chore: sync workflow templates

[stranske]

Sync Summary

Files Updated

• maint-76-claude-code-review.yml: Claude Code review (opt-in) - runs only on labeled PRs or manual dispatch

Files Skipped

• pr-00-gate.yml: File exists and sync_mode is create_only
• ci.yml: File exists and sync_mode is create_only
• renovate.json: File exists and sync_mode is create_only
• cross-repo-smoke.yml: File exists and sync_mode is create_only
• AGENTS.md: Repo keeps historical Agents.md casing to avoid case-only path conflicts
• llm_slots.json: None

---

Review Checklist

• CI passes with updated workflows
• No repo-specific customizations were overwritten

Source: stranske/Workflows
Source SHA: 2cd581363fec39b00e22245591d3c4588d0e35e4
Template hash: 2c0d11f0678e
Sync branch: sync/workflows-2c0d11f0678e
Consumer repo: stranske/Trend_Model_Project
Manifest: .github/sync-manifest.yml

Summary by CodeRabbit

• Chores
  • Updated the Claude code review GitHub Action to a newer version while maintaining all existing configuration and workflow behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d65be222-1c86-4382-b4d2-b6b03b24d454

📥 Commits

Reviewing files that changed from the base of the PR and between 0620a12 and 3c42546.

📒 Files selected for processing (1)

• .github/workflows/maint-76-claude-code-review.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (3)

{pyproject.toml,.github/workflows/**/*.{yml,yaml}}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Check both pyproject.toml ([tool.coverage.report] fail_under) AND workflow files for coverage-min settings - these must match or the lower one wins

Files:

• .github/workflows/maint-76-claude-code-review.yml

.github/workflows/**/*.{yml,yaml}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

For startup_failure GitHub Actions workflow errors with zero jobs, check for common causes: Invalid YAML syntax, top-level permissions: block on workflow_call reusable workflows (conflicts with caller permissions), invalid permission scopes, or circular workflow references

Files:

• .github/workflows/maint-76-claude-code-review.yml

.github/workflows/*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

Reference reusable workflows in .github/workflows/*.yml files with @main unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

• .github/workflows/maint-76-claude-code-review.yml

🔀 Multi-repo context stranske/Workflows

Based on my exploration of the stranske/Workflows repository, I now have sufficient context to conclude the research.

Summary of Findings

Source Repository Context

[::stranske/Workflows::]

The PR in stranske/Workflows is updating the template workflow file templates/consumer-repo/.github/workflows/maint-76-claude-code-review.yml:

What Changed:

• Updated the pinned digest of anthropics/claude-code-action from an older version to @30544b674398ee15c84819bd87caf8a87e8c7b55 (tagged as # v1)
• No changes to workflow inputs, logic, or configuration
• The step remains configured with continue-on-error: true
• All conditional execution logic and skip conditions remain unchanged

Workflow Purpose & Distribution:

• This is an opt-in Claude Code Review workflow that runs only on PRs labeled with claude-review or via manual dispatch
• The workflow is centrally managed in the template repository and synced to consumer repos via the sync manifest (.github/sync-manifest.yml)
• Line 122-123 in sync-manifest.yml confirms: "Claude Code review (opt-in) - runs only on labeled PRs or manual dispatch"
• Sync mode is standard (not create_only), meaning it overwrites existing versions in consumer repos

Safety Mechanisms:

• The workflow includes a workflow_unchanged integrity check that verifies the workflow on the base branch matches before allowing secrets access
• This prevents PRs that modify the workflow itself from running with credentials
• The claude-review step has continue-on-error: true, making failures non-blocking

Cross-Repo Impact:
The version bump is purely a digest update with no API or configuration changes, so it should not cause breaking changes in consumer repos. The related PRs listed in the PR context (Trend_Model_Project #5556, #5589, #5595, #5609) all show the same pattern - just updating the pinned digest without other modifications.

🔇 Additional comments (1)

.github/workflows/maint-76-claude-code-review.yml (1)

192-192: 🔒 Security & Privacy

Digest is valid and correctly corresponds to v1. The pinned commit 30544b674398ee15c84819bd87caf8a87e8c7b55 exists in the anthropics/claude-code-action repository and carries the v1 tag as indicated in the comment. The update is a routine version bump with no changes to workflow inputs or configuration.

---

📝 Walkthrough

Walkthrough

The pinned commit digest for the anthropics/claude-code-action action in the claude-review job of .github/workflows/maint-76-claude-code-review.yml is updated from one SHA to another. All inputs, conditional logic, and surrounding steps remain unchanged.

Changes

Claude Action Digest Bump

Layer / File(s)	Summary
Update pinned action digest .github/workflows/maint-76-claude-code-review.yml	The uses: reference for anthropics/claude-code-action in the claude-review step is updated to a new pinned digest; all with: inputs and workflow logic are unchanged.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• stranske/Trend_Model_Project#5556: Updates the same pinned anthropics/claude-code-action digest in the same workflow file and step without changing any other inputs or logic.
• stranske/Trend_Model_Project#5589: Updates the pinned anthropics/claude-code-action digest in the same claude-review job step with no other changes.
• stranske/Trend_Model_Project#5609: Modifies the same workflow step by updating the pinned anthropics/claude-code-action commit hash without altering any inputs or configuration.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'chore: sync workflow templates' accurately reflects the main change—updating a GitHub Action workflow template as part of an automated sync operation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sync/workflows-2c0d11f0678e

---

_{Comment @coderabbitai help to get the list of available commands.}