chore(deps): update anthropics/claude-code-action digest to 9dd8b95

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
anthropics/claude-code-action (changelog)	action	digest	4d7e1f0 → 9dd8b95

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

📝 Walkthrough

Walkthrough

The pinned commit digest for the anthropics/claude-code-action step in .github/workflows/maint-76-claude-code-review.yml is updated to a new hash. No other workflow inputs, configuration, or behavior are changed.

Changes

Claude Code Action Pin Update

Layer / File(s)	Summary
Update anthropics/claude-code-action commit digest .github/workflows/maint-76-claude-code-review.yml	The uses: pin on line 192 is changed to a new commit hash; all surrounding step configuration remains identical.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related issues

• The changes appear to address the objective of Ready#320, which flags the available digest update for anthropics/claude-code-action in the dependency dashboard.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title accurately describes the main change: updating the anthropics/claude-code-action digest to a new revision hash.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/anthropics-claude-code-action-digest

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[agents-workflows-bot]

Automated Status Summary

Gate summary details were unavailable for this run.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/maint-76-claude-code-review.yml:
- Line 192: This workflow file is a synced template that automatically
propagates updates to all consumer repositories through the
maint-68-sync-consumer-repos.yml synchronization workflow. Before merging the
digest update for anthropics/claude-code-action from the current version to
4d7e1f0cd85743fdc93b1c8040ab54395da024e2, perform thorough validation to ensure
the new action version maintains backward compatibility, does not introduce
breaking changes to the input schema, and functions correctly. After merging,
monitor the synchronization workflow to verify that the digest update propagates
successfully to all registered consumer repositories and verify there are no
failures across the consumer fleet.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c5657835-f148-47de-871e-2133871d3f87

📥 Commits

Reviewing files that changed from the base of the PR and between 2fb1840 and 6988740.

📒 Files selected for processing (1)

• .github/workflows/maint-76-claude-code-review.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)

📜 Review details

🧰 Additional context used

📓 Path-based instructions (2)

.github/workflows/**/*.{yml,yaml}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

.github/workflows/**/*.{yml,yaml}: Ensure coverage threshold settings in GitHub Actions workflow files for coverage-min match the [tool.coverage.report] fail_under setting in pyproject.toml, as the lower value will be the effective threshold
For startup_failure in GitHub Actions workflows with zero jobs, check for invalid YAML syntax, top-level permissions: blocks in workflow_call reusable workflows (which conflicts with caller permissions), invalid permission scopes, or circular workflow references

First-party consumers should reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

• .github/workflows/maint-76-claude-code-review.yml

.github/workflows/*.yml

📄 CodeRabbit inference engine (AGENTS.md)

Reference reusable workflows with @main by default unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

• .github/workflows/maint-76-claude-code-review.yml

🔀 Multi-repo context stranske/Workflows

Based on my exploration, I now have sufficient context to provide findings. Let me summarize:

Linked repositories findings

stranske/Workflows

This PR updates the pinned anthropics/claude-code-action digest in a template workflow that is synced to multiple consumer repositories. Here are the critical cross-repo implications:

Template Location & Scope:

• The workflow file is located at templates/consumer-repo/.github/workflows/maint-76-claude-code-review.yml [::stranske/Workflows::], not in the main .github/workflows/ directory.
• This is a distributed template: It is declared in ./.github/sync-manifest.yml (line 122-123) [::stranske/Workflows::] as a synced workflow that propagates to all registered consumer repositories via the maint-68-sync-consumer-repos.yml workflow.

Action Change Details:

• Current pin: anthropics/claude-code-action@593d7a5c4e0073569f74772c2b7b64c30ec14707 # v1 (line 192) [::stranske/Workflows::]
• New pin: anthropics/claude-code-action@4d7e1f0 (per PR context)
• The action is used in the claude-review job with continue-on-error: true, making it non-blocking for CI.

Consumer Impact:

• The workflow checks for a claude-review label on PRs or uses workflow_dispatch for manual triggering (lines 94, 203) [::stranske/Workflows::].
• The workflow includes an integrity guard (lines 122-150) that validates the workflow file hasn't been modified, preventing potential prompt injection attacks [::stranske/Workflows::].
• Once synced, all consumer repositories registered in the sync system will receive this updated digest, meaning the behavior change from the version update will automatically propagate across the fleet.

Distribution Mechanism:

• The sync manifest entry (line 122-123) confirms this workflow is explicitly declared for synchronization [::stranske/Workflows::].
• The maint-68-sync-consumer-repos.yml workflow orchestrates the fleet-wide synchronization using a matrix strategy [::stranske/Workflows::].
• Documentation in docs/HISTORY.md notes that maint-76-claude-code-review.yml was introduced as an opt-in code review feature for consumers in Phase 3/4 of the roadmap [::stranske/Workflows::].

Potential Risk Areas:

1. No documented changelog in the repository for the digest change—can't determine if the new digest includes breaking changes to the action's input schema, output structure, or security fixes.
2. Wide propagation: Any behavioral change in the action will affect all consumer repos that have this workflow enabled, even if they haven't explicitly opted in beyond the initial sync.

🔇 Additional comments (1)

.github/workflows/maint-76-claude-code-review.yml (1)

192-192: Action update introduces internal improvements only—no breaking changes to input schema.

The digest update from 593d7a5 to 4d7e1f0 (22 commits, June 15, 2026) includes internal refactoring and bug fixes:

• Fixed a Bun runtime bug by removing the --tsconfig-override flag
• Enhanced environment variable handling for authentication inputs (fallback to env vars)
• Improved bun executable path resolution

All inputs used in this workflow (claude_code_oauth_token, allowed_bots, claude_args, prompt, plugin_marketplaces, plugins) remain compatible with no schema changes.

[coderabbitai]

🧹 Nitpick | 🔵 Trivial

Cross-repository propagation impact from template sync.

Based on linked repository findings, this workflow file is a synced template defined in stranske/Workflows at templates/consumer-repo/.github/workflows/maint-76-claude-code-review.yml and declared in .github/sync-manifest.yml (lines 122-123). Once merged, the updated action digest will automatically propagate to all registered consumer repositories via the maint-68-sync-consumer-repos.yml synchronization workflow.

Any behavioral changes, breaking input schema modifications, or bugs introduced in the new action version will affect the entire fleet of consumer repos. Ensure thorough validation of the digest update before merging and monitor the sync process for failures across consumers.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/maint-76-claude-code-review.yml at line 192, This workflow
file is a synced template that automatically propagates updates to all consumer
repositories through the maint-68-sync-consumer-repos.yml synchronization
workflow. Before merging the digest update for anthropics/claude-code-action
from the current version to 4d7e1f0cd85743fdc93b1c8040ab54395da024e2, perform
thorough validation to ensure the new action version maintains backward
compatibility, does not introduce breaking changes to the input schema, and
functions correctly. After merging, monitor the synchronization workflow to
verify that the digest update propagates successfully to all registered consumer
repositories and verify there are no failures across the consumer fleet.

Source: MCP tools