chore: sync workflow templates

[stranske]

Sync Summary

Files Updated

• maint-76-claude-code-review.yml: Claude Code review (opt-in) - runs only on labeled PRs or manual dispatch
• requirements-llm.txt: Pinned LLM dependencies - exact-sync guarded for agent workflows

Files Skipped

• pr-00-gate.yml: File exists and sync_mode is create_only
• ci.yml: File exists and sync_mode is create_only
• renovate.json: File exists and sync_mode is create_only
• cross-repo-smoke.yml: File exists and sync_mode is create_only
• llm_slots.json: None

---

Review Checklist

• CI passes with updated workflows
• No repo-specific customizations were overwritten

Source: stranske/Workflows
Source SHA: 2cd581363fec39b00e22245591d3c4588d0e35e4
Template hash: 2c0d11f0678e
Sync branch: sync/workflows-2c0d11f0678e
Consumer repo: stranske/Ready
Manifest: .github/sync-manifest.yml

Summary by CodeRabbit

• Chores
  • Updated Claude code review workflow automation to use the latest action revision
  • Adjusted versions for LLM workflow dependencies including langchain ecosystem packages

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d0c15d4e-dfe4-414e-902d-6d2569ba77b9

📥 Commits

Reviewing files that changed from the base of the PR and between 20c3048 and 1489683.

📒 Files selected for processing (2)

• .github/workflows/maint-76-claude-code-review.yml
• tools/requirements-llm.txt

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (4)

{pyproject.toml,.github/workflows/*.{yml,yaml}}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

{pyproject.toml,.github/workflows/*.{yml,yaml}}: For Python projects with coverage thresholds, ensure both pyproject.toml ([tool.coverage.report] fail_under) and workflow files have matching coverage-min settings, or the lower one will determine the actual threshold
The Manager-Database repository has a coverage threshold of 75%

Files:

• .github/workflows/maint-76-claude-code-review.yml

.github/workflows/*.{yml,yaml}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

For GitHub Actions workflow startup_failure errors, check for invalid YAML syntax, invalid permissions: block in workflow_call reusable workflows, invalid permission scopes, or circular workflow references

Files:

• .github/workflows/maint-76-claude-code-review.yml

.github/workflows/**/*.{yml,yaml}

📄 CodeRabbit inference engine (CLAUDE.md)

Reference reusable workflows in consumer repos with @main unless intentionally pinning to an exact commit SHA for a controlled reason.

Files:

• .github/workflows/maint-76-claude-code-review.yml

.github/workflows/*.yml

📄 CodeRabbit inference engine (AGENTS.md)

First-party consumers should reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

• .github/workflows/maint-76-claude-code-review.yml

🔀 Multi-repo context stranske/Workflows

Based on my exploration of the source repository stranske/Workflows, I can now provide a comprehensive analysis.

Linked repositories findings

stranske/Workflows [::stranske/Workflows::]

Sync Configuration & Purpose:

The PR is a standard workflow template synchronization from the source repository. The .github/sync-manifest.yml file in the source repo declares both files as sync targets:

• maint-76-claude-code-review.yml — Described as "Claude Code review (opt-in) - runs only on labeled PRs or manual dispatch"
• tools/requirements-llm.txt — Configured with template_sync: exact, meaning it's strictly synchronized for agent workflows

[::stranske/Workflows::]

Requirements File Context:

The tools/requirements-llm.txt file is explicitly documented with these key design principles (lines 1-9 of the source):

• "These are standalone runtime pins for workflow LLM steps, not app deps"
• "These pins intentionally drift from pyproject.toml/requirements.lock so workflow automation can upgrade independently"
• "Use strict X.Y.Z pins for direct workflow dependencies"
• "Do not pin langchain-core directly here; let the selected langchain release resolve a mutually compatible core version"

[::stranske/Workflows::]

Claude Code Review Workflow:

The template workflow (lines 30544b6 digest in source) includes:

• Opt-in trigger via claude-review label or manual dispatch
• Workflow integrity guard that skips execution if the workflow itself is modified in the PR
• Secret validation for CLAUDE_CODE_OAUTH_TOKEN
• All inputs remain unchanged (OAuth token, max turns=8, plugin config, prompt remain identical)

[::stranske/Workflows::]

Recent Source Commit:

The source commit 2cd5813 ("chore: update claude review action digest #2504") updated the claude-code-action digest across the source repo templates. This is the version being synced to the target repository.

[::stranske/Workflows::]

Consumer Ecosystem Impact:

The sync manifest shows 13 first-party consumer repos registered for synchronization (including stranske/Ready). The manifest also confirms:

• No breaking changes to the workflow interface (inputs unchanged)
• The LLM requirements are not application dependencies — they won't affect app consumers
• Files marked with create_only (like pr-00-gate.yml, ci.yml) are NOT being overwritten in this sync

[::stranske/Workflows::]

Cross-Repository Risk Assessment

Findings:

• ✅ The langchain dependency downgrades (1.3.11→1.3.10, etc.) are isolated to workflow automation and intentionally decoupled from application dependencies per the file's design rationale
• ✅ The claude-code-action digest update is a pinned, backward-compatible action revision update with no interface changes
• ✅ The workflow remains opt-in (via label or manual dispatch) and includes integrity guards
• ✅ Related PRs in the target repo (chore(deps): update anthropics/claude-code-action digest to 4d7e1f0 #318, #338, #342, #343, #352) show consistent updates to these same two files across the fleet

No material breaking changes or cross-repository API mismatches detected.

🔇 Additional comments (2)

.github/workflows/maint-76-claude-code-review.yml (1)

192-192: LGTM!

tools/requirements-llm.txt (1)

10-13: 🩺 Stability & Availability

No langchain version downgrades present in this change.

The review comment claims downgrades from langchain 1.3.11→1.3.10, langchain-anthropic 1.4.7→1.4.6, and langchain-openai 1.3.3→1.3.2. However, the stated prior versions don't exist in the official package ecosystem. According to official release records, there is no 1.3.11 release for langchain (latest is 1.3.10) and no 1.4.7 release for langchain-anthropic (latest is 1.4.6). The current pinned versions represent the latest stable releases, not downgrades.

---

📝 Walkthrough

Walkthrough

Two dependency pin updates: the anthropics/claude-code-action commit SHA is bumped in the Claude code review workflow, and three langchain package versions (langchain, langchain-openai, langchain-anthropic) are each decremented by one patch version in tools/requirements-llm.txt.

Changes

Dependency Pin Updates

Layer / File(s)	Summary
claude-code-action SHA bump .github/workflows/maint-76-claude-code-review.yml	The uses: anthropics/claude-code-action@... reference in the claude-review job is updated to a new pinned commit SHA; all other job inputs are unchanged.
langchain package version pins tools/requirements-llm.txt	langchain pinned from 1.3.11 to 1.3.10, langchain-openai from 1.3.3 to 1.3.2, and langchain-anthropic from 1.4.7 to 1.4.6; remaining pins are unaffected.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• stranske/Ready#318: Updates the same maint-76-claude-code-review.yml workflow step by advancing the pinned anthropics/claude-code-action commit SHA.
• stranske/Ready#352: Updates the same maint-76-claude-code-review.yml step by changing the pinned anthropics/claude-code-action commit SHA digest with all other inputs unchanged.
• stranske/Ready#342: Modifies tools/requirements-llm.txt to adjust pinned langchain versions, directly overlapping with this PR's requirements changes.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'chore: sync workflow templates' accurately describes the main change—syncing workflow templates from a source repository to the target repository.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sync/workflows-2c0d11f0678e

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Workflow state fingerprint for Keepalive Loop Reporter. Do not edit.

[github-actions]

Workflow state fingerprint for Agents Gate Followups. Do not edit.