chore: sync workflow templates

[stranske]

Sync Summary

Files Updated

• agents-guard.yml: Agents guard - enforces agents workflow protections (Health 45)
• maint-76-claude-code-review.yml: Claude Code review (opt-in) - runs only on labeled PRs or manual dispatch

Files Skipped

• pr-00-gate.yml: File exists and sync_mode is create_only
• ci.yml: File exists and sync_mode is create_only
• renovate.json: File exists and sync_mode is create_only
• cross-repo-smoke.yml: File exists and sync_mode is create_only
• llm_slots.json: None

---

Review Checklist

• CI passes with updated workflows
• No repo-specific customizations were overwritten

Source: stranske/Workflows
Source SHA: cd5687d7ae00a31b9cb6ddbf94cfb94c0e4fdf69
Template hash: 57b9e3dbcb23
Sync branch: sync/workflows-57b9e3dbcb23
Consumer repo: stranske/Collab-Admin
Manifest: .github/sync-manifest.yml

Summary by CodeRabbit

• Chores
  • Updated pinned versions for two automated workflow actions to newer commits.
  • No changes to workflow behavior, conditions, or user-facing functionality.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 468d11b5-ef83-4765-9945-768db1fcbf40

📥 Commits

Reviewing files that changed from the base of the PR and between c602651 and 2ba8f8a.

📒 Files selected for processing (2)

• .github/workflows/agents-guard.yml
• .github/workflows/maint-76-claude-code-review.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)
• stranske/Template (auto-detected) → reviewed against open PR #874 sync/workflows-57b9e3dbcb23 instead of the default branch

📜 Recent review details

⏰ Context from checks skipped due to timeout. (2)

• GitHub Check: Python CI / typecheck-mypy
• GitHub Check: Python CI / lint-ruff

🧰 Additional context used

📓 Path-based instructions (6)

{pyproject.toml,.github/workflows/*.{yml,yaml}}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

{pyproject.toml,.github/workflows/*.{yml,yaml}}: Ensure coverage thresholds in pyproject.toml ([tool.coverage.report] fail_under) match the coverage-min settings in CI workflow files to avoid threshold conflicts
The Manager-Database repository has a coverage threshold of 75%

Files:

• .github/workflows/agents-guard.yml
• .github/workflows/maint-76-claude-code-review.yml

.github/workflows/*.{yml,yaml}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

When a GitHub Actions workflow fails with startup_failure, check for invalid YAML syntax, top-level permissions: blocks on workflow_call reusable workflows (which conflicts with caller permissions), invalid permission scopes, or circular workflow references

Files:

• .github/workflows/agents-guard.yml
• .github/workflows/maint-76-claude-code-review.yml

.github/workflows/**/*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

Reference reusable workflows with @main to match first-party consumer defaults, unless intentionally pinning to an exact commit SHA for a controlled reason.

Files:

• .github/workflows/agents-guard.yml
• .github/workflows/maint-76-claude-code-review.yml

.github/workflows/agents-*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

Synced workflows (agents-*.yml, autofix.yml) should be fixed in stranske/Workflows, not locally in the consumer repo.

Files:

• .github/workflows/agents-guard.yml

.github/workflows/*.yml

📄 CodeRabbit inference engine (AGENTS.md)

First-party consumers should reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason.

Files:

• .github/workflows/agents-guard.yml
• .github/workflows/maint-76-claude-code-review.yml

{.github/workflows/agents-*.yml,.github/workflows/autofix.yml,.github/codex/**/*.{md,txt,prompt},**/*.sync.*}

📄 CodeRabbit inference engine (AGENTS.md)

Synced workflow files, agent prompts, scripts, and consumer docs should be fixed in stranske/Workflows through the sync manifest, not edited locally.

Files:

• .github/workflows/agents-guard.yml

🔀 Multi-repo context

Linked repositories findings

stranske/Template (inspected refs/pull/874/head)

• .github/workflows/agents-guard.yml:114,183 — the fallback setup-api-client steps already pin stranske/Workflows/.github/actions/setup-api-client@a525e6e3e2431d302073de65723c6e022f4b02fa on this PR branch, matching the PR under review.
• .github/workflows/maint-76-claude-code-review.yml:192 — the claude-review job already pins anthropics/claude-code-action@521136812280ae7ef256e06045655b9da02793f0 on this PR branch, also matching the PR under review.

stranske/Workflows (inspected current checked-out ref)

• .github/workflows/agents-guard.yml:103,173 — the repository’s own agents-guard workflow still references the older setup-api-client SHA (6c3391d38bbc20a4577ac42b9aa6c9dc4e462c09) in the pinned remote fallback steps, so the PR’s update is a downstream sync to a newer upstream template version.
• .github/workflows/agents-guard.yml:64-73,81-83,93,151-173 — agents-guard is one of the workflows that explicitly depends on setup-api-client, so changing that pinned fallback affects the guard path directly.
• .github/workflows/maint-76-claude-code-review.yml — no matching workflow was found in this repo’s checked-out ref, so there’s no local consumer here to cross-check for the claude-code-action pin.

🔇 Additional comments (2)

.github/workflows/agents-guard.yml (1)

114-114: LGTM!

Also applies to: 183-183

.github/workflows/maint-76-claude-code-review.yml (1)

192-192: LGTM!

---

📝 Walkthrough

Walkthrough

This PR updates pinned GitHub Action revisions in two workflows: the setup-api-client fallback steps in agents-guard.yml and the claude-review step in maint-76-claude-code-review.yml.

Changes

Workflow action pin updates

Layer / File(s)	Summary
Agents guard pins .github/workflows/agents-guard.yml	The pull_request_target and pull_request fallback steps now use stranske/Workflows/.github/actions/setup-api-client at commit a525e6e3e2431d302073de65723c6e022f4b02fa.
Claude review pin .github/workflows/maint-76-claude-code-review.yml	The claude-review job updates the pinned revision of anthropics/claude-code-action used by Run Claude Code Review.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• stranske/Collab-Admin#843: Updates the same anthropics/claude-code-action pin in .github/workflows/maint-76-claude-code-review.yml.
• stranske/Collab-Admin#860: Updates the same stranske/Workflows/.github/actions/setup-api-client pin in .github/workflows/agents-guard.yml.
• stranske/Collab-Admin#894: Also changes the claude-review step to a different pinned anthropics/claude-code-action commit.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: synchronizing workflow templates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sync/workflows-57b9e3dbcb23

---

_{Comment @coderabbitai help to get the list of available commands.}