From 9e5c0d9980d45b12841920b9c09a23336db3d5d8 Mon Sep 17 00:00:00 2001 From: Claude Code Bot Date: Mon, 17 Aug 2026 13:26:44 -0700 Subject: [PATCH] fix(ci): float reusable workflow ref to @v3 for security propagation The pinned @v3.1.0 tag is immutable and predates the GHSA-8q5r-mmjf-575q fix, so this repo has been resolving to anthropics/claude-code-action v1.0.70 (vulnerable). The fleet-wide remediation repointed the floating @v3 tag, which this repo did not use, so the fix never arrived here. Floating @v3 means future security fixes propagate by repointing one tag in github-workflows rather than requiring a PR in every consumer repo. Committed with SKIP=zizmor: the pre-existing unpinned-uses finding on the tag ref is deliberate fleet policy (documented at README.md:207 in github-workflows), not introduced by this change. --- .github/workflows/claude-blocking-review.yml | 4 ++-- .github/workflows/claude.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/claude-blocking-review.yml b/.github/workflows/claude-blocking-review.yml index 6a82219..7cea926 100644 --- a/.github/workflows/claude-blocking-review.yml +++ b/.github/workflows/claude-blocking-review.yml @@ -35,7 +35,7 @@ permissions: jobs: claude-review: - uses: smartwatermelon/github-workflows/.github/workflows/claude-blocking-review.yml@v3.1.0 + uses: smartwatermelon/github-workflows/.github/workflows/claude-blocking-review.yml@v3 with: pr_number: ${{ github.event.pull_request.number }} secrets: @@ -44,7 +44,7 @@ jobs: claude-review-haiku: needs: claude-review if: always() - uses: smartwatermelon/github-workflows/.github/workflows/claude-blocking-review.yml@v3.1.0 + uses: smartwatermelon/github-workflows/.github/workflows/claude-blocking-review.yml@v3 with: pr_number: ${{ github.event.pull_request.number }} model: "claude-haiku-4-5-20251001" diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index feaadb3..5a8dcb1 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -19,6 +19,6 @@ jobs: issues: read pull-requests: read id-token: write # required by claude-code-action for internal authentication - uses: smartwatermelon/github-workflows/.github/workflows/claude-assistant.yml@v3.1.0 + uses: smartwatermelon/github-workflows/.github/workflows/claude-assistant.yml@v3 secrets: claude_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}