chore: sync workflow templates

[stranske]

Sync Summary

Files Updated

• maint-76-claude-code-review.yml: Claude Code review (opt-in) - runs only on labeled PRs or manual dispatch

Files Skipped

• pr-00-gate.yml: File exists and sync_mode is create_only
• ci.yml: File exists and sync_mode is create_only
• renovate.json: File exists and sync_mode is create_only
• cross-repo-smoke.yml: File exists and sync_mode is create_only
• llm_slots.json: None

---

Review Checklist

• CI passes with updated workflows
• No repo-specific customizations were overwritten

Source: stranske/Workflows
Source SHA: f329dbdf3612922fab25b8d002b802c5f3ef7186
Template hash: 2dc5f6ceac12
Sync branch: sync/workflows-2dc5f6ceac12
Consumer repo: stranske/Counter_Risk
Manifest: .github/sync-manifest.yml

Summary by CodeRabbit

• Chores
  • Updated internal workflow configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 16e06b87-8a20-4816-8be1-0f103b522e37

📥 Commits

Reviewing files that changed from the base of the PR and between 921ae1d and 635d2d7.

📒 Files selected for processing (1)

• .github/workflows/maint-76-claude-code-review.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (1)

.github/workflows/**/*.yml

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

.github/workflows/**/*.yml: Do not add top-level permissions: block on workflow_call reusable workflows - this conflicts with caller permissions
Avoid invalid YAML syntax, invalid permission scopes, and circular workflow references when creating GitHub Actions workflows

Files:

• .github/workflows/maint-76-claude-code-review.yml

🔀 Multi-repo context stranske/Workflows

Based on my exploration of the Workflows repository, here are my findings:

Cross-Repository Context

stranske/Workflows Repository

Template File Analysis [::stranske/Workflows::]

• The maint-76-claude-code-review.yml workflow is located at ./templates/consumer-repo/.github/workflows/maint-76-claude-code-review.yml [::stranske/Workflows::]
• Current pinned action: anthropics/claude-code-action@80b31826338489861333dc17217865dfe8085cdc # v1 [::stranske/Workflows::]
• This is a newly added file in commit f329dbd (chore: update Claude review action digest #2523) [::stranske/Workflows::]

Sync Configuration [::stranske/Workflows::]

• The file is declared in .github/sync-manifest.yml at line 122-123 [::stranske/Workflows::]
• Entry: source: .github/workflows/maint-76-claude-code-review.yml with description "Claude Code review (opt-in) - runs only on labeled PRs or manual dispatch" [::stranske/Workflows::]
• No sync_mode specified (defaults to standard sync, not create_only) [::stranske/Workflows::]

Workflow Implementation [::stranske/Workflows::]

• The workflow has comprehensive safety guards:
  • Workflow integrity check (workflow-integrity) to ensure the workflow file hasn't been modified in the PR [::stranske/Workflows::]
  • Secret detection check to verify CLAUDE_CODE_OAUTH_TOKEN is configured [::stranske/Workflows::]
  • Opt-in behavior requiring either claude-review label on PR or manual workflow_dispatch [::stranske/Workflows::]
  • Non-blocking failure mode (continues even if the action fails) [::stranske/Workflows::]

Repository Governance [::stranske/Workflows::]

• CLAUDE.md documents that changes to consumer-facing workflows must be made in Workflows source, not patched in consumer repos [::stranske/Workflows::]
• The sync manifest is the single source of truth for consumer repo synchronization [::stranske/Workflows::]
• Consumer repos should not override synced files unless explicitly documented in docs/ops/CONSUMER_REPO_MAINTENANCE.md [::stranske/Workflows::]

Key Observations

1. Template-Driven Sync: This PR is part of automated workflow template synchronization from stranske/Workflows to consumer repos via the .github/sync-manifest.yml configuration.

2. Action Version Pinning: The workflow uses a specific commit SHA (80b31826338489861333dc17217865dfe8085cdc) for the Claude Code action with # v1 annotation, ensuring reproducible builds.

3. Safety Mechanisms: The workflow includes a critical workflow-integrity guard that prevents the action from running if this workflow file itself has been modified in the current PR—a security measure to prevent token exfiltration.

4. Multiple Related Updates: The related PRs context shows this action SHA has been updated multiple times across different PRs (722, 748, 751, 761, 780), suggesting this is part of a coordinated update cycle.

5. No Breaking Changes Detected: The Workflows repository CHANGELOG references multiple "bump claude code review action" entries but no documented breaking changes between versions. The workflow configuration and inputs appear stable.

🔇 Additional comments (1)

.github/workflows/maint-76-claude-code-review.yml (1)

192-192: LGTM!

---

📝 Walkthrough

Walkthrough

The uses: pin for anthropics/claude-code-action in the Run Claude Code Review step of .github/workflows/maint-76-claude-code-review.yml is updated from one commit SHA to another. No other workflow logic, inputs, or parameters are changed.

Changes

claude-code-action SHA bump

Layer / File(s)	Summary
Update claude-code-action commit SHA .github/workflows/maint-76-claude-code-review.yml	The uses: ref for anthropics/claude-code-action in the Run Claude Code Review step is repinned to a new commit SHA.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~1 minutes

Possibly related PRs

• stranske/Counter_Risk#722: Modifies the same Run Claude Code Review step to repin anthropics/claude-code-action to a different commit SHA.
• stranske/Counter_Risk#748: Updates the same anthropics/claude-code-action pinned commit SHA in the same workflow step.
• stranske/Counter_Risk#780: Bumps the same anthropics/claude-code-action commit digest in the same claude-review workflow step.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'chore: sync workflow templates' directly relates to the main objective of syncing workflow templates from the stranske/Workflows repository. It accurately describes the primary change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sync/workflows-2dc5f6ceac12

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Workflow state fingerprint for Keepalive Loop Reporter. Do not edit.

[github-actions]

Workflow state fingerprint for Agents Gate Followups. Do not edit.