chore: sync workflow templates

[stranske]

Sync Summary

Files Updated

• agents-guard.yml: Agents guard - enforces agents workflow protections (Health 45)
• maint-76-claude-code-review.yml: Claude Code review (opt-in) - runs only on labeled PRs or manual dispatch

Files Skipped

• renovate.json: File exists and sync_mode is create_only
• cross-repo-smoke.yml: File exists and sync_mode is create_only
• llm_slots.json: None

---

Review Checklist

• CI passes with updated workflows
• No repo-specific customizations were overwritten

Source: stranske/Workflows
Source SHA: cd5687d7ae00a31b9cb6ddbf94cfb94c0e4fdf69
Template hash: 57b9e3dbcb23
Sync branch: sync/workflows-57b9e3dbcb23
Consumer repo: stranske/Template
Manifest: .github/sync-manifest.yml

Summary by CodeRabbit

• Chores
  • Updated pinned versions for automated workflow actions to keep CI and code review runs current and reliable.
  • No changes to product behavior or user-facing features.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d93e251a-19c4-4d03-9f8a-58e78f588f33

📥 Commits

Reviewing files that changed from the base of the PR and between 8ce9d0f and 7a867b3.

📒 Files selected for processing (2)

• .github/workflows/agents-guard.yml
• .github/workflows/maint-76-claude-code-review.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (4)

.github/workflows/**/*.{yml,yaml}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

.github/workflows/**/*.{yml,yaml}: Ensure coverage threshold settings in GitHub Actions workflow files for coverage-min match the [tool.coverage.report] fail_under setting in pyproject.toml, as the lower value will be the effective threshold
For startup_failure in GitHub Actions workflows with zero jobs, check for invalid YAML syntax, top-level permissions: blocks in workflow_call reusable workflows (which conflicts with caller permissions), invalid permission scopes, or circular workflow references

Files:

• .github/workflows/agents-guard.yml
• .github/workflows/maint-76-claude-code-review.yml

.github/workflows/*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

Reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

• .github/workflows/agents-guard.yml
• .github/workflows/maint-76-claude-code-review.yml

.github/workflows/**/*.yml

📄 CodeRabbit inference engine (AGENTS.md)

First-party consumers should reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

• .github/workflows/agents-guard.yml
• .github/workflows/maint-76-claude-code-review.yml

.github/workflows/agents-*.yml

📄 CodeRabbit inference engine (AGENTS.md)

Agent workflows (agents-*.yml), autofix.yml, synced prompts in .github/codex/, and synced scripts/docs should be fixed in stranske/Workflows, not in the consumer repository

Files:

• .github/workflows/agents-guard.yml

🔀 Multi-repo context stranske/Workflows

Linked repositories findings

stranske/Workflows

• .github/actions/setup-api-client/action.yml:16-75 — the referenced action’s interface is stable: inputs still include secrets, github_token, and fallback token/app fields; outputs remain token_count, available_tokens, and setup_contract. No signature/contract change is visible here, so the workflow pin bump should not require call-site changes. [::stranske/Workflows::]

• .github/actions/setup-api-client/action.yml:79-572 — the action performs dependency setup and token export internally, and the workflow’s existing usage (secrets: ${{ toJSON(secrets) }}, github_token: ${{ github.token }}) matches the documented usage in the action file. [::stranske/Workflows::]

• .github/workflows/agents-guard.yml:93-173 — both the pull_request_target and pull_request fallback steps already call the same setup-api-client action with the same inputs; only the pinned fallback SHA is changing. This is a narrow supply-chain pin update, not a behavior change in the workflow logic. [::stranske/Workflows::]

• .github/workflows/agents-guard.yml:25-173 — the fallback only activates when the local checkout lacks .github/actions/setup-api-client, so the external pin is strictly a safety net for repo states without the local action. That reduces the likelihood of runtime behavior changes from the pin bump itself. [::stranske/Workflows::]

🔇 Additional comments (2)

.github/workflows/agents-guard.yml (1)

114-114: 🔒 Security & Privacy

Pinned SHA matches the stranske/Workflows v1 tag.

.github/workflows/maint-76-claude-code-review.yml (1)

192-192: 🔒 Security & Privacy

No change needed: anthropics/claude-code-action@521136812280ae7ef256e06045655b9da02793f0 is the current v1 target, and the published advisory only affects < 1.0.74.

---

📝 Walkthrough

Walkthrough

This pull request updates pinned GitHub Actions commit SHAs in agents-guard.yml and maint-76-claude-code-review.yml.

Changes

Workflow action pin refresh

Layer / File(s)	Summary
Setup API client pins .github/workflows/agents-guard.yml	Both pull_request_target and pull_request fallback steps update the pinned stranske/Workflows/.github/actions/setup-api-client commit SHA.
Claude review action pin .github/workflows/maint-76-claude-code-review.yml	The claude-review job updates the pinned anthropics/claude-code-action commit hash.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• stranske/Template#834: Updates the same agents-guard.yml fallback setup-api-client pin in both event branches.
• stranske/Template#850: Updates the anthropics/claude-code-action pin in maint-76-claude-code-review.yml.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the workflow template sync and matches the main change set.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sync/workflows-57b9e3dbcb23

---

_{Comment @coderabbitai help to get the list of available commands.}

[agents-workflows-bot]

Automated Status Summary

Head SHA: 4d21947
Latest Runs: ⏳ pending — Gate
Required: core tests (3.12): ⏳ pending, core tests (3.13): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job	Result	Logs
(no jobs reported)	⏳ pending	—

Coverage Overview

• Coverage history entries: 0

Updated automatically; will refresh on subsequent CI/Docker completions.

---

Keepalive checklist

Scope

No scope information available

Tasks

• No tasks defined

Acceptance criteria

• No acceptance criteria defined