From 568cf3e3ea3710e41263e104a7186f261356953e Mon Sep 17 00:00:00 2001 From: Cam Quilici Date: Fri, 25 Sep 2026 11:27:48 -0500 Subject: [PATCH 1/2] ci: run Claude Opus 5.5 with a supported CLI Pin Claude Code 2.1.282 and update the Claude action in each workflow before selecting Opus 5.5. --- .github/workflows/claude.yml | 24 +++++++++++++++---- .../workflows/codeowner-signoff-verify.yml | 13 ++++++++-- .github/workflows/klaud-candidate.yml | 12 ++++++++-- .github/workflows/klaud-plan.yml | 13 ++++++++-- .github/workflows/run-sweep.yml | 13 ++++++++-- 5 files changed, 63 insertions(+), 12 deletions(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 9e8cbe63eb..30c49998c0 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -38,9 +38,16 @@ jobs: - name: Set up uv uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + - name: Install Claude Code 2.1.282 + id: claude_cli + run: | + npm install --prefix "$RUNNER_TEMP/claude-code" --no-audit --no-fund @anthropic-ai/claude-code@2.1.282 + claude_cli="$RUNNER_TEMP/claude-code/node_modules/.bin/claude" + test "$("$claude_cli" --version)" = "2.1.282 (Claude Code)" + echo "path=$claude_cli" >> "$GITHUB_OUTPUT" - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@0d0e0876d3eaa933f45dc692f7a4312c83caf36f # v1.0.218 + uses: anthropics/claude-code-action@9171db3e57d6a3140a37ddc2ba92788584e0ead6 # v1.0.234 env: # Repository agent credential; the pinned action authorizes the triggering actor. GH_TOKEN: ${{ secrets.AGENT_PAT }} # zizmor: ignore[secrets-outside-env] @@ -50,6 +57,7 @@ jobs: BASH_DEFAULT_TIMEOUT_MS: "1800000" BASH_MAX_TIMEOUT_MS: "3600000" with: + path_to_claude_code_executable: ${{ steps.claude_cli.outputs.path }} # Repository agent credential; the pinned action authorizes the triggering actor. anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} # zizmor: ignore[secrets-outside-env] # Repository agent credential; the pinned action authorizes the triggering actor. @@ -63,7 +71,7 @@ jobs: {"fastMode": true} claude_args: | - --model 'claude-fable-5-1' + --model 'claude-opus-5-5' --mcp-config .github/mcp-ci.json '{"mcpServers": {"fetch": {"command": "npx", "args": ["-y", "@anthropic-ai/mcp-server-fetch@latest"]}}}' --allowedTools "Write,Edit,Read,Glob,Grep,WebFetch,mcp__github__*,mcp__github_inline_comment__create_inline_comment,mcp__github_ci__*,mcp__fetch__*,mcp__inferencemax-repos__*,Bash" prompt: | @@ -315,11 +323,19 @@ jobs: - name: Set up uv uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + - name: Install Claude Code 2.1.282 + id: claude_cli + run: | + npm install --prefix "$RUNNER_TEMP/claude-code" --no-audit --no-fund @anthropic-ai/claude-code@2.1.282 + claude_cli="$RUNNER_TEMP/claude-code/node_modules/.bin/claude" + test "$("$claude_cli" --version)" = "2.1.282 (Claude Code)" + echo "path=$claude_cli" >> "$GITHUB_OUTPUT" - name: PR Review with Claude - uses: anthropics/claude-code-action@0d0e0876d3eaa933f45dc692f7a4312c83caf36f # v1.0.218 + uses: anthropics/claude-code-action@9171db3e57d6a3140a37ddc2ba92788584e0ead6 # v1.0.234 env: INFERENCEMAX_ROOT: ${{ github.workspace }} with: + path_to_claude_code_executable: ${{ steps.claude_cli.outputs.path }} # Repository review credential; the job gates eligible review requests. anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} # zizmor: ignore[secrets-outside-env] trigger_phrase: "@pr-claude" @@ -329,7 +345,7 @@ jobs: {"fastMode": true} claude_args: | - --model 'claude-fable-5-1' + --model 'claude-opus-5-5' --mcp-config .github/mcp-ci.json --allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__inferencemax-repos__*,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)" prompt: | diff --git a/.github/workflows/codeowner-signoff-verify.yml b/.github/workflows/codeowner-signoff-verify.yml index ae355f9e07..23b9ce988d 100644 --- a/.github/workflows/codeowner-signoff-verify.yml +++ b/.github/workflows/codeowner-signoff-verify.yml @@ -87,10 +87,18 @@ jobs: grep -q "PR #${PR_NUMBER}" /tmp/codeowner-signoff-verify-prompt.md wc -c /tmp/codeowner-signoff-verify-prompt.md + - name: Install Claude Code 2.1.282 + id: claude_cli + if: steps.resolve.outputs.proceed == 'true' + run: | + npm install --prefix "$RUNNER_TEMP/claude-code" --no-audit --no-fund @anthropic-ai/claude-code@2.1.282 + claude_cli="$RUNNER_TEMP/claude-code/node_modules/.bin/claude" + test "$("$claude_cli" --version)" = "2.1.282 (Claude Code)" + echo "path=$claude_cli" >> "$GITHUB_OUTPUT" - name: Verify sign-off with Claude id: claude if: steps.resolve.outputs.proceed == 'true' - uses: anthropics/claude-code-action@0d0e0876d3eaa933f45dc692f7a4312c83caf36f # v1.0.218 + uses: anthropics/claude-code-action@9171db3e57d6a3140a37ddc2ba92788584e0ead6 # v1.0.234 env: # Repository verifier credential; trusted code checks writer authorization before this step. GH_TOKEN: ${{ secrets.AGENT_PAT }} # zizmor: ignore[secrets-outside-env] @@ -104,6 +112,7 @@ jobs: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} # zizmor: ignore[secrets-outside-env] # Repository verifier credential; trusted code checks writer authorization before this step. github_token: ${{ secrets.AGENT_PAT }} # zizmor: ignore[secrets-outside-env] + path_to_claude_code_executable: ${{ steps.claude_cli.outputs.path }} track_progress: false allowed_bots: '' additional_permissions: | @@ -112,7 +121,7 @@ jobs: {"fastMode": true} claude_args: | - --model 'claude-fable-5-1' + --model 'claude-opus-5-5' --mcp-config .github/mcp-ci.json '{"mcpServers": {"fetch": {"command": "npx", "args": ["-y", "@anthropic-ai/mcp-server-fetch@latest"]}}}' --allowedTools "Read,Write,Glob,Grep,WebFetch,mcp__github__*,mcp__github_ci__*,mcp__fetch__*,mcp__inferencemax-repos__*,Bash" prompt: | diff --git a/.github/workflows/klaud-candidate.yml b/.github/workflows/klaud-candidate.yml index ec519a83ed..255a28d769 100644 --- a/.github/workflows/klaud-candidate.yml +++ b/.github/workflows/klaud-candidate.yml @@ -62,14 +62,22 @@ jobs: rm -r "$RUNNER_TEMP/plan" outcome_schema=$(uv run --project .infx-tooling --locked python -P -m infx.klaud outcome-schema) echo "outcome-schema=$outcome_schema" >> "$GITHUB_OUTPUT" + - name: Install Claude Code 2.1.282 + id: claude_cli + run: | + npm install --prefix "$RUNNER_TEMP/claude-code" --no-audit --no-fund @anthropic-ai/claude-code@2.1.282 + claude_cli="$RUNNER_TEMP/claude-code/node_modules/.bin/claude" + test "$("$claude_cli" --version)" = "2.1.282 (Claude Code)" + echo "path=$claude_cli" >> "$GITHUB_OUTPUT" - name: Let Klaud Cold own the candidate PR id: claude continue-on-error: true - uses: anthropics/claude-code-action@0d0e0876d3eaa933f45dc692f7a4312c83caf36f # v1.0.218 + uses: anthropics/claude-code-action@9171db3e57d6a3140a37ddc2ba92788584e0ead6 # v1.0.234 env: GH_TOKEN: ${{ secrets.AGENT_PAT }} KLAUD_DASHBOARD_API_KEY: ${{ secrets.DASH_API_KEY }} with: + path_to_claude_code_executable: ${{ steps.claude_cli.outputs.path }} anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} github_token: ${{ secrets.AGENT_PAT }} settings: | @@ -83,7 +91,7 @@ jobs: } } claude_args: >- - --model 'claude-fable-5-1' + --model 'claude-opus-5-5' --max-turns 500 --json-schema '${{ steps.context.outputs.outcome-schema }}' --add-dir '${{ runner.temp }}/klaud' diff --git a/.github/workflows/klaud-plan.yml b/.github/workflows/klaud-plan.yml index b7efedb7d7..3c87c90fc6 100644 --- a/.github/workflows/klaud-plan.yml +++ b/.github/workflows/klaud-plan.yml @@ -66,15 +66,24 @@ jobs: --directory "$RUNNER_TEMP/klaud" --review-batch-size "$REVIEW_BATCH_SIZE" --cooldown-hours "$CANDIDATE_COOLDOWN_HOURS" + - name: Install Claude Code 2.1.282 + id: claude_cli + if: steps.prepare.outputs.has_candidates == 'true' + run: | + npm install --prefix "$RUNNER_TEMP/claude-code" --no-audit --no-fund @anthropic-ai/claude-code@2.1.282 + claude_cli="$RUNNER_TEMP/claude-code/node_modules/.bin/claude" + test "$("$claude_cli" --version)" = "2.1.282 (Claude Code)" + echo "path=$claude_cli" >> "$GITHUB_OUTPUT" - name: Check for overlapping open PRs id: review if: steps.prepare.outputs.has_candidates == 'true' continue-on-error: true - uses: anthropics/claude-code-action@0d0e0876d3eaa933f45dc692f7a4312c83caf36f # v1.0.218 + uses: anthropics/claude-code-action@9171db3e57d6a3140a37ddc2ba92788584e0ead6 # v1.0.234 env: GH_TOKEN: ${{ github.token }} KLAUD_EVIDENCE: ${{ runner.temp }}/klaud with: + path_to_claude_code_executable: ${{ steps.claude_cli.outputs.path }} # Repository automation credential; the planner runs only on main. anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} # zizmor: ignore[secrets-outside-env] github_token: ${{ github.token }} @@ -82,7 +91,7 @@ jobs: settings: | {"fastMode": false} claude_args: >- - --model 'claude-opus-5' + --model 'claude-opus-5-5' --max-turns 500 --add-dir '${{ runner.temp }}/klaud' --allowedTools "Read,Glob,Grep,Bash(gh pr list:*),Bash(gh pr view:*),Bash(gh pr diff:*),Bash(gh api --method GET:*),Bash(git show:*),Bash(git diff:*),Bash(git status:*),Bash(git log:*),Bash(git ls-tree:*)" diff --git a/.github/workflows/run-sweep.yml b/.github/workflows/run-sweep.yml index 7bb20715a8..00437a01ee 100644 --- a/.github/workflows/run-sweep.yml +++ b/.github/workflows/run-sweep.yml @@ -266,14 +266,23 @@ jobs: ]).write(); return data.sha; - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + - name: Install Claude Code 2.1.282 + id: claude_cli + if: vars.PRIORITY_SCHEDULER_ENABLED == 'true' && github.event_name == 'pull_request' + run: | + npm install --prefix "$RUNNER_TEMP/claude-code" --no-audit --no-fund @anthropic-ai/claude-code@2.1.282 + claude_cli="$RUNNER_TEMP/claude-code/node_modules/.bin/claude" + test "$("$claude_cli" --version)" = "2.1.282 (Claude Code)" + echo "path=$claude_cli" >> "$GITHUB_OUTPUT" - name: Classify priority criteria id: classify if: >- vars.PRIORITY_SCHEDULER_ENABLED == 'true' && github.event_name == 'pull_request' continue-on-error: true - uses: anthropics/claude-code-action@0d0e0876d3eaa933f45dc692f7a4312c83caf36f # v1.0.218 + uses: anthropics/claude-code-action@9171db3e57d6a3140a37ddc2ba92788584e0ead6 # v1.0.234 with: + path_to_claude_code_executable: ${{ steps.claude_cli.outputs.path }} github_token: ${{ github.token }} # Repository integration credential for the scoped sweep/ingest job. anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} # zizmor: ignore[secrets-outside-env] @@ -281,7 +290,7 @@ jobs: settings: | {"fastMode": true} claude_args: | - --model 'claude-opus-5' + --model 'claude-opus-5-5' --effort low --max-turns 8 --allowedTools "Read,Glob,Grep,Bash(git diff:*)" From 775769fa32314c80fe00d450116785466a495229 Mon Sep 17 00:00:00 2001 From: Cam Quilici Date: Fri, 25 Sep 2026 11:30:58 -0500 Subject: [PATCH 2/2] ci: document pinned Claude CLI installation The Claude CLI package has no regular dependencies, and all native optional packages are version pinned to 2.1.282. Record the narrow Zizmor exception for this explicit compatibility pin. --- .github/workflows/claude.yml | 4 ++-- .github/workflows/codeowner-signoff-verify.yml | 2 +- .github/workflows/klaud-candidate.yml | 2 +- .github/workflows/klaud-plan.yml | 2 +- .github/workflows/run-sweep.yml | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 30c49998c0..c14aa3c440 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -40,7 +40,7 @@ jobs: - name: Install Claude Code 2.1.282 id: claude_cli - run: | + run: | # zizmor: ignore[adhoc-packages] Claude CLI and its native packages are pinned to 2.1.282 npm install --prefix "$RUNNER_TEMP/claude-code" --no-audit --no-fund @anthropic-ai/claude-code@2.1.282 claude_cli="$RUNNER_TEMP/claude-code/node_modules/.bin/claude" test "$("$claude_cli" --version)" = "2.1.282 (Claude Code)" @@ -325,7 +325,7 @@ jobs: - name: Install Claude Code 2.1.282 id: claude_cli - run: | + run: | # zizmor: ignore[adhoc-packages] Claude CLI and its native packages are pinned to 2.1.282 npm install --prefix "$RUNNER_TEMP/claude-code" --no-audit --no-fund @anthropic-ai/claude-code@2.1.282 claude_cli="$RUNNER_TEMP/claude-code/node_modules/.bin/claude" test "$("$claude_cli" --version)" = "2.1.282 (Claude Code)" diff --git a/.github/workflows/codeowner-signoff-verify.yml b/.github/workflows/codeowner-signoff-verify.yml index 23b9ce988d..441187e18d 100644 --- a/.github/workflows/codeowner-signoff-verify.yml +++ b/.github/workflows/codeowner-signoff-verify.yml @@ -90,7 +90,7 @@ jobs: - name: Install Claude Code 2.1.282 id: claude_cli if: steps.resolve.outputs.proceed == 'true' - run: | + run: | # zizmor: ignore[adhoc-packages] Claude CLI and its native packages are pinned to 2.1.282 npm install --prefix "$RUNNER_TEMP/claude-code" --no-audit --no-fund @anthropic-ai/claude-code@2.1.282 claude_cli="$RUNNER_TEMP/claude-code/node_modules/.bin/claude" test "$("$claude_cli" --version)" = "2.1.282 (Claude Code)" diff --git a/.github/workflows/klaud-candidate.yml b/.github/workflows/klaud-candidate.yml index 255a28d769..ea68c5517d 100644 --- a/.github/workflows/klaud-candidate.yml +++ b/.github/workflows/klaud-candidate.yml @@ -64,7 +64,7 @@ jobs: echo "outcome-schema=$outcome_schema" >> "$GITHUB_OUTPUT" - name: Install Claude Code 2.1.282 id: claude_cli - run: | + run: | # zizmor: ignore[adhoc-packages] Claude CLI and its native packages are pinned to 2.1.282 npm install --prefix "$RUNNER_TEMP/claude-code" --no-audit --no-fund @anthropic-ai/claude-code@2.1.282 claude_cli="$RUNNER_TEMP/claude-code/node_modules/.bin/claude" test "$("$claude_cli" --version)" = "2.1.282 (Claude Code)" diff --git a/.github/workflows/klaud-plan.yml b/.github/workflows/klaud-plan.yml index 3c87c90fc6..5826854e50 100644 --- a/.github/workflows/klaud-plan.yml +++ b/.github/workflows/klaud-plan.yml @@ -69,7 +69,7 @@ jobs: - name: Install Claude Code 2.1.282 id: claude_cli if: steps.prepare.outputs.has_candidates == 'true' - run: | + run: | # zizmor: ignore[adhoc-packages] Claude CLI and its native packages are pinned to 2.1.282 npm install --prefix "$RUNNER_TEMP/claude-code" --no-audit --no-fund @anthropic-ai/claude-code@2.1.282 claude_cli="$RUNNER_TEMP/claude-code/node_modules/.bin/claude" test "$("$claude_cli" --version)" = "2.1.282 (Claude Code)" diff --git a/.github/workflows/run-sweep.yml b/.github/workflows/run-sweep.yml index 00437a01ee..82f4be9dbc 100644 --- a/.github/workflows/run-sweep.yml +++ b/.github/workflows/run-sweep.yml @@ -269,7 +269,7 @@ jobs: - name: Install Claude Code 2.1.282 id: claude_cli if: vars.PRIORITY_SCHEDULER_ENABLED == 'true' && github.event_name == 'pull_request' - run: | + run: | # zizmor: ignore[adhoc-packages] Claude CLI and its native packages are pinned to 2.1.282 npm install --prefix "$RUNNER_TEMP/claude-code" --no-audit --no-fund @anthropic-ai/claude-code@2.1.282 claude_cli="$RUNNER_TEMP/claude-code/node_modules/.bin/claude" test "$("$claude_cli" --version)" = "2.1.282 (Claude Code)"