From 74209aa07d5140ff807a1570d88efe9682c9228f Mon Sep 17 00:00:00 2001 From: Akshay Dodeja Date: Fri, 29 May 2026 15:44:28 -0700 Subject: [PATCH] ci(security): pin claude-code-action to a commit SHA MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `anthropics/claude-code-action@v1` is a mutable tag — a force-push of a compromised release would run with CLAUDE_CODE_OAUTH_TOKEN in scope. Pin both workflows to the commit the tag currently resolves to, per GitHub's third-party action hardening guidance. 787c5a0 == tag v1.0.133. Bump the SHA (and the trailing comment) together when upgrading. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/claude-code-review.yml | 2 +- .github/workflows/claude.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index fa4de10a..b0ad453e 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -38,7 +38,7 @@ jobs: - name: Run Claude Code Review id: claude-review continue-on-error: true - uses: anthropics/claude-code-action@v1 + uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 2409615f..49dad8c0 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -66,7 +66,7 @@ jobs: - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@v1 + uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}