chore(deps): bump anthropics/claude-code-action from 1 to 1.0.167#84
Conversation
Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1 to 1.0.167. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@v1...v1.0.167) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.167 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![semgrep-code-wireapp[bot]](https://avatars.githubusercontent.com/u/16047324?s=60&v=4){kind=small}
| - name: Run Claude Code | ||
| id: claude | ||
| uses: anthropics/claude-code-action@v1 | ||
| uses: anthropics/claude-code-action@v1.0.167 |
There was a problem hiding this comment.
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
🌟 Fixed in commit 4bfe6bc 🌟
| - name: Run Claude Code Review | ||
| id: claude-review | ||
| uses: anthropics/claude-code-action@v1 | ||
| uses: anthropics/claude-code-action@v1.0.167 |
There was a problem hiding this comment.
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
🧼 Fixed in commit 4bfe6bc 🧼
This blocks repointing of tag to different code version in case of unlikely repository takeover. Dependabot can operate on commit SHAs so we won't lose automatic updates, source: https://github.blog/changelog/2022-10-31-dependabot-now-updates-comments-in-github-actions-workflows-referencing-action-versions/
1 participant
Bumps anthropics/claude-code-action from 1 to 1.0.167.
Release notes
Sourced from anthropics/claude-code-action's releases.
... (truncated)
Commits
6b80630fix: filter PR reviews and inline review comments to trigger time (#1385)30544b6chore: bump Claude Code to 2.1.186 and Agent SDK to 0.3.1862fee155chore: bump Claude Code to 2.1.185 and Agent SDK to 0.3.18551705dachore: bump Claude Code to 2.1.183 and Agent SDK to 0.3.183806af32chore: bump Claude Code to 2.1.181 and Agent SDK to 0.3.1810a08a86fix: skip workflow validation token exchange failures (#1417)9dd8b95chore: bump Claude Code to 2.1.179 and Agent SDK to 0.3.179Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)