chore(deps): update anthropics/claude-code-action action to v1.0.96

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
anthropics/claude-code-action	action	patch	v1.0.95 → v1.0.96	v1.0.101 (+4)

---

Release Notes

anthropics/claude-code-action (anthropics/claude-code-action)

v1.0.96

Compare Source

What's Changed

• fix: handle fork PRs by fetching via refs/pull/N/head by @​stakeswky in #​963

New Contributors

• @​stakeswky made their first contribution in #​963

Full Changelog: anthropics/claude-code-action@v1...v1.0.96

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

Version Update: v1.0.95 → v1.0.96 (Patch release)

Major Changes:

• Fork PR Handling Fix (chore(deps): update dependency @cloudflare/workers-types to v4.20250426.0 - autoclosed #963): Fixes a critical issue where claude-code-action failed when triggered on pull requests from forked repositories
  • Previously failed with fatal: couldn't find remote ref <branch> when using @claude on fork PRs
  • Now correctly detects cross-repository PRs and uses refs/pull/<number>/head refspec for fetching
  • Maintains backward compatibility: same-repository PRs continue using the existing fetch strategy

Breaking Changes:

• None

Security Fixes:

• None

Implementation Details:

• Added GraphQL query fields: isCrossRepository and headRepository
• Updated TypeScript types accordingly
• Conditional branch checkout logic based on PR origin
• All 652 existing tests pass with the changes

🎯 Impact Scope Investigation

Usage Locations in Codebase:

1. .github/workflows/ci.yml (2 instances)
   • Line 253: Content review job - reviews blog article content changes
   • Line 342: Code review job - reviews code changes
2. .github/workflows/claude.yml (1 instance)
   • Line 35: Interactive Claude assistant via @claude mentions

Current Configuration:

• All three usages employ SHA pinning for security (commit hash comments)
• Configured with claude_code_oauth_token secret
• Limited tool access via claude_args with --allowed-tools restrictions
• Uses allowed_bots parameter to control trigger sources

Impact on Dependencies:

• No impact on other dependencies
• No configuration changes required
• No API breaking changes

Repository Context:

• This repository is not a fork (isFork: false)
• Currently does not appear to accept fork PRs from external contributors
• The fix provides forward compatibility if fork-based contributions are enabled in the future

💡 Recommended Actions

Immediate Actions:

1. ✅ Safe to merge immediately - This is a backward-compatible bug fix
2. No code modifications required
3. No configuration changes needed

Optional Follow-up:

• Consider updating to newer versions (v1.0.97-v1.0.101 are available)
  • v1.0.100 includes model upgrade to opus-4-7 and SDK fixes
  • However, each version should be reviewed individually per Renovate's standard process

Verification Steps:

• The existing CI workflows will automatically use v1.0.96 upon merge
• No manual testing required as this is a patch fix that doesn't affect current workflow (no fork PRs in this repository)
• If fork PR support is enabled later, the action will work correctly without additional changes

🔗 Reference Links

• Release Notes v1.0.96
• PR #963: Fork PR Handling Fix
• Full Changelog v1.0.95...v1.0.96
• Action Repository

Generated by koki-develop/claude-renovate-review