chore: sync workflow templates

[stranske]

Sync Summary

Files Updated

• agents-guard.yml: Agents guard - enforces agents workflow protections (Health 45)
• maint-76-claude-code-review.yml: Claude Code review (opt-in) - runs only on labeled PRs or manual dispatch

Files Skipped

• pr-00-gate.yml: File exists and sync_mode is create_only
• ci.yml: File exists and sync_mode is create_only
• renovate.json: File exists and sync_mode is create_only
• cross-repo-smoke.yml: File exists and sync_mode is create_only
• llm_slots.json: None

---

Review Checklist

• CI passes with updated workflows
• No repo-specific customizations were overwritten

Source: stranske/Workflows
Source SHA: cd5687d7ae00a31b9cb6ddbf94cfb94c0e4fdf69
Template hash: 57b9e3dbcb23
Sync branch: sync/workflows-57b9e3dbcb23
Consumer repo: stranske/Counter_Risk
Manifest: .github/sync-manifest.yml

Summary by CodeRabbit

• Chores
  • Updated pinned versions for two workflow actions to newer revisions.
  • Kept existing workflow behavior, inputs, and conditional logic unchanged.
  • Maintains the same review and fallback automation while using the latest approved action pins.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR updates pinned GitHub Actions revisions in two workflows: the fallback setup-api-client action in agents-guard.yml and the anthropics/claude-code-action pin in maint-76-claude-code-review.yml.

Changes

Workflow action pin updates

Layer / File(s)	Summary
Fallback setup-api-client pins .github/workflows/agents-guard.yml	The pull_request_target and pull_request fallback steps now use a newer pinned revision of stranske/Workflows/.github/actions/setup-api-client.
Claude review action pin .github/workflows/maint-76-claude-code-review.yml	The claude-review job now uses a newer pinned revision of anthropics/claude-code-action.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~4 minutes

Possibly related PRs

• stranske/Counter_Risk#806: Updates the same anthropics/claude-code-action pin in .github/workflows/maint-76-claude-code-review.yml.
• stranske/Counter_Risk#757: Updates the same fallback setup-api-client action pin in .github/workflows/agents-guard.yml.
• stranske/Counter_Risk#804: Changes the same claude-review workflow step to a different pinned revision of anthropics/claude-code-action.

Suggested labels

dependencies

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: syncing workflow templates from upstream.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sync/workflows-57b9e3dbcb23

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Workflow state fingerprint for Keepalive Loop Reporter. Do not edit.

[github-actions]

Workflow state fingerprint for Agents Gate Followups. Do not edit.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/maint-76-claude-code-review.yml:
- Line 192: The claude-code-action reference is inconsistent because the pinned
commit SHA does not match the commit currently pointed to by the v1 tag. Update
the uses entry for anthropics/claude-code-action so the annotation and pinned
SHA agree, either by switching the pin to the v1 tag target or by changing the
comment to the correct version reference.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ba885579-c678-481d-bed8-f959c0a2d2b9

📥 Commits

Reviewing files that changed from the base of the PR and between a769802 and 041b971.

📒 Files selected for processing (2)

• .github/workflows/agents-guard.yml
• .github/workflows/maint-76-claude-code-review.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)

📜 Review details

⏰ Context from checks skipped due to timeout. (2)

• GitHub Check: gate-summary
• GitHub Check: Evaluate keepalive loop

🧰 Additional context used

📓 Path-based instructions (2)

.github/workflows/**/*.yml

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

.github/workflows/**/*.yml: Do not add top-level permissions: block on workflow_call reusable workflows - this conflicts with caller permissions
Avoid invalid YAML syntax, invalid permission scopes, and circular workflow references when creating GitHub Actions workflows

Files:

• .github/workflows/maint-76-claude-code-review.yml
• .github/workflows/agents-guard.yml

.github/workflows/agents-*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

Agent workflow files (agents-*.yml) should be fixed in stranske/Workflows, not edited locally in the consumer repository

agents-*.yml workflow files should be fixed in stranske/Workflows, not edited locally in the consumer repo

Files:

• .github/workflows/agents-guard.yml

🔇 Additional comments (1)

.github/workflows/agents-guard.yml (1)

114-114: 🩺 Stability & Availability

setup-api-client pin is correct — both fallback steps use a525e6e3e2431d302073de65723c6e022f4b02fa, which matches # v1.