chore: sync workflow templates

[stranske]

Sync Summary

Files Updated

• agents-guard.yml: Agents guard - enforces agents workflow protections (Health 45)
• maint-76-claude-code-review.yml: Claude Code review (opt-in) - runs only on labeled PRs or manual dispatch

Files Skipped

• pr-00-gate.yml: File exists and sync_mode is create_only
• ci.yml: File exists and sync_mode is create_only
• renovate.json: File exists and sync_mode is create_only
• cross-repo-smoke.yml: File exists and sync_mode is create_only
• llm_slots.json: None

---

Review Checklist

• CI passes with updated workflows
• No repo-specific customizations were overwritten

Source: stranske/Workflows
Source SHA: cd5687d7ae00a31b9cb6ddbf94cfb94c0e4fdf69
Template hash: 57b9e3dbcb23
Sync branch: sync/workflows-57b9e3dbcb23
Consumer repo: stranske/Fine-Art-Archive
Manifest: .github/sync-manifest.yml

Summary by CodeRabbit

• Chores
  • Updated workflow action revisions to newer pinned versions in two automation workflows.
  • Kept all existing workflow behavior, conditions, and inputs unchanged.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ba289689-24bb-408e-a3b3-828d5ef7ea31

📥 Commits

Reviewing files that changed from the base of the PR and between 957c782 and b69cc14.

📒 Files selected for processing (2)

• .github/workflows/agents-guard.yml
• .github/workflows/maint-76-claude-code-review.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)
• stranske/Template (auto-detected) → reviewed against open PR #874 sync/workflows-57b9e3dbcb23 instead of the default branch

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (5)

.github/workflows/*.{yml,yaml}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

startup_failure in GitHub Actions workflows with zero jobs indicates GitHub couldn't parse the workflow; check for invalid YAML syntax, conflicting permissions: blocks on workflow_call reusable workflows, invalid permission scopes, or circular workflow references

Files:

• .github/workflows/agents-guard.yml
• .github/workflows/maint-76-claude-code-review.yml

.github/workflows/*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

Reference reusable workflows with @main by default unless intentionally pinning to an exact commit SHA for a documented reason

Files:

• .github/workflows/agents-guard.yml
• .github/workflows/maint-76-claude-code-review.yml

{.github/workflows/agents-*.yml,.github/workflows/autofix.yml,.github/codex/**,docs/**}

📄 CodeRabbit inference engine (CLAUDE.md)

Synced workflows, prompts, scripts, and consumer docs are managed through .github/sync-manifest.yml in Workflows and should not be edited locally

Files:

• .github/workflows/agents-guard.yml

**/.github/workflows/*.yml

📄 CodeRabbit inference engine (AGENTS.md)

Reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason.

Files:

• .github/workflows/agents-guard.yml
• .github/workflows/maint-76-claude-code-review.yml

{**/.github/workflows/agents-*.yml,.github/workflows/autofix.yml,.github/codex/**,docs/ops/CONSUMER_REPO_MAINTENANCE.md,docs/keepalive/Agents.md}

📄 CodeRabbit inference engine (AGENTS.md)

Synced workflows, prompts, scripts, and consumer docs (including agents-*.yml, autofix.yml, .github/codex/ prompts, and synced scripts) are managed through .github/sync-manifest.yml in Workflows and should not be edited locally; fix issues in Workflows instead.

Files:

• .github/workflows/agents-guard.yml

🔀 Multi-repo context

Linked repositories findings

stranske/Workflows (inspected main)

• .github/workflows/agents-guard.yml:103,173 still pins stranske/Workflows/.github/actions/setup-api-client at 6c3391d38bbc20a4577ac42b9aa6c9dc4e462c09 in both fallback paths. The search output also shows this file is part of the template drift allowlist with a note that consumer pins were refreshed to a525e6e (config/template-drift-allowlist.txt:87-91), so the template sync is updating an already-known divergence rather than introducing a new workflow shape.
• .github/workflows/agents-guard.yml is the only workflow file in this repo directly tied to the changed guard path; no separate consumer of the setup-api-client pin was found beyond the workflow and its tests/scripts references.

stranske/Template (inspected refs/pull/874/head)

• .github/workflows/agents-guard.yml:114,183 already pins stranske/Workflows/.github/actions/setup-api-client@a525e6e3e2431d302073de65723c6e022f4b02fa in both event paths. This matches the newer pin described in the PR, so the sync appears consistent with the template PR branch.
• .github/workflows/maint-76-claude-code-review.yml:192 already pins anthropics/claude-code-action@521136812280ae7ef256e06045655b9da02793f0 on the PR branch, so the workflow-template source already contains the repin targeted by the PR.
• No additional downstream consumers of those exact pins were surfaced in the template repo; the remaining hits were the same workflow file and generic setup-api-client usages in other workflows.

🔇 Additional comments (2)

.github/workflows/agents-guard.yml (1)

114-114: 🩺 Stability & Availability

Looks good.

.github/workflows/maint-76-claude-code-review.yml (1)

192-192: 🔒 Security & Privacy

No change needed for this pin.

---

📝 Walkthrough

Walkthrough

The PR repins two GitHub Actions in workflow YAML files: the fallback API client action used by agents-guard in both PR event paths, and the Claude code review action used by the maintenance workflow.

Changes

Workflow action pins

Layer / File(s)	Summary
Agents guard fallback pin .github/workflows/agents-guard.yml	The pull_request_target and pull_request fallback steps repin stranske/Workflows/.github/actions/setup-api-client to a new commit digest.
Claude review pin .github/workflows/maint-76-claude-code-review.yml	The claude-review step repins anthropics/claude-code-action to a new digest.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• stranske/Fine-Art-Archive#112: Updates the same agents-guard.yml fallback action pin for stranske/Workflows/.github/actions/setup-api-client.
• stranske/Fine-Art-Archive#97: Updates the same claude-review workflow step by repinning anthropics/claude-code-action.
• stranske/Fine-Art-Archive#153: Also changes the maint-76-claude-code-review.yml claude-review action pin to a different digest.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change: syncing workflow templates in the repository.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sync/workflows-57b9e3dbcb23

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Workflow state fingerprint for Keepalive Loop Reporter. Do not edit.

[github-actions]

Workflow state fingerprint for Agents Gate Followups. Do not edit.