chore(deps): update anthropics/claude-code-action digest to 4d7e1f0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
anthropics/claude-code-action (changelog)	action	digest	593d7a5 → 4d7e1f0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

📝 Walkthrough

Walkthrough

The uses: reference for anthropics/claude-code-action in the claude-review job's "Run Claude Code Review" step is updated to a new pinned commit SHA (still labeled # v1). No other workflow inputs, conditions, or steps are changed.

Changes

Claude Code Action SHA Bump

Layer / File(s)	Summary
Update pinned SHA for claude-code-action .github/workflows/maint-76-claude-code-review.yml	The uses: value for anthropics/claude-code-action is changed to a new pinned commit SHA while all with: configuration and surrounding step behavior remain identical.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and accurately describes the main change: updating the anthropics/claude-code-action dependency digest to a specific commit SHA.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/anthropics-claude-code-action-digest

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Workflow state fingerprint for Agents Gate Followups. Do not edit.

[agents-workflows-bot]

Workflow source needed

PR #722 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely.

Please do one of:

• Add <!-- meta:issue:123 --> or a normal Closes #123 / Related to #123 line.
• Check one Workflow Source option in the PR body.
• Add a hidden marker such as <!-- workflow-source:local_request -->, <!-- workflow-source:manual_remote -->, <!-- workflow-source:review_followup -->, <!-- workflow-source:sync_campaign -->, or <!-- workflow-source:dependabot -->.
• Add a workflow source label such as workflow:source-direct-pr, workflow:source-local-request, workflow:source-review-followup, workflow:source-sync, or workflow:no-automation.

Once a valid source is present, this warning will not be reposted.

[github-actions]

Workflow state fingerprint for Keepalive Loop Reporter. Do not edit.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/maint-76-claude-code-review.yml:
- Line 191: This file is a synced template from stranske/Workflows and should
not be edited directly in the consumer repository. Apply the SHA update to
anthropics/claude-code-action at
stranske/Workflows/templates/consumer-repo/.github/workflows/maint-76-claude-code-review.yml
first, then trigger the sync workflow to propagate the updated SHA to consumer
repos including this one. Do not commit this change directly to the consumer
repo workflow file.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b1baf506-60fa-4046-8efd-36c40a5cb1f6

📥 Commits

Reviewing files that changed from the base of the PR and between 5028eaf and 13010b2.

📒 Files selected for processing (1)

• .github/workflows/maint-76-claude-code-review.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)

📜 Review details

🧰 Additional context used

📓 Path-based instructions (3)

.github/workflows/**/*.yml

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

.github/workflows/**/*.yml: Do not add top-level permissions: block on workflow_call reusable workflows - this conflicts with caller permissions
Avoid invalid YAML syntax, invalid permission scopes, and circular workflow references when creating GitHub Actions workflows

Files:

• .github/workflows/maint-76-claude-code-review.yml

**/.github/workflows/*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

First-party consumers should reference reusable workflows with @main. Only pin to an exact commit SHA for a controlled, documented reason.

Files:

• .github/workflows/maint-76-claude-code-review.yml

.github/workflows/**/*.{yml,yaml}

📄 CodeRabbit inference engine (AGENTS.md)

.github/workflows/**/*.{yml,yaml}: When editing workflow infrastructure, verify if the work belongs in stranske/Workflows instead. The answer is usually yes if the change affects reusable workflows, agent prompts or routing, keepalive/autofix/verifier behavior, synced workflow files, or synced scripts or docs.
First-party consumers should reference reusable workflows with @main by default. Only pin to an exact commit SHA if intentionally controlling for a specific reason.

Files:

• .github/workflows/maint-76-claude-code-review.yml

[coderabbitai]

🛠️ Refactor suggestion | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Verify upstream commit exists and metadata =="
curl -fsSL "https://api.github.com/repos/anthropics/claude-code-action/commits/d5726de019ec4498aa667642bc3a80fca83aa102" | jq '{sha: .sha, date: .commit.committer.date, verified: .commit.verification.verified, message: .commit.message}'

echo
echo "== Verify repository references this workflow as synced/source-managed =="
rg -n -C2 "maint-76-claude-code-review\\.yml|stranske/Workflows|synced workflow|source of truth|generated workflow" . || true

echo
echo "If repo docs indicate this file is synced from stranske/Workflows, apply the SHA bump there and re-sync."

Repository: stranske/Counter_Risk

Length of output: 23287

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== Check if maint-76-claude-code-review.yml exists in Workflows repo ==="
find . -name "maint-76-claude-code-review.yml" 2>/dev/null | head -20 || echo "File not found in Workflows repo"

echo
echo "=== List maint-* workflow files in Workflows ==="
find .github/workflows -name "maint-*.yml" 2>/dev/null | sort || echo "No maint-* workflows found"

echo
echo "=== Check sync manifests for consumer-specific files ==="
find . -name "*sync*manifest*" -o -name "*consumer*config*" 2>/dev/null | head -10 || true
rg "maint-76|claude-code-review" . 2>/dev/null || echo "No references found"

Repository: stranske/Workflows

Length of output: 2482

---

Apply this SHA update in stranske/Workflows first, then sync to consumer repos.

The SHA d5726de019ec4498aa667642bc3a80fca83aa102 is valid (anthropics/claude-code-action commit from 2026-06-13: "chore: bump Claude Code to 2.1.177 and Agent SDK to 0.3.177").

However, .github/workflows/maint-76-claude-code-review.yml is a synced template file from stranske/Workflows/templates/consumer-repo/. Per the consumer repo governance model documented in CLAUDE.md and the consumer sync manifest, edits to synced workflow files must be made in the Workflows source first and then synced downstream. Make the SHA bump in stranske/Workflows/templates/consumer-repo/.github/workflows/maint-76-claude-code-review.yml, then trigger the sync workflow to update consumer repos including this one.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/maint-76-claude-code-review.yml at line 191, This file is
a synced template from stranske/Workflows and should not be edited directly in
the consumer repository. Apply the SHA update to anthropics/claude-code-action
at
stranske/Workflows/templates/consumer-repo/.github/workflows/maint-76-claude-code-review.yml
first, then trigger the sync workflow to propagate the updated SHA to consumer
repos including this one. Do not commit this change directly to the consumer
repo workflow file.

Source: Coding guidelines

[coderabbitai]

♻️ Duplicate comments (1)

.github/workflows/maint-76-claude-code-review.yml (1)

192-192: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Apply all changes in stranske/Workflows first, then sync to consumer repos. This file is a synced template from stranske/Workflows/templates/consumer-repo/. Per the consumer repo governance model documented in past reviews, edits to synced workflow files must be made in the Workflows source first and then synced downstream.

• .github/workflows/maint-76-claude-code-review.yml#L192: Apply the anthropics/claude-code-action SHA update to 4d7e1f0cd85743fdc93b1c8040ab54395da024e2 in stranske/Workflows/templates/consumer-repo/.github/workflows/maint-76-claude-code-review.yml.
• .github/workflows/maint-76-claude-code-review.yml#L33: Apply the error_classifier.js sparse-checkout addition in the same Workflows template file.

After making both changes in stranske/Workflows, trigger the sync workflow to propagate the updated workflow to consumer repos including this one. Do not commit these changes directly to the consumer repo. As per coding guidelines, when editing workflow infrastructure, verify if the work belongs in stranske/Workflows instead — the answer is usually yes if the change affects synced workflow files.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/maint-76-claude-code-review.yml at line 192, This file is
a synced template from stranske/Workflows and must not be edited directly in the
consumer repo. Do not commit the changes to
.github/workflows/maint-76-claude-code-review.yml at lines 192 and 33. Instead,
navigate to the stranske/Workflows repository and apply both changes to the
source template at
stranske/Workflows/templates/consumer-repo/.github/workflows/maint-76-claude-code-review.yml:
update the anthropics/claude-code-action SHA to
4d7e1f0cd85743fdc93b1c8040ab54395da024e2 at the corresponding line, and add the
error_classifier.js sparse-checkout entry at the corresponding location. After
committing these changes to stranske/Workflows, trigger the sync workflow to
automatically propagate the updated workflow template to all consumer repos
including this one.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Duplicate comments:
In @.github/workflows/maint-76-claude-code-review.yml:
- Line 192: This file is a synced template from stranske/Workflows and must not
be edited directly in the consumer repo. Do not commit the changes to
.github/workflows/maint-76-claude-code-review.yml at lines 192 and 33. Instead,
navigate to the stranske/Workflows repository and apply both changes to the
source template at
stranske/Workflows/templates/consumer-repo/.github/workflows/maint-76-claude-code-review.yml:
update the anthropics/claude-code-action SHA to
4d7e1f0cd85743fdc93b1c8040ab54395da024e2 at the corresponding line, and add the
error_classifier.js sparse-checkout entry at the corresponding location. After
committing these changes to stranske/Workflows, trigger the sync workflow to
automatically propagate the updated workflow template to all consumer repos
including this one.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: a3459673-67e0-46ae-832f-754e4fc00437

📥 Commits

Reviewing files that changed from the base of the PR and between 13010b2 and 57bc333.

📒 Files selected for processing (1)

• .github/workflows/maint-76-claude-code-review.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)

📜 Review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: Fetch PR context / Fetch PR Context

🧰 Additional context used

📓 Path-based instructions (3)

.github/workflows/**/*.yml

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

.github/workflows/**/*.yml: Do not add top-level permissions: block on workflow_call reusable workflows - this conflicts with caller permissions
Avoid invalid YAML syntax, invalid permission scopes, and circular workflow references when creating GitHub Actions workflows

Files:

• .github/workflows/maint-76-claude-code-review.yml

**/.github/workflows/*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

First-party consumers should reference reusable workflows with @main. Only pin to an exact commit SHA for a controlled, documented reason.

Files:

• .github/workflows/maint-76-claude-code-review.yml

.github/workflows/**/*.{yml,yaml}

📄 CodeRabbit inference engine (AGENTS.md)

.github/workflows/**/*.{yml,yaml}: When editing workflow infrastructure, verify if the work belongs in stranske/Workflows instead. The answer is usually yes if the change affects reusable workflows, agent prompts or routing, keepalive/autofix/verifier behavior, synced workflow files, or synced scripts or docs.
First-party consumers should reference reusable workflows with @main by default. Only pin to an exact commit SHA if intentionally controlling for a specific reason.

Files:

• .github/workflows/maint-76-claude-code-review.yml