chore: sync workflow templates

[stranske]

Sync Summary

Files Updated

• maint-76-claude-code-review.yml: Claude Code review (opt-in) - runs only on labeled PRs or manual dispatch

Files Skipped

• renovate.json: File exists and sync_mode is create_only
• cross-repo-smoke.yml: File exists and sync_mode is create_only
• llm_slots.json: None

---

Review Checklist

• CI passes with updated workflows
• No repo-specific customizations were overwritten

Source: stranske/Workflows
Source SHA: 8ee41928ebaeffa75539e5e3ee0b6fa11b313398
Template hash: 2c33f158db7e
Sync branch: sync/workflows-2c33f158db7e
Consumer repo: stranske/Template
Manifest: .github/sync-manifest.yml

Summary by CodeRabbit

• Chores
  • Updated the version of an automated code review tool used in the development workflow.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 2ec18f73-6aea-426d-93fd-c3c73bdce8b1

📥 Commits

Reviewing files that changed from the base of the PR and between 0eebc4a and 43b0702.

📒 Files selected for processing (1)

• .github/workflows/maint-76-claude-code-review.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: check

🧰 Additional context used

📓 Path-based instructions (3)

.github/workflows/**/*.{yml,yaml}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

.github/workflows/**/*.{yml,yaml}: Ensure coverage threshold settings in GitHub Actions workflow files for coverage-min match the [tool.coverage.report] fail_under setting in pyproject.toml, as the lower value will be the effective threshold
For startup_failure in GitHub Actions workflows with zero jobs, check for invalid YAML syntax, top-level permissions: blocks in workflow_call reusable workflows (which conflicts with caller permissions), invalid permission scopes, or circular workflow references

Files:

• .github/workflows/maint-76-claude-code-review.yml

.github/workflows/*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

Reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

• .github/workflows/maint-76-claude-code-review.yml

.github/workflows/**/*.yml

📄 CodeRabbit inference engine (AGENTS.md)

First-party consumers should reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

• .github/workflows/maint-76-claude-code-review.yml

🔀 Multi-repo context stranske/Workflows

[::stranske/Workflows::] .github/sync-manifest.yml:122 includes .github/workflows/maint-76-claude-code-review.yml as a synced template source, so the pinned anthropics/claude-code-action update is part of the template sync path and can flow into downstream repos.

[::stranske/Workflows::] .github/workflows/reusable-claude-run.yml:67 uses a separate default action (@anthropic-ai/claude-code) and its own auth/runner logic, so this PR does not appear to alter the shared reusable Claude execution workflow.

🔇 Additional comments (1)

.github/workflows/maint-76-claude-code-review.yml (1)

192-192: 🔒 Security & Privacy

No change needed. Pinning anthropics/claude-code-action by full SHA is correct, and 428971d2ecd6e3a7cb0ee0da2a3a8b33fdb3678d is tagged v1, so the inline # v1 comment is accurate.

---

📝 Walkthrough

Walkthrough

The workflow updates the pinned anthropics/claude-code-action reference used by the claude-review job step. No other job configuration, inputs, or conditionals change.

Changes

Claude Code Review action pin

Layer / File(s)	Summary
Updated action pin .github/workflows/maint-76-claude-code-review.yml	The claude-review job updates the uses: reference for anthropics/claude-code-action to a new pinned commit hash, with the rest of the step unchanged.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• stranske/Template#805: Updates the same anthropics/claude-code-action pin in the Claude Code Review workflow step.
• stranske/Template#865: Changes the same claude-review workflow step by updating the pinned action commit hash.
• stranske/Template#869: Modifies the same workflow file and step, with the same kind of pinned action reference update.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the automated sync of workflow templates, which matches the primary change in this PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sync/workflows-2c33f158db7e

---

_{Comment @coderabbitai help to get the list of available commands.}

[stranske-keepalive]

Automated Status Summary

Head SHA: fdb6351
Latest Runs: ⏳ pending — Gate
Required: core tests (3.12): ⏳ pending, core tests (3.13): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job	Result	Logs
(no jobs reported)	⏳ pending	—

Coverage Overview

• Coverage history entries: 0

Updated automatically; will refresh on subsequent CI/Docker completions.

---

Keepalive checklist

Scope

No scope information available

Tasks

• No tasks defined

Acceptance criteria

• No acceptance criteria defined