chore(deps): update anthropics/claude-code-action action to v1.0.76

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
anthropics/claude-code-action	action	patch	v1.0.29 → v1.0.76	v1.0.79 (+2)

---

Release Notes

anthropics/claude-code-action (anthropics/claude-code-action)

v1.0.76

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.76

v1.0.75

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.75

v1.0.74

Compare Source

What's Changed

• Restore .claude/ and .mcp.json from PR base branch before CLI runs by @​km-anthropic in #​1066
• Remove redundant git status/diff/log from tag mode allowlist by @​ddworken in #​1075

Full Changelog: anthropics/claude-code-action@v1...v1.0.74

v1.0.73

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.73

v1.0.72

Compare Source

What's Changed

• Harden tag mode tool permissions against prompt injection by @​km-anthropic in #​1002

Full Changelog: anthropics/claude-code-action@v1...v1.0.72

v1.0.71

Compare Source

What's Changed

• docs: warn that allowed_bots can expose the action to external triggers by @​an-dustin in #​1039
• feat(inline-comment): add confirmed param + probe-pattern safety net by @​km-anthropic in #​1048

New Contributors

• @​an-dustin made their first contribution in #​1039

Full Changelog: anthropics/claude-code-action@v1...v1.0.71

v1.0.70

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.70

v1.0.69

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.69

v1.0.68

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.68

v1.0.67

Compare Source

What's Changed

• Improve gh.sh wrapper: stricter validation and better error messages by @​OctavianGuzu in #​996

Full Changelog: anthropics/claude-code-action@v1...v1.0.67

v1.0.66

Compare Source

What's Changed

• Only expose permission_denials count in sanitized output by @​ddworken in #​993

Full Changelog: anthropics/claude-code-action@v1...v1.0.66

v1.0.65

Compare Source

What's Changed

• Change the default display_report option to false to restrict exposed data by @​ddworken in #​992

Full Changelog: anthropics/claude-code-action@v1...v1.0.65

v1.0.64

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.64

v1.0.63

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.63

v1.0.62

Compare Source

What's Changed

• Add gh.sh wrapper for gh CLI commands in issue triage workflows by @​OctavianGuzu in #​975

Full Changelog: anthropics/claude-code-action@v1...v1.0.62

v1.0.61

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.61

v1.0.60

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.60

v1.0.59

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.59

v1.0.58

Compare Source

What's Changed

• Add non-write users check workflow by @​OctavianGuzu in #​973

Full Changelog: anthropics/claude-code-action@v1...v1.0.58

v1.0.57

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.57

v1.0.56

Compare Source

What's Changed

• Use wrapper script for label operations in issue triage by @​OctavianGuzu in #​968

Full Changelog: anthropics/claude-code-action@v1...v1.0.56

v1.0.55

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.55

v1.0.54

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.54

v1.0.53

Compare Source

What's Changed

• fix: grant write permissions and use @​main in claude workflow by @​ashwin-ant in #​950
• feat: add display_report option to disable step summary by @​ashwin-ant in #​952

Full Changelog: anthropics/claude-code-action@v1...v1.0.53

v1.0.52

Compare Source

What's Changed

• Fix stale claudeCodeVersion and update bump script to keep run.ts in sync by @​ashwin-ant in #​943
• fix: revert to colon-based wildcard syntax for git permissions by @​ashwin-ant in #​949

Full Changelog: anthropics/claude-code-action@v1...v1.0.52

v1.0.51

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.51

v1.0.50

Compare Source

What's Changed

• revert: undo PR checkout fork support and unique branch naming by @​ashwin-ant in #​937

Full Changelog: anthropics/claude-code-action@v1...v1.0.50

v1.0.49

Compare Source

What's Changed

• fix: replace deprecated :* with modern * wildcard in git permissions by @​Dave-London in #​929
• fix: skip CI MCP server installation when actions:read permission is missing by @​OctavianGuzu in #​933
• Fix/PR checkout branch name conflicts by @​kirisame-wang in #​931

New Contributors

• @​OctavianGuzu made their first contribution in #​933
• @​kirisame-wang made their first contribution in #​931

Full Changelog: anthropics/claude-code-action@v1...v1.0.49

v1.0.48

Compare Source

What's Changed

• Fix PR checkout to support fork PRs by @​Tsuesun in #​851

New Contributors

• @​Tsuesun made their first contribution in #​851

Full Changelog: anthropics/claude-code-action@v1...v1.0.48

v1.0.47

Compare Source

What's Changed

• Update claude-opus-4-5 to claude-opus-4-6 in workflow by @​ashwin-ant in #​909
• fix: skip dev dependencies in CI install step by @​Dave-London in #​919

New Contributors

• @​Dave-London made their first contribution in #​919

Full Changelog: anthropics/claude-code-action@v1...v1.0.47

v1.0.46

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.46

v1.0.45

Compare Source

What's Changed

• fix: use original body from webhook payload for TOCTOU hardening by @​ddworken in #​904
• refactor: simplify mode system by removing Mode interface and registry by @​ashwin-ant in #​899

Full Changelog: anthropics/claude-code-action@v1...v1.0.45

v1.0.44

Compare Source

What's Changed

• refactor: unify action into single composite step with run.ts entrypoint by @​ashwin-ant in #​898

Full Changelog: anthropics/claude-code-action@v1...v1.0.44

v1.0.43

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.43

v1.0.42

Compare Source

What's Changed

• fix: pass OpenTelemetry environment variables to Claude Code subprocess by @​csy1204 in #​886
• fix: pass GitHub token to setup-bun to avoid rate limits by @​peloyeje in #​861

New Contributors

• @​csy1204 made their first contribution in #​886
• @​peloyeje made their first contribution in #​861

Full Changelog: anthropics/claude-code-action@v1...v1.0.42

v1.0.41

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.41

v1.0.40

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.40

v1.0.39

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.39

v1.0.38

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.38

v1.0.37

Compare Source

What's Changed

• feat: add actor-based comment filtering to GitHub data fetching by @​ranyhb in #​812
• Revert "Revert "feat: send additional_permissions in token exchange request"" by @​ashwin-ant in #​866
• Revert "chore: bump Claude Code to 2.1.21 and Agent SDK to 0.2.21" by @​ashwin-ant in #​869

New Contributors

• @​ranyhb made their first contribution in #​812

Full Changelog: anthropics/claude-code-action@v1...v1.0.37

v1.0.36

Compare Source

What's Changed

• Revert "feat: send additional_permissions in token exchange request" by @​ashwin-ant in #​864

Full Changelog: anthropics/claude-code-action@v1...v1.0.36

v1.0.35

Compare Source

What's Changed

• feat: send additional_permissions in token exchange request by @​ashwin-ant in #​859
• chore: upgrade checkout-action to v6 by @​arthur-mountain in #​862

New Contributors

• @​arthur-mountain made their first contribution in #​862

Full Changelog: anthropics/claude-code-action@v1...v1.0.35

v1.0.34

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.34

v1.0.33

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.33

v1.0.32

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.32

v1.0.31

Compare Source

What's Changed

• fix: ensure SSH signing key has trailing newline by @​ashwin-ant in #​834
• Consolidate CI workflows into a single entry point by @​ashwin-ant in #​836
• chore: bump Bun to 1.3.6 and setup-bun action to v2.1.2 by @​ashwin-ant in #​848
• refactor: remove CLI path, use Agent SDK exclusively by @​ashwin-ant in #​849

Full Changelog: anthropics/claude-code-action@v1...v1.0.31

v1.0.30

Compare Source

What's Changed

• fix: parse ALL --allowed-tools flags, not just the first one by @​AlexanderBartash in #​801
• docs: clarify that Claude does not auto-create PRs by default by @​ashwin-ant in #​824
• fix: add checkHumanActor to agent mode by @​ashwin-ant in #​826
• chore: comment out release-base-action job in release workflow by @​ashwin-ant in #​833

New Contributors

• @​AlexanderBartash made their first contribution in #​801

Full Changelog: anthropics/claude-code-action@v1...v1.0.30

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

This PR updates anthropics/claude-code-action from v1.0.29 to v1.0.76 (47 patch versions). The changes are primarily focused on:

Key Improvements:

• Security hardening: Multiple security enhancements including prompt injection protection (v1.0.72), TOCTOU hardening (v1.0.45), and permission denials sanitization (v1.0.66)
• Permission system improvements: Better handling of additional_permissions (v1.0.37), improved git permission wildcards (v1.0.49, v1.0.52)
• Architecture refactoring: Migration to Agent SDK exclusively (v1.0.31), unified composite step with run.ts entrypoint (v1.0.44)
• Bug fixes: Fixed --allowed-tools parsing to handle all flags (v1.0.30), fork PR checkout support (v1.0.48), SSH signing key formatting (v1.0.31)
• Developer experience: Better error messages for gh CLI wrapper (v1.0.67), improved CI MCP server installation (v1.0.49)

Notable Changes:

• v1.0.74: Restores .claude/ and .mcp.json from PR base branch before CLI runs
• v1.0.65: Changed default display_report option to false for security
• v1.0.53: Added display_report option to disable step summary
• v1.0.47: Updated model from claude-opus-4-5 to claude-opus-4-6
• v1.0.42: Better OpenTelemetry support and GitHub token handling for setup-bun

Breaking Changes: None identified - all changes maintain backward compatibility

Security Fixes:

• Hardened tag mode tool permissions against prompt injection (v1.0.72)
• Restricted exposed data via permission denials count (v1.0.66)
• TOCTOU hardening using original webhook payload (v1.0.45)
• Documentation warnings about allowed_bots exposure risks (v1.0.71)

🎯 Impact Scope Investigation

Usage Locations:
The action is used in 3 workflow files:

1. .github/workflows/claude-code-review.yml (PR code review automation)
2. .github/workflows/claude-content-review.yml (Content review for Notion sync)
3. .github/workflows/claude.yml (Interactive Claude via @claude mentions)

Configuration Analysis:
All three workflows use similar configurations:

• claude_code_oauth_token: Using secret token (no change needed)
• claude_args: Custom allowed tools configuration (compatible with updates)
• additional_permissions: Used in claude.yml with actions: read (v1.0.37 improves this)
• use_sticky_comment: Used in claude-code-review.yml (no breaking changes)
• --json-schema: Used in claude-content-review.yml (no breaking changes)

Dependency Impact:

• No changes to package.json or other dependencies required
• The action is a GitHub Actions dependency, not a Node.js package
• Update is applied via commit SHA reference in workflow files

Configuration File Impact:

• No changes needed to .claude/ or .mcp.json files
• The v1.0.74 improvement to restore these files is beneficial for this codebase

💡 Recommended Actions

Immediate Actions:

1. ✅ Merge this PR - The update is backward compatible and includes valuable security improvements
2. ✅ No code changes required - All existing configurations remain compatible
3. ✅ No manual migration needed - The action maintains full backward compatibility

Post-Merge Verification:

1. Monitor the next PR that triggers claude-code-review.yml workflow
2. Verify that claude-content-review.yml works correctly on next Notion sync PR
3. Test @claude mention functionality in an issue or PR comment

Optional Enhancements to Consider:

• The new display_report option (v1.0.53) defaults to false in v1.0.65. If you want to see step summaries, you can add display_report: true to the action configuration
• Consider reviewing the allowed_bots configuration warning from v1.0.71 - currently set to "*" in claude-code-review.yml

Future Updates:

• Note that v1.0.79 is available (2 versions ahead). This PR targets v1.0.76, so a future update PR is expected from Renovate

🔗 Reference Links

• v1.0.76 Release Notes
• Full Changelog v1.0.29...v1.0.76
• Action Documentation
• Claude Code CLI Reference

Generated by koki-develop/claude-renovate-review