[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/create-github-app-token (changelog)	action	digest	bcd2ba4 → 64ab729
actions/create-github-app-token	action	minor	v3.2.0 → v3.3.0
anthropics/claude-code-action (changelog)	action	digest	8cf3482 → a5a423f
anthropics/claude-code-action	action	patch	v1.0.233 → v1.0.256
astral-sh/setup-uv	action	minor	v10.2.0 → v10.3.0
azure/setup-kubectl	action	minor	v5.1.0 → v5.2.0
loft-sh/github-actions (changelog)	action	digest	c6a76f1 → d15a1df
openai/codex-action	action	minor	v1.12 → v1.13
reviewdog/action-actionlint	action	minor	v1.77.0 → v1.80.4

---

Release Notes

actions/create-github-app-token

v3.3.0

Compare Source

Features

• update permission inputs (#​399) (a47236f)

Bug Fixes

• deps: bump nested undici from 6.24.0 to 6.29.0 (#​403) (12461a3)
• deps: bump the production-dependencies group across 1 directory with 3 updates (#​395) (a69c19d)

anthropics/claude-code-action

v1.0.256

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.255...v1.0.256

v1.0.255

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.254...v1.0.255

v1.0.254

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.253...v1.0.254

v1.0.253

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.252...v1.0.253

v1.0.252

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.251...v1.0.252

v1.0.251

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.250...v1.0.251

v1.0.250

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.249...v1.0.250

v1.0.249

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.248...v1.0.249

v1.0.248

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.247...v1.0.248

v1.0.247

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.246...v1.0.247

v1.0.246

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.245...v1.0.246

v1.0.245

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.244...v1.0.245

v1.0.244

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.243...v1.0.244

v1.0.243

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.242...v1.0.243

v1.0.242

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.241...v1.0.242

v1.0.241

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.240...v1.0.241

v1.0.240

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.239...v1.0.240

v1.0.239

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.238...v1.0.239

v1.0.238

Compare Source

What's Changed

• ci: security hardening for GitHub Actions workflows that call Claude by @​qing-ant in #​1867

New Contributors

• @​qing-ant made their first contribution in #​1867

Full Changelog: anthropics/claude-code-action@v1.0.237...v1.0.238

v1.0.237

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.236...v1.0.237

v1.0.236

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.235...v1.0.236

v1.0.235

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.234...v1.0.235

v1.0.234

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.233...v1.0.234

astral-sh/setup-uv

v10.3.0: 🌈 Add Python architecture selection

Compare Source

Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

• Use macOS 15 runners for tests @​charliermarsh (#​1081)

🚀 Enhancements

• Add python-arch support @​zanieb (#​1079)

🧰 Maintenance

• chore: update known checksums for 0.13.0 @​github-actions[bot] (#​1089)
• chore: update known checksums for 0.12.24 @​github-actions[bot] (#​1084)
• chore: update known checksums for 0.12.23 @​github-actions[bot] (#​1082)
• chore: update known checksums for 0.12.22 @​github-actions[bot] (#​1080)
• chore: update known checksums for 0.12.21 @​github-actions[bot] (#​1078)
• chore: update known checksums for 0.12.20 @​github-actions[bot] (#​1076)
• chore: update known checksums for 0.12.19 @​github-actions[bot] (#​1068)
• chore: update known checksums for 0.12.18 @​github-actions[bot] (#​1065)

⬆️ Dependency updates

• chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 @​dependabot[bot] (#​1077)

azure/setup-kubectl

v5.2.0

Compare Source

Added

• #​268 Add custom download URL, checksum verification, and download authentication inputs

Fixed

• #​251 Add Node.js types for TypeScript 6 compatibility

Changed

• #​267 Pin the release workflow to a commit SHA
• #​252 Update action dependencies
• #​253 Update CI action dependencies
• #​254 Update action dependencies
• #​255 Update CodeQL action
• #​257 Update action dependencies
• #​258 Update CodeQL action
• #​262 Update Node.js type definitions
• #​263 Update CodeQL action
• #​265 Update action dependencies
• #​266 Update CI action dependencies
• #​269 Update Vitest
• #​270 Update Node.js type definitions
• #​271 Update CI action dependencies
• #​272 Update esbuild
• #​273 Update action dependencies
• #​274 Update Node.js type definitions
• #​275 Update checkout action
• #​281 Update action dependencies
• #​282 Update action dependencies
• #​284 Update Prettier
• #​285 Update action dependencies
• #​287 Update CI action dependencies
• #​293 Update action dependencies
• #​294 Update action dependencies
• #​295 Update CI action dependencies
• #​299 Update action dependencies

Security

• #​256 Update postcss
• #​276 Update undici
• #​289 Update undici
• #​290 Update postcss

openai/codex-action

v1.13

Compare Source

• #​183 preserve system service access when restricting runner sockets under Linux drop-sudo.
• Bound output draining to five seconds after Codex exits so descendants retaining log streams cannot keep the action open.
• Linux drop-sudo now requires setfacl (the acl package) and ACL support on /run.

reviewdog/action-actionlint

v1.80.4

Compare Source

What's Changed

• chore(deps): update python:3.15.0-alpine3.24 docker digest to 2699b90 by @​renovate[bot] in #​254

Full Changelog: reviewdog/action-actionlint@v1.80.3...v1.80.4

v1.80.3

Compare Source

What's Changed

• chore(deps): update python:3.15.0-alpine3.24 docker digest to e7044cc by @​renovate[bot] in #​253

Full Changelog: reviewdog/action-actionlint@v1.80.2...v1.80.3

v1.80.2

Compare Source

What's Changed

• chore(deps): update python:3.15.0-alpine3.24 docker digest to ff4d3c9 by @​renovate[bot] in #​252

Full Changelog: reviewdog/action-actionlint@v1.80.1...v1.80.2

v1.80.1

Compare Source

What's Changed

• chore(deps): update python docker tag to v3.15.0 by @​renovate[bot] in #​251

Full Changelog: reviewdog/action-actionlint@v1.80.0...v1.80.1

v1.80.0

Compare Source

What's Changed

• chore(deps): update dependency pyflakes to v4.0.3 by @​renovate[bot] in #​250

Full Changelog: reviewdog/action-actionlint@v1.79.1...v1.80.0

v1.79.1

Compare Source

What's Changed

• chore(deps): update python:3.14.8-alpine3.24 docker digest to f6a589d by @​renovate[bot] in #​249

Full Changelog: reviewdog/action-actionlint@v1.79.0...v1.79.1

v1.79.0

Compare Source

What's Changed

• chore(deps): update dependency pyflakes to v4.0.2 by @​renovate[bot] in #​248

Full Changelog: reviewdog/action-actionlint@v1.78.1...v1.79.0

v1.78.1

Compare Source

What's Changed

• chore(deps): update python docker tag to v3.14.8 by @​renovate[bot] in #​247

Full Changelog: reviewdog/action-actionlint@v1.78.0...v1.78.1

v1.78.0

Compare Source

What's Changed

• chore(deps): update shogo82148/actions-create-release action to v1.9.2 by @​renovate[bot] in #​245
• chore(deps): update dependency pyflakes to v4.0.1 by @​renovate[bot] in #​246

Full Changelog: reviewdog/action-actionlint@v1.77.0...v1.78.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Claude finished @renovate[bot]'s task in 16s —— View job

---

Review: PR #291

I found no bugs, security issues or performance problems.

• The same full-length SHA pin (9171db3e…) is applied to all four places that use it. No copy of the old digest (8cf3482) is left anywhere in the repo, so none of the pins is out of step.
• The pins stay on full commit SHAs, and the existing zizmor: ignore annotations are unchanged.
• Upstream's v1.0.234 release has no notes. From what's in the PR, it looks like a plain patch bump with no new inputs or permissions.

Release note: .github/actions/ai-pr-review is a shared composite action. Callers get this bump only after its floating tag is moved to the merge commit (see the Release Process section in CLAUDE.md). The change asks nothing new of callers, so moving the existing tag is fine.

[github-actions]

Claude finished @renovate[bot]'s task in 18s —— View job

---

Review: PR #291

I found no bugs, security issues or performance problems.

• All four uses of anthropics/claude-code-action now point at the same full commit SHA (9171db3e…). The old SHA (8cf3482) no longer appears anywhere in the repo's YAML.
• actions/checkout goes to v6.1.0 (d23441a4…) in test-platform-release.yaml. That file was the last workflow still pinned to v6. Every other workflow and composite action is on v7.0.1, so this bump leaves nothing behind. Some README examples still say v6.0.2, but that is documentation and changes nothing at runtime.
• The pins are still full commit SHAs, and the zizmor: ignore annotations are unchanged.

Release note: .github/actions/ai-pr-review is a shared composite action. Merging this PR does not reach its callers until the action's floating tag is moved to the merge commit (see the Release Process section of CLAUDE.md). The bump asks nothing new of callers, so it is fine to move the existing tag rather than cut a new major.

[github-actions]

Claude finished @renovate[bot]'s task in 16s —— View job

---

Review: PR #291

I found no bugs, security issues or performance problems.

• All four uses of anthropics/claude-code-action now point at the same full commit SHA (9171db3e…). The old SHA (8cf3482) no longer appears anywhere under .github/.
• The actions/checkout change that the previous review covered is no longer in this PR. That is expected: test-platform-release.yaml is already on v7.0.1 on main (from chore(deps): update actions/checkout action to v7 #292), so the rebase dropped it.
• The pins are still full commit SHAs, and the zizmor: ignore annotations are unchanged.

Release note: .github/actions/ai-pr-review is a shared composite action. Merging this PR does not reach its callers until the action's floating tag is moved to the merge commit (see the Release Process section of CLAUDE.md). The bump asks nothing new of callers, so it is fine to move the existing tag rather than cut a new major.

[github-actions]

Claude finished @renovate[bot]'s task in 14s —— View job

---

Review: PR #291

I found no bugs, security issues or performance problems.

• Renovate has pushed a new commit. All four uses of anthropics/claude-code-action now point at 756cc22e… (v1.0.235). The earlier reviews on this PR checked the previous pin, 9171db3e…. Neither the old digest (8cf3482) nor 9171db3e appears anywhere under .github/, so no pin is out of step with the others.
• The pins are still full commit SHAs, and the zizmor: ignore annotations are unchanged.
• Upstream's v1.0.234 and v1.0.235 releases have no notes. The changed lines only move the SHA; no inputs or permissions change.

Release note: .github/actions/ai-pr-review is a shared composite action. Merging this PR does not reach its callers until the action's floating tag is moved to the merge commit (see the Release Process section of CLAUDE.md). The bump asks nothing new of callers, so moving the existing tag is fine.

[github-actions]

Claude finished @renovate[bot]'s task in 13s —— View job

---

Review: PR #291

I found no bugs, security issues or performance problems.

• Renovate pushed a new commit. All four uses of anthropics/claude-code-action now point at 8ce9314f… (v1.0.236). The earlier reviews on this PR checked older pins. No other claude-code-action pin is left under .github/, so none of the pins is out of step.
• The pins are still full commit SHAs, and the zizmor: ignore annotations are unchanged.
• Upstream's v1.0.234–v1.0.236 releases have no notes. The changed lines only move the SHA; no inputs or permissions change.

Release note: .github/actions/ai-pr-review is a shared composite action. Merging this PR does not reach its callers until the action's floating tag is moved to the merge commit (see the Release Process section of CLAUDE.md). The bump asks nothing new of callers, so moving the existing tag is fine.

[github-actions]

Claude finished @renovate[bot]'s task in 18s —— View job

---

Review: PR #291

I found no bugs, security issues or performance problems.

• Renovate pushed a new commit. All four uses of anthropics/claude-code-action now point at fd1c1286… (v1.0.237). No other claude-code-action pin is left under .github/, so none of the pins is out of step.
• The pins are still full commit SHAs, and the zizmor: ignore annotations are unchanged.
• Upstream's v1.0.234–v1.0.237 releases have no notes. The changed lines only move the SHA; no inputs or permissions change.

Release note: .github/actions/ai-pr-review is a shared composite action. Merging this PR does not reach its callers until the action's floating tag is moved to the merge commit (see the Release Process section of CLAUDE.md). The bump asks nothing new of callers, so moving the existing tag is fine.

[github-actions]

Claude finished @renovate[bot]'s task in 28s —— View job

---

Review: PR #291

I found no bugs, security issues or performance problems.

• Renovate pushed a new commit. All four uses of anthropics/claude-code-action now point at fd1c1286… (v1.0.237), and no older pin is left under .github/. The pins are still full commit SHAs, and the zizmor: ignore annotations are unchanged.
• New in this push: .github/actions/govulncheck/action.yml:91 moves ci-test-notify from c6a76f1 to e9b507c (feat(ci-test-notify): add info status and none run link position #298). The only thing feat(ci-test-notify): add info status and none run link position #298 changes in ci-test-notify is two additions: a new info status and a new run-link-position: none option. govulncheck sends status: failure and uses the default link position, so the Slack message it posts stays the same.
• .github/workflows/ci.yaml:16 still pins validate-renovate.yaml@c6a76f1. Nothing is broken by that, because the file is outside this Renovate group and feat(ci-test-notify): add info status and none run link position #298 didn't touch it.

Release note: ai-pr-review and govulncheck are both shared composite actions. Merging this PR does not reach their callers until each action's floating tag is moved to the merge commit (see the Release Process section of CLAUDE.md). Neither bump asks anything new of callers, so moving the existing tags is fine and no new major is needed.

[github-actions]

Claude finished @renovate[bot]'s task in 22s —— View job

---

Review: PR #291

I found no bugs, security issues or performance problems.

• Renovate pushed a new commit. All four uses of anthropics/claude-code-action now point at 12dd8d74… (v1.0.238), and no older pin is left under .github/. The pins are still full commit SHAs, and the zizmor: ignore annotations haven't changed.
• The ci-test-notify bump in .github/actions/govulncheck/action.yml:91 (c6a76f1 → e9b507c, feat(ci-test-notify): add info status and none run link position #298) is the same as in the last review. feat(ci-test-notify): add info status and none run link position #298 only adds an info status and a run-link-position: none option. govulncheck sends status: failure with the default link position, so its Slack message is unchanged.
• Upstream's v1.0.234–v1.0.238 releases have no notes. The changed lines only move the SHA, and no inputs or permissions change.

Release note: ai-pr-review and govulncheck are shared composite actions. Their callers won't get this bump until each action's floating tag is moved to the merge commit (see the Release Process section in CLAUDE.md). Neither bump asks anything new of callers, so you can move the existing tags. No new major is needed.

[github-actions]

Claude finished @renovate[bot]'s task in 16s —— View job

---

Review: PR #291

I found no bugs, security issues or performance problems.

• New in this push: .github/workflows/actionlint.yaml:38 moves reviewdog/action-actionlint from v1.77.0 to v1.78.0 (1129829f…). Upstream's release notes list only dependency bumps (actions-create-release, pyflakes). No inputs change, and the github_token and reporter inputs it passes stay the same.
• All four uses of anthropics/claude-code-action still point at 12dd8d74… (v1.0.238), and no older pin is left under .github/. The pins are still full commit SHAs, and the zizmor: ignore annotations haven't changed.
• The ci-test-notify bump in govulncheck/action.yml:91 (c6a76f1 → e9b507c, feat(ci-test-notify): add info status and none run link position #298) hasn't changed since the last review. Its Slack message stays the same.

Release note: ai-pr-review and govulncheck are shared composite actions. Their callers won't get this bump until each action's floating tag is moved to the merge commit (see Release Process in CLAUDE.md). Neither bump asks anything new of callers, so you can move the existing tags. No new major is needed.

[github-actions]

Claude finished @renovate[bot]'s task in 49s —— View job

---

Review: PR #291

Bug: this push rolls cve-scan back to an older ci-test-notify, which undoes #300

.github/actions/cve-scan/action.yml:167 and :197 change the ci-test-notify pin from 2c8ba9b to e9b507c. That is a downgrade: e9b507c is an ancestor of 2c8ba9b, and the only change between the two commits is #299, which added the footer-text input.

cve-scan passes that input at :185 and :220 (footer-text: "View run #…"). At e9b507c the input doesn't exist, so:

• GitHub logs an Unexpected input 'footer-text' warning and ignores the value.
• The Slack footer goes back to the default <repo> · Run #N. That is the text fix(cve-scan): link the run from a footer that does not name the repo #300 removed, because for a CVE scan the repo name reads like the subject of the message.

Likely cause: the # ci-test-notify/v1 tag comment. Renovate pins each SHA to whatever the tag points at, so the floating tag probably still points at e9b507c, which means it wasn't moved after #299 merged (pin drift). I couldn't confirm this: git ls-remote needed an approval I don't have.

Fix (pick one):

• Advance the tag to a commit that includes feat(ci-test-notify): let callers set the footer link text #299, e.g. git tag -f ci-test-notify/v1 origin/main && git push origin ci-test-notify/v1 --force. Then have Renovate rebase, and it will re-pin all ci-test-notify uses forward.
• Or revert the two cve-scan lines in this PR to 2c8ba9b4c4be9e873fac4898cfb4ea2eddb5faed.

Advancing the tag is safe. #299 only adds an optional input, so it asks nothing new of callers.

Fix this →

Everything else is unchanged since the last review and has no problems: the claude-code-action pins on 12dd8d74… (v1.0.238), the govulncheck ci-test-notify bump (c6a76f1 → e9b507c is forward, and govulncheck doesn't use footer-text), and action-actionlint v1.78.0.

[github-actions]

Claude finished @renovate[bot]'s task in 20s —— View job

---

Review: PR #291

I found no bugs, security issues or performance problems.

• The cve-scan downgrade from the last review is fixed. cve-scan/action.yml is no longer in the diff, and both of its ci-test-notify pins stay on 2c8ba9b (feat(ci-test-notify): let callers set the footer link text #299, which has footer-text). The notification_pins.bats guard expects exactly that SHA.
• govulncheck/action.yml:91 now moves ci-test-notify from c6a76f1 to 2c8ba9b. That is forward: c6a76f1 is an ancestor of 2c8ba9b. The only commits in between are feat(ci-test-notify): add info status and none run link position #298 and feat(ci-test-notify): let callers set the footer link text #299, and both just add optional inputs. govulncheck uses neither, so its Slack message is unchanged.
• All four uses of anthropics/claude-code-action now point at 97c53473… (v1.0.239), and no older pin is left under .github/. The pins are still full commit SHAs, and the zizmor: ignore annotations haven't changed.
• reviewdog/action-actionlint v1.78.0 is the same as in the last review: upstream only bumped dependencies.

Release note: ai-pr-review and govulncheck are shared composite actions. Their callers won't get this bump until each action's floating tag is moved to the merge commit (see Release Process in CLAUDE.md). Neither bump asks anything new of callers, so you can move the existing tags. No new major is needed.

[github-actions]

Claude finished @renovate[bot]'s task in 21s —— View job

---

Review: PR #291

I found no bugs, security issues or performance problems.

• New in this push: .github/workflows/actionlint.yaml:38 moves reviewdog/action-actionlint from v1.78.0 to v1.78.1 (13465d02…). Upstream's only change is a bump of the Python docker tag to 3.14.8. The inputs stay the same, and this workflow still passes the same github_token and reporter.
• All four uses of anthropics/claude-code-action still point at 97c53473… (v1.0.239), and no older pin is left under .github/. The pins are still full commit SHAs, and the zizmor: ignore annotations haven't changed.
• govulncheck/action.yml:91 still moves ci-test-notify forward from c6a76f1 to 2c8ba9b, the same as in the last review. Both cve-scan pins stay on 2c8ba9b, so the downgrade flagged two reviews ago has not come back.

Release note: ai-pr-review and govulncheck are shared composite actions. Their callers won't get this bump until each action's floating tag is moved to the merge commit (see Release Process in CLAUDE.md). Neither bump asks anything new of callers, so you can move the existing tags. No new major is needed.

[github-actions]

Claude finished @renovate[bot]'s task in 52s —— View job

---

Review: PR #291

Bug: this push rolls cve-scan back to a ci-test-notify that breaks on jq 1.6, undoing #303

.github/actions/cve-scan/action.yml:167 and :197 change the pin from d15a1df (on main since #303) to 2c8ba9b. That is a downgrade, because 2c8ba9b is an ancestor of d15a1df. The only ci-test-notify change between the two is #302. It added the else . branch to SLACK_ESCAPE_CHARS in build-payload.sh:23–24.

• jq 1.6 rejects an if … elif … end that has no else. jq 1.6 is the version on ubuntu-22.04, where the scheduled scans run.
• cve-scan passes footer-text (:185, :220), and that input sends the footer through the broken filter (build-payload.sh:115, :119). On 22.04 the jq call fails, so no payload is built. The step is advisory, so the Slack alert for a found CVE or a scanner error is dropped and nothing goes red.
• .github/actions/cve-scan/test/notification_pins.bats:8 expects exactly d15a1df, so make test fails on this branch.

Likely cause: pin drift again, like the earlier e9b507c rollback on this PR. Renovate re-pins to whatever ci-test-notify/v1 points at, and that tag apparently still points at 2c8ba9b. It wasn't moved after #302 merged. I couldn't check this myself because git fetch/ls-remote needs approval I don't have.

Fix (pick one):

• Advance the tag: git tag -f ci-test-notify/v1 d15a1df8ea70c58cf70343f7c3687a6014ed63f8 && git push origin ci-test-notify/v1 --force, then tick Renovate's rebase box. This is safe because fix(ci-test-notify): add the else branch jq 1.6 needs in the footer escape #302 is a pure bug fix and asks nothing new of callers.
• Or revert the two cve-scan lines in this PR to d15a1df8ea70c58cf70343f7c3687a6014ed63f8.

Fix this →

govulncheck is fine. govulncheck/action.yml:91 moves from c6a76f1 to 2c8ba9b, which is forward. govulncheck doesn't pass footer-text, so it never runs the broken filter. Once the tag is advanced, Renovate will move it to d15a1df as well.

Nothing else changed since the last review: claude-code-action is on 97c53473… (v1.0.239) in all four places, and action-actionlint is on v1.78.1.

[github-actions]

Claude finished @renovate[bot]'s task in 22s —— View job

---

Review: PR #291

I found no bugs, security issues or performance problems.

• The cve-scan downgrade from the last review is fixed. cve-scan/action.yml is no longer in the diff, and both of its ci-test-notify pins stay on d15a1df (fix(cve-scan): repin ci-test-notify to the jq 1.6 footer fix #303, the jq 1.6 fix), which is the SHA notification_pins.bats expects. It looks like the ci-test-notify/v1 tag was advanced.
• govulncheck/action.yml:91 now moves ci-test-notify from c6a76f1 to d15a1df, the same commit cve-scan uses. That is a forward move. The changes in between (feat(ci-test-notify): add info status and none run link position #298, feat(ci-test-notify): let callers set the footer link text #299, fix(ci-test-notify): add the else branch jq 1.6 needs in the footer escape #302) add optional inputs or fix bugs, and govulncheck's Slack message stays the same.
• All four uses of anthropics/claude-code-action now point at ed670b4c… (v1.0.240), and no older pin is left under .github/. The pins are still full commit SHAs, and the zizmor: ignore annotations haven't changed.
• reviewdog/action-actionlint v1.78.1 is the same as in the last review.

Release note: ai-pr-review and govulncheck are shared composite actions. Their callers won't get this bump until each action's floating tag is moved to the merge commit (see Release Process in CLAUDE.md). Neither bump asks anything new of callers, so you can move the existing tags. No new major is needed.

[github-actions]

Claude finished @renovate[bot]'s task in 14s —— View job

---

Review: PR #291

I found no bugs, security issues or performance problems.

• New in this push: all four uses of anthropics/claude-code-action now point at cab360f6… (v1.0.241). No older pin is left under .github/. The pins are still full commit SHAs, and the zizmor: ignore annotations haven't changed. Upstream's v1.0.239–v1.0.241 releases have no notes. The changed lines only move the SHA, and no inputs or permissions change.
• govulncheck/action.yml:91 still moves ci-test-notify forward from c6a76f1 to d15a1df. That matches both cve-scan pins (:167, :197), which are not in the diff, so the downgrade flagged in earlier reviews has not come back.
• reviewdog/action-actionlint v1.78.1 is the same as in the last review.

Release note: ai-pr-review and govulncheck are shared composite actions. Their callers won't get this bump until each action's floating tag is moved to the merge commit (see Release Process in CLAUDE.md). Neither bump asks anything new of callers, so you can move the existing tags. No new major is needed.

[github-actions]

Claude finished @renovate[bot]'s task in 31s —— View job

---

Review: PR #291

I found no bugs or security issues in this push. The ai-pr-review release caveat from earlier reviews still applies.

• New in this push: actions/create-github-app-token v3.2.0 → v3.3.0 (64ab729a…). It changes in comment-triggered-check/action.yml:179 and secret-broker-request/action.yml:32. The PR body's table lists it. Upstream's headline change is #399, "update permission inputs". Both call sites pass a permission-* input: permission-checks: write (:183) and permission-members: read (:37).
  • Whether either input was renamed or removed matters here. An unknown input only logs a warning, so the token would quietly be minted with the app's full installation permissions instead of the narrowed scope.
  • I couldn't check upstream's action.yml at 64ab729 because gh api needs approval I don't have. Please confirm both inputs still exist before merging. It's a minor release, so a rename is unlikely.
• Also new: all four anthropics/claude-code-action pins move to 34968b59… (v1.0.249), and no older pin is left under .github/. reviewdog/action-actionlint moves to v1.80.1, which only bumps the Python docker tag. Both pins are still full SHAs.
• Still open: openai/codex-action v1.13 (ai-pr-review/action.yml:147). In drop-sudo mode it now needs setfacl (the acl package) and ACL support on /run. Self-hosted runners or containers without acl will fail at the Codex step.
• These haven't changed since the last review: setup-uv v10.3.0 (test-only workflows), setup-kubectl v5.2.0, and ci-test-notify in govulncheck moving forward to d15a1df, the same commit the cve-scan pins use.

Release note:

• ai-pr-review: codex-action v1.13 adds a runner requirement, so the Release Process section of CLAUDE.md calls for a new major. The exception is if gh search code 'loft-sh/github-actions/.github/actions/ai-pr-review@ org:loft-sh' shows that every caller uses the wrapper on GitHub-hosted runners.
• comment-triggered-check, secret-broker-request, govulncheck, prerelease-setup: none of these bumps asks anything new of callers, so you can move their existing tags. For the first two, check the permission-* inputs above first.

[github-actions]

Claude finished @renovate[bot]'s task in 52s —— View job

---

Review: PR #291

Likely bug: this push may roll release-summary back to an ai-step that lacks the inputs it passes, which would undo #309

.github/actions/release-summary/action.yml:93 moves ai-step from e36ead5 (the pin #309 set) to d462e84. The comment directly above that line (:90–92) gives the reason for the old pin: "input-file and max-tokens are newer than the commit ai-step/v1 points at." Renovate sets the pin to wherever # ai-step/v1 points, in either direction. So unless someone advanced ai-step/v1 after #309, d462e84 is the old tag commit. That is the same kind of pin drift that rolled back cve-scan's ci-test-notify pin twice on this PR.

If that's what happened:

• input-file (:101) and max-tokens (:99) become unknown inputs. GitHub only logs a warning for those.
• ai-step gets no PR data and falls back to 4096 tokens. The release summary is then empty or cut off. It is advisory, so nothing goes red.
• No bats guard checks this pin (unlike cve-scan/test/notification_pins.bats), so make test won't catch it.

I couldn't confirm the direction: the checkout is shallow, and git fetch needs approval I don't have. Check it with git merge-base --is-ancestor e36ead5 d462e84, or look at what ai-step/v1 points at.

Fix (pick one):

• If d462e84 is older, advance the tag: git tag -f ai-step/v1 e36ead5fbb77c6fff66720215288783c6471d37d && git push origin ai-step/v1 --force. Then tick Renovate's rebase box. This is safe because the new inputs are optional and ask nothing new of callers.
• Or revert :93 in this PR to e36ead5fbb77c6fff66720215288783c6471d37d.

Fix this →

Also new: setup-uv v10.3.0 now covers test-release-notification.yaml and test-release-summary.yaml too. These are test-only workflows, and the bump is fine.

Still open from earlier reviews:

• create-github-app-token v3.3.0: upstream's #399 "update permission inputs" touches inputs these call sites use: permission-checks (comment-triggered-check/action.yml:183) and permission-members (secret-broker-request/action.yml:37). If either input was renamed, the token would be minted with the app's full permissions instead of the narrowed scope. Please confirm both inputs still exist at 64ab729 before merging.
• openai/codex-action v1.13 (ai-pr-review/action.yml:147): drop-sudo mode now needs setfacl (the acl package) and ACL support on /run. That counts as a new runner requirement, so the Release Process section of CLAUDE.md calls for a new ai-pr-review major. The exception is if every caller uses the wrapper on GitHub-hosted runners.

These are unchanged since the last review and have no problems:

• claude-code-action is on 34968b59… (v1.0.249) in all four places.
• action-actionlint is on v1.80.1.
• setup-kubectl is on v5.2.0.
• In govulncheck, ci-test-notify moves to d15a1df, which matches the cve-scan pins.

[github-actions]

Claude finished @renovate[bot]'s task in 29s —— View job

---

Review: PR #291

I found no new bugs or security issues in this push. Two items from earlier reviews are still open.

• The release-summary rollback flagged last review is fixed. release-summary/action.yml:93 now moves ai-step from e36ead5 to 17f1806. That is the feat(release-summary): ai summary of each release in its banner thread #309 merge commit and current origin/main, so the move is forward. I checked that ai-step/action.yml at 17f1806 has both inputs this step passes, input-file (:29) and max-tokens (:37). So ai-step/v1 was advanced, and the summary step gets its PR data and token budget again.
  • The comment at :90–92 ("input-file and max-tokens are newer than the commit ai-step/v1 points at") is now out of date. It changes nothing at runtime.

Still open from earlier reviews:

• create-github-app-token v3.3.0: upstream's #399, "update permission inputs", may affect inputs used here: permission-checks (comment-triggered-check/action.yml:183) and permission-members (secret-broker-request/action.yml:37). If either input was renamed, the token would be minted with the app's full installation permissions instead of the narrowed scope, and GitHub would only log a warning. Please confirm both inputs still exist at 64ab729 before merging.
• openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode it now needs setfacl (the acl package) and ACL support on /run. Under the Release Process section of CLAUDE.md, a new runner requirement calls for a new ai-pr-review major. The exception is if every caller uses the wrapper on GitHub-hosted runners.

These haven't changed since the last review and have no problems:

• claude-code-action is on 34968b59… (v1.0.249) in all four places.
• action-actionlint is on v1.80.1.
• setup-uv is on v10.3.0 (test-only workflows).
• setup-kubectl is on v5.2.0.
• In govulncheck, ci-test-notify moves to d15a1df, which matches the cve-scan pins.

[github-actions]

Claude finished @renovate[bot]'s task in 28s —— View job

---

Review: PR #291

This push adds no new bugs or security issues. Two items from earlier reviews are still open.

• New in this push: Renovate rebased onto fix(release-summary): pin ai-step to its commit on main #311, so release-summary/action.yml has dropped out of the diff. On main, :91 now pins ai-step to 17f1806 (the feat(release-summary): ai summary of each release in its banner thread #309 squash commit, where ai-step/v1 points). The out-of-date comment from the last review was replaced, so nothing is left to fix there.

Still open:

• create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses: permission-checks (comment-triggered-check/action.yml:183) and permission-members (secret-broker-request/action.yml:37). If either was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. I tried to check upstream's action.yml at 64ab729 again, but gh api needs approval I don't have. Please confirm both inputs still exist before merging.
• openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode it now needs setfacl (the acl package) and ACL support on /run. Under the Release Process section of CLAUDE.md, a new runner requirement calls for a new ai-pr-review major. The exception is if every caller uses the wrapper on GitHub-hosted runners.

These haven't changed since the last review and have no problems:

• claude-code-action is on 34968b59… (v1.0.249) in all four places.
• action-actionlint is on v1.80.1.
• setup-uv is on v10.3.0 (test-only workflows).
• setup-kubectl is on v5.2.0.
• In govulncheck, ci-test-notify moves to d15a1df, which matches the cve-scan pins.

[github-actions]

Claude finished @renovate[bot]'s task in 21s —— View job

---

Review: PR #291

This push adds no new bugs or security issues. Two items from earlier reviews are still open.

• New in this push: all four uses of anthropics/claude-code-action now point at a26b07d8… (v1.0.250), and no older pin is left under .github/. The pins are still full commit SHAs, and the changed lines only move the SHA. This review job itself ran on a26b07d8, so that pin has been exercised end-to-end at least once.

Still open:

• create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses: permission-checks (comment-triggered-check/action.yml:183) and permission-members (secret-broker-request/action.yml:37). If either was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. I still can't check upstream's action.yml at 64ab729 from this job. Please confirm both inputs still exist before merging.
• openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode it now needs setfacl (the acl package) and ACL support on /run. Under the Release Process section of CLAUDE.md, a new runner requirement calls for a new ai-pr-review major. The exception is if every caller uses the wrapper on GitHub-hosted runners.

These haven't changed since the last review and have no problems: action-actionlint v1.80.1, setup-uv v10.3.0 (test-only workflows), setup-kubectl v5.2.0, and ci-test-notify in govulncheck moving forward to d15a1df, which matches the cve-scan pins.

[github-actions]

Claude finished @renovate[bot]'s task in 17s —— View job

---

Review: PR #291

This push adds no new bugs or security issues. Two items from earlier reviews are still open.

• New in this push: .github/workflows/actionlint.yaml:38 moves reviewdog/action-actionlint from v1.80.1 to v1.80.2 (3cbf14ef…). According to upstream's notes, the only change is a new Python docker digest. The workflow passes the same two inputs as before, and the pin is still a full SHA.

Still open:

• create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses: permission-checks (comment-triggered-check/action.yml:183) and permission-members (secret-broker-request/action.yml:37). If either one was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. I tried again to fetch upstream's action.yml at 64ab729, but curl needs approval this job doesn't have. Please confirm both inputs still exist before merging.
• openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so the Release Process section of CLAUDE.md calls for a new ai-pr-review major. The exception is if every caller uses the wrapper on GitHub-hosted runners.

These haven't changed since the last review and have no problems:

• claude-code-action is on a26b07d8… (v1.0.250) in all four places.
• setup-uv is on v10.3.0 (test-only workflows).
• setup-kubectl is on v5.2.0.
• In govulncheck, ci-test-notify moves forward to d15a1df, which matches the cve-scan pins.

[github-actions]

Claude finished @renovate[bot]'s task in 30s —— View job

---

Review: PR #291

This push doesn't add any bugs or security issues. Two items from earlier reviews are still open.

• New in this push: Renovate rebased onto fix(auto-approve-bot-prs): decide mergeability after every other check #316 (auto-approve-bot-prs). The diff is the same as last time: 14 files, +15/−15. fix(auto-approve-bot-prs): decide mergeability after every other check #316 changes no pin this PR moves. No old digest from this group is left under .github/.

Still open:

• create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses: permission-checks (comment-triggered-check/action.yml:183) and permission-members (secret-broker-request/action.yml:37). If either one was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. I still can't fetch upstream's action.yml from this job, so I haven't checked this. Please confirm both inputs still exist before merging.
• openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so the Release Process section of CLAUDE.md calls for a new ai-pr-review major. The exception is if every caller uses the wrapper on GitHub-hosted runners.

These haven't changed since the last review and have no problems:

• claude-code-action is on a26b07d8… (v1.0.250) in all four places.
• action-actionlint is on v1.80.2.
• setup-uv is on v10.3.0 (test-only workflows).
• setup-kubectl is on v5.2.0.
• In govulncheck, ci-test-notify moves forward to d15a1df, the same commit the cve-scan pins use.

[github-actions]

Claude finished @renovate[bot]'s task in 27s —— View job

---

Review: PR #291

This push adds no new bugs or security issues. Two items from earlier reviews are still open.

• New in this push: all four uses of anthropics/claude-code-action now point at 374f254f… (v1.0.251), and no older pin is left under .github/. The pins are still full commit SHAs, and the changed lines only move the SHA. This review job ran on 374f254f, so the new pin has run end-to-end at least once. The PR body's table still says v1.0.250, but that is only Renovate's description and isn't what the diff contains.

Still open:

• create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses: permission-checks (comment-triggered-check/action.yml:183) and permission-members (secret-broker-request/action.yml:37). If either was renamed, GitHub only logs a warning, and the token is minted with the app's full installation permissions instead of the narrower scope. I still can't fetch upstream's action.yml from this job, so this is unchecked. Please confirm both inputs still exist before merging.
• openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so the Release Process section of CLAUDE.md calls for a new ai-pr-review major. The exception is if every caller uses the wrapper on GitHub-hosted runners.

These haven't changed since the last review and have no problems:

• action-actionlint is on v1.80.2.
• setup-uv is on v10.3.0 (test-only workflows).
• setup-kubectl is on v5.2.0.
• In govulncheck, ci-test-notify moves forward to d15a1df, the same commit the cve-scan pins use.

[github-actions]

Claude finished @renovate[bot]'s task in 27s —— View job

---

Review: PR #291

This push adds no new bugs or security issues. Two items from earlier reviews are still open.

• New in this push: Renovate rebased onto feat(vcluster-release): check release.yaml before tagging, through release-lib #321. All four anthropics/claude-code-action pins now point at f27be6b6… (v1.0.252). No older pin from this group is left under .github/, and every ci-test-notify pin is still on d15a1df. This review job ran on f27be6b6, so the new pin has run once end to end. The PR body's table still says v1.0.251, but the diff has v1.0.252.

Still open:

• create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may touch two inputs this repo uses: permission-checks (comment-triggered-check/action.yml:183) and permission-members (secret-broker-request/action.yml:37). If either input was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. I still can't check this from the job. Please confirm both inputs exist at 64ab729 before merging.
• openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement. Under the Release Process section of CLAUDE.md, that means a new ai-pr-review major, unless every caller uses the wrapper on GitHub-hosted runners.

These haven't changed since the last review and have no problems: action-actionlint v1.80.2, setup-uv v10.3.0 (only in test workflows), setup-kubectl v5.2.0, and govulncheck's ci-test-notify pin moving forward to d15a1df.

[github-actions]

Claude finished @renovate[bot]'s task in 18s —— View job

---

Review: PR #291

This push doesn't add any bugs or security issues. Two items from earlier reviews are still open.

• New in this push: .github/workflows/actionlint.yaml:38 moves reviewdog/action-actionlint from v1.80.2 to v1.80.3 (b76d06f8…). The PR body's table still says v1.80.2 and has no notes for v1.80.3. Every earlier release in this range only bumped dependencies. The workflow passes the same two inputs as before, and the pin is still a full SHA.

Still open:

• create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses:

  • permission-checks (comment-triggered-check/action.yml:183)
  • permission-members (secret-broker-request/action.yml:37)

  If either input was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. I can't check this from the job. Please confirm both inputs exist at 64ab729 before merging.

• openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement. Under the Release Process section of CLAUDE.md, that calls for a new ai-pr-review major, unless every caller uses the wrapper on GitHub-hosted runners.

These haven't changed since the last review and have no problems:

• claude-code-action is on f27be6b6… (v1.0.252) in all four places.
• setup-uv is on v10.3.0, only in test workflows.
• setup-kubectl is on v5.2.0.
• govulncheck's ci-test-notify pin moves forward to d15a1df.

[github-actions]

Claude finished @renovate[bot]'s task in 21s —— View job

---

Review: PR #291

This push adds no new bugs or security issues. Two items from earlier reviews are still open.

• New in this push: .github/workflows/actionlint.yaml:38 moves reviewdog/action-actionlint from v1.80.3 to v1.80.4 (419a4937…). The PR body's table still says v1.80.3 and has no notes for v1.80.4. Every earlier release in this range only bumped dependencies. The workflow passes the same two inputs as before, and the pin is still a full SHA.

Still open:

• create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses:

  • permission-checks (comment-triggered-check/action.yml:183)
  • permission-members (secret-broker-request/action.yml:37)

  If either input was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. I tried again to fetch upstream's action.yml at 64ab729, but WebFetch needs approval this job doesn't have. Please confirm both inputs exist before merging.

• openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement. Under the Release Process section of CLAUDE.md, that calls for a new ai-pr-review major, unless every caller uses the wrapper on GitHub-hosted runners.

These haven't changed since the last review and have no problems:

• claude-code-action is on f27be6b6… (v1.0.252) in all four places.
• setup-uv is on v10.3.0, only in test workflows.
• setup-kubectl is on v5.2.0.
• govulncheck's ci-test-notify pin moves forward to d15a1df.

[github-actions]

Claude finished @renovate[bot]'s task in 19s —— View job

---

Review: PR #291

This push adds no new bugs or security issues. Two items from earlier reviews are still open.

• New in this push: all four anthropics/claude-code-action pins now point at 5eb090f3… (v1.0.253). No older pin from this group is left under .github/. The pins are still full commit SHAs, and the changed lines only move the SHA. This review job ran on 5eb090f3, so the new pin has run once end to end. The PR body's table still says v1.0.252, but the diff has v1.0.253.

Still open:

• create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses:

  • permission-checks (comment-triggered-check/action.yml:183)
  • permission-members (secret-broker-request/action.yml:37)

  If either input was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. I still haven't checked this: gh api needs approval this job doesn't have. Please confirm both inputs exist at 64ab729 before merging.

• openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement. Under the Release Process section of CLAUDE.md, it calls for a new ai-pr-review major, unless every caller uses the wrapper on GitHub-hosted runners.

These haven't changed since the last review and have no problems: action-actionlint v1.80.4, setup-uv v10.3.0 (only in test workflows), setup-kubectl v5.2.0, and govulncheck's ci-test-notify pin moving forward to d15a1df.

[github-actions]

Claude finished @renovate[bot]'s task in 20s —— View job

---

Review: PR #291

This push adds no new bugs or security issues. Two items from earlier reviews are still open.

• New in this push: all four anthropics/claude-code-action pins now point at db77d4d3… (v1.0.254). No older pin from this group is left under .github/. The pins are still full commit SHAs, and the changed lines only move the SHA. This review job ran on db77d4d3, so the new pin has run once end to end.

Still open:

• create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses:

  • permission-checks (comment-triggered-check/action.yml:183)
  • permission-members (secret-broker-request/action.yml:37)

  If either input was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. I still can't fetch upstream's action.yml from this job, so this hasn't been checked. Please confirm both inputs exist at 64ab729 before merging.

• openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement. Under the Release Process section of CLAUDE.md, it calls for a new ai-pr-review major, unless every caller uses the wrapper on GitHub-hosted runners.

These haven't changed since the last review and have no problems: action-actionlint v1.80.4, setup-uv v10.3.0 (only in test workflows), setup-kubectl v5.2.0, and govulncheck's ci-test-notify pin moving forward to d15a1df.

[github-actions]

Claude finished @renovate[bot]'s task in 24s —— View job

---

Review: PR #291

This push adds no new bugs or security issues. Two items from earlier reviews are still open.

• New in this push: all four anthropics/claude-code-action pins now point at e4a6faad… (v1.0.255). No older pin from this group is left under .github/. The pins are still full commit SHAs, and the changed lines only move the SHA. This review job ran on e4a6faad, so the new pin has run once end to end.

Still open:

• create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses:

  • permission-checks (comment-triggered-check/action.yml:183)
  • permission-members (secret-broker-request/action.yml:37)

  If either input was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. I still haven't checked this, because fetching upstream's action.yml with curl needs approval this job doesn't have. Please confirm both inputs exist at 64ab729 before merging.

• openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement. Under the Release Process section of CLAUDE.md, it calls for a new ai-pr-review major, unless every caller uses the wrapper on GitHub-hosted runners.

These haven't changed since the last review and have no problems: action-actionlint v1.80.4, setup-uv v10.3.0 (only in test workflows), setup-kubectl v5.2.0, and govulncheck's ci-test-notify pin moving forward to d15a1df.

[github-actions]

Claude finished @renovate[bot]'s task in 20s —— View job

---

Review: PR #291

This push adds no new bugs or security issues. Two items from earlier reviews are still open.

• New in this push: all four anthropics/claude-code-action pins now point at a5a423f7… (v1.0.256), and no older pin from this group is left under .github/. The pins are still full commit SHAs, and the changed lines only move the SHA. This review job ran on a5a423f7, so the new pin has run once end to end. The PR body's table still says v1.0.255, but the diff has v1.0.256.

Still open:

• create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses:

  • permission-checks (comment-triggered-check/action.yml:183)
  • permission-members (secret-broker-request/action.yml:37)

  If either input was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. I still haven't checked this: fetching upstream's action.yml with WebFetch needs approval this job doesn't have. Please confirm both inputs exist at 64ab729 before merging.

• openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement. Under the Release Process section of CLAUDE.md, it calls for a new ai-pr-review major, unless every caller uses the wrapper on GitHub-hosted runners.

These haven't changed since the last review and have no problems: action-actionlint v1.80.4, setup-uv v10.3.0 (only in test workflows), setup-kubectl v5.2.0, and govulncheck's ci-test-notify pin moving forward to d15a1df.