1186
• fix: exclude .claude-pr snapshot from git staging by @​cvan20191 in #​1277
• fix: write execution file when SDK throws by @​Jerry2003826 in #​1255
• fix: handle non-user actors (e.g. Copilot) in permission and actor checks by @​krislavten in #​1144
• chore: bump pinned Bun to 1.3.14 by @​ashwin-ant in #​1312

New Contributors

• @​bugbubug made their first contribution in #​1310
• @​matanbaruch made their first contribution in #​1186
• @​cvan20191 made their first contribution in #​1277
• @​Jerry2003826 made their first contribution in #​1255
• @​krislavten made their first contribution in #​1144

Full Changelog: anthropics/claude-code-action@v1...v1.0.123

v1.0.122

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.122

v1.0.121

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.121

v1.0.120

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.120

v1.0.119

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.119

v1.0.118

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.118

v1.0.117

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.117

v1.0.116

Compare Source

What's Changed

• Update HackerOne links in SECURITY.md by @​OctavianGuzu in #​1268

Full Changelog: anthropics/claude-code-action@v1...v1.0.116

v1.0.115

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.115

v1.0.114

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.114

v1.0.113

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.113

v1.0.112

Compare Source

What's Changed

• fix: make trigger_phrase match case-insensitive by @​JustinBis in #​1279

New Contributors

• @​JustinBis made their first contribution in #​1279

Full Changelog: anthropics/claude-code-action@v1...v1.0.112

v1.0.111

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.111

v1.0.110

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.110

v1.0.109

Compare Source

What's Changed

• docs: pull_request_target guidance and base-action trust model by @​OctavianGuzu in #​1250

Full Changelog: anthropics/claude-code-action@v1...v1.0.109

v1.0.108

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.108

v1.0.107

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.107

v1.0.106

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.106

v1.0.105

Compare Source

What's Changed

• fix: allow + in branch names (generated by Claude Code EnterWorktree) by @​awakia in #​1248

New Contributors

• @​awakia made their first contribution in #​1248

Full Changelog: anthropics/claude-code-action@v1...v1.0.105

v1.0.104

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.104

v1.0.103

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.103

v1.0.102

Compare Source

What's Changed

• chore: bump oven-sh/setup-bun to v2.2.0 (Node.js 24) by @​ashwin-ant in #​1238
• docs: nit updates to security.md by @​OctavianGuzu in #​1240

Full Changelog: anthropics/claude-code-action@v1...v1.0.102

v1.0.101

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.101

v1.0.100

Compare Source

What's Changed

• Upgrade Claude model from opus-4-6 to opus-4-7 by @​ashwin-ant in #​1227
• fix: pass install.sh binary path to Agent SDK after 0.2.113 bump by @​ashwin-ant in #​1235

Full Changelog: anthropics/claude-code-action@v1...v1.0.100

v1.0.99

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.99

v1.0.98

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.98

v1.0.97

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.97

v1.0.96

Compare Source

What's Changed

• fix: handle fork PRs by fetching via refs/pull/N/head by @​stakeswky in #​963

New Contributors

• @​stakeswky made their first contribution in #​963

Full Changelog: anthropics/claude-code-action@v1...v1.0.96

v1.0.95

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.95

v1.0.94

Compare Source

What's Changed

• Prepend system bin dirs to PATH when allowed_non_write_users is set by @​OctavianGuzu in #​1208

Full Changelog: anthropics/claude-code-action@v1...v1.0.94

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

Bug Fixes:

• v1.0.123: Fix symlink dereference when snapshotting sensitive paths to .claude-pr/; exclude .claude-pr snapshot from git staging; fix execution file write when SDK throws; handle non-user actors (e.g., Copilot) in permission checks; allow , in branch names
• v1.0.124: Fix operator precedence in co-author check (parentheses bug)
• v1.0.112: Make trigger_phrase match case-insensitive
• v1.0.105: Allow + in branch names (generated by Claude Code EnterWorktree)
• v1.0.100: Fix binary path passed to Agent SDK after 0.2.113 bump
• v1.0.96: Handle fork PRs by fetching via refs/pull/N/head
• v1.0.94: Prepend system bin dirs to PATH when allowed_non_write_users is set

New Features (all additive/optional):

• v1.0.130/1.0.133: Add Workload Identity Federation (OIDC) authentication support for Claude auth in CI
• v1.0.127: Refactor allowed_bots actor resolution
• v1.0.125: Simplify comment tool instructions in prompt
• v1.0.100: Upgrade bundled Claude model from opus-4-6 to opus-4-7

Maintenance:

• v1.0.102: Bump oven-sh/setup-bun to v2.2.0 (Node.js 24); bump Bun to 1.3.14
• v1.0.116: Update HackerOne links in SECURITY.md
• v1.0.109: Add pull_request_target guidance and base-action trust model documentation

No breaking changes across all 40 patch versions (v1.0.93 → v1.0.133).

🎯 Impact Scope Investigation

• Usage location: action.yml:109 — this repo uses anthropics/claude-code-action/base-action pinned by commit SHA
• The inputs used (anthropic_api_key, claude_code_oauth_token, claude_args, settings, prompt) remain fully compatible — no input renames or removals across this range
• WIF/OIDC support is purely additive; existing API key and OAuth token auth methods continue to work unchanged
• The model upgrade (opus-4-6 → opus-4-7) is internal to the action and automatic — no configuration change needed
• No impact on other dependencies in this repository

💡 Recommended Actions

• No migration steps required. This is a straightforward patch-level update with only backward-compatible changes.
• The commit SHA pin is updated correctly from b47fd721da662d48c5680e154ad16a73ed74d2e0 to 787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251, ensuring reproducible builds.
• Merge as-is.

🔗 Reference Links

• v1.0.94 release
• v1.0.100 release
• v1.0.123 release
• v1.0.130 release
• v1.0.133 release

Generated by koki-develop/claude-renovate-review