Repository navigation
chore(deps): bump anthropics/claude-code-action from 1.0.229 to 1.0.250 in the claude-code-action group across 1 directory - #282
Closed
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
|
Skipped: bot-authored PR ( |
|
Coverage Floor — FAILED — mode:
|
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/github_actions/claude-code-action-5c78c4a289
branch
from
October 8, 2026 04:23
d0e31fd to
b5050f8
Compare
|
Skipped: bot-authored PR ( |
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/github_actions/claude-code-action-5c78c4a289
branch
from
October 9, 2026 21:15
b5050f8 to
96305ae
Compare
|
Skipped: bot-authored PR ( |
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/github_actions/claude-code-action-5c78c4a289
branch
from
October 15, 2026 04:23
96305ae to
0bdfa40
Compare
|
Skipped: bot-authored PR ( |
Owner
|
@dependabot rebase |
Bumps the claude-code-action group with 1 update in the / directory: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action). Updates `anthropics/claude-code-action` from 1.0.229 to 1.0.250 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@a4f54ef...a26b07d) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.236 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: claude-code-action ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/github_actions/claude-code-action-5c78c4a289
branch
from
October 17, 2026 00:21
0bdfa40 to
3a9487b
Compare
|
Skipped: bot-authored PR ( |
Owner
|
Hold: don't merge this bump as is. It needs a manual PR, as the pin comment in This is the re-check that #300's pin comment asks for, run against a4f54ef → a26b07d8 (v1.0.250) and independently verified: Still holds:
Changed: the Agent SDK moves from 0.3.276 to 0.3.300.
The manual PR should:
Then close this PR. |
topcoder1
added a commit
that referenced
this pull request
Oct 17, 2026
…de default (#302) ## What and why Bumps `anthropics/claude-code-action` from `a4f54ef` (v1.0.229) to `a26b07d8c778b0c43f64618e5fd29fd0f8af72e8` (v1.0.250) in the three Claude lanes, and pins the reviewer's permission mode, which the new release would otherwise leave to the caller's settings. **The one behavioural change in v1.0.250:** the bundled Agent SDK moves from 0.3.276 to 0.3.300 (exact versions from `bun.lock`). 0.3.276 computed `permissionMode ?? (resolvePermissionModeInCli ? undefined : "default")`, so it always sent `--permission-mode default`. 0.3.300 passes the option through with no fallback, so it sends nothing. The CLI then takes `permissions.defaultMode` from the settings it loads (`settingSources: user, project, local`). The project `.claude/` is the one `restoreConfigFromBase` checks out from `origin/<PR base branch>`, which is not always the default branch. A `bypassPermissions` or `acceptEdits` there would let tools outside a lane's `--allowedTools` run. This PR pins `default`, not `auto`, because `auto` runs whatever its classifier approves, allowlisted or not. Everything else the review-ran and caller checks rely on is unchanged between the two SHAs: `src/github/token.ts`, `action.yml` and `src/entrypoints/post-buffered-inline-comments.ts` are byte-identical, `base-action/src/parse-sdk-options.ts` is identical, and `src/entrypoints/run.ts` differs only in the bundled CLI version string (2.1.276 → 2.1.300). No lane uses that CLI: `installClaudeCode` returns early when `path_to_claude_code_executable` is set. Agent mode only prepends `--mcp-config` to `claude_args`, and 0.3.300's extraArgs serializer emits `--permission-mode default` as two argv words, exactly what 0.3.276 sent. ## Changes 1. All three `uses:` now point to `anthropics/claude-code-action@a26b07d8c778b0c43f64618e5fd29fd0f8af72e8 # v1.0.250` (SHA checked against the annotated tag `v1.0.250`). 2. `selftest/test_claude_review_ran_check.sh`: the header comment, the pin and the pass message all move to v1.0.250 / `a26b07d`. 3. `--permission-mode default` is added to `claude_args` in `claude-review.yml`, `claude-adversarial-review.yml` and `verifier-on-high-risk.yml`. The new `selftest/test_claude_lanes_permission_mode.py` hardcodes the expected lanes and the flag rather than reading them from the workflows. It parses `claude_args` the way the action does (`#` lines dropped, then split into shell words) and requires exactly one `--permission-mode default` per claude-code-action step, with no `--flag=value` form and no `--(allow-)dangerously-skip-permissions`. It also fails on any workflow or composite action that uses claude-code-action but isn't listed. It has 13 mutant negative controls: flag dropped, `auto`, `bypassPermissions`, no value, `=` form, misspelled, commented out, given twice, bypass flag added, unlisted new lane, unlisted composite, expected lane removed, step renamed away. 4. The pin comment in `claude-review.yml` is rewritten. The old hold reason ("later ones bundle Claude Code 2.1.277+, which the adversarial and verifier lanes would run") is stale, because every lane now runs its own pinned CLI. The comment now lists what a bump must re-check: the caller and review-ran check assumptions, the composite's step order, and the SDK's permission-mode default together with how `claude_args` reaches the CLI. ## Verification - TDD: the new selftest was RED before the change (each lane reported `claude_args carries --permission-mode 0 times`; 10 failed, 4 passed) and GREEN after (14 passed). As an on-disk negative control I set the adversarial lane to `--permission-mode auto`; the test failed with `--permission-mode is 'auto', not 'default'`, and passed again once the file was restored. - `uv sync && uv run --no-sync pytest -q`: 801 passed, 1 skipped (a pre-existing conditional skip), 9m37s. This includes every `.sh` selftest through `test_workflow_guards.py`. - `actionlint -color -shellcheck=` (1.7.12, the CI pin): clean. - `ruff check tests` and `ruff format --check tests` (0.15.10, CI's scope): clean. `ruff check .`: clean. - `shellcheck -S error` over all 56 `.sh` scripts: clean. Supersedes #282 (left open for the owner to close). Codex rounds: 2 - Round 1 (`codex review --uncommitted`): 0 findings. - Round 2 (`codex review --uncommitted`): 0 findings. Auto-merge rationale: never — ci-workflows PRs are always manual click-merge; .github/workflows high-risk. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Owner
Contributor
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
dependabot
Bot
deleted the
dependabot/github_actions/claude-code-action-5c78c4a289
branch
October 17, 2026 22:13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the claude-code-action group with 1 update in the / directory: anthropics/claude-code-action.
Updates
anthropics/claude-code-actionfrom 1.0.229 to 1.0.250Release notes
Sourced from anthropics/claude-code-action's releases.
... (truncated)
Commits
a26b07dchore: bump Claude Code to 2.1.300 and Agent SDK to 0.3.30034968b5chore: bump Claude Code to 2.1.299 and Agent SDK to 0.3.2991d6de8cchore: bump Claude Code to 2.1.296 and Agent SDK to 0.3.2962dca132chore: bump Claude Code to 2.1.295 and Agent SDK to 0.3.29538c80c1chore: bump Claude Code to 2.1.294 and Agent SDK to 0.3.2946fed3cachore: bump Claude Code to 2.1.293 and Agent SDK to 0.3.2935898584chore: bump Claude Code to 2.1.292 and Agent SDK to 0.3.29286d88e6chore: bump Claude Code to 2.1.291 and Agent SDK to 0.3.2916c69018chore: bump Claude Code to 2.1.290 and Agent SDK to 0.3.290cab360fchore: bump Claude Code to 2.1.289 and Agent SDK to 0.3.289