From 2d6fa8b2cf576920a0d492dd65afd5de2bb919b6 Mon Sep 17 00:00:00 2001 From: abir-vim Date: Mon, 20 Jul 2026 12:33:14 +0300 Subject: [PATCH] chore(security): pin claude-code-action to known-good v1.0.174 --- .github/workflows/security.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 0f289ca..764cfc9 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -150,7 +150,10 @@ jobs: - name: Claude security scan (attempt 1) id: scan1 continue-on-error: true - uses: anthropics/claude-code-action@v1 + # Pinned to the last known-good release. The floating @v1 tag regressed in v1.0.175+: + # on Bedrock with a direct `prompt` the action no-ops after the trigger check (never + # installs/runs Claude Code, writes no findings.json), which fails the gate closed. + uses: anthropics/claude-code-action@12531344451323133b0493233c759991ac61da12 # v1.0.174 (Claude Code 2.1.210) env: GH_TOKEN: ${{ github.token }} PR_NUMBER: ${{ github.event.pull_request.number }} @@ -184,7 +187,8 @@ jobs: id: scan2 if: steps.check1.outputs.complete != 'true' continue-on-error: true - uses: anthropics/claude-code-action@v1 + # Pinned — see the note on attempt 1 above (floating @v1 regressed on Bedrock+prompt). + uses: anthropics/claude-code-action@12531344451323133b0493233c759991ac61da12 # v1.0.174 (Claude Code 2.1.210) env: GH_TOKEN: ${{ github.token }} PR_NUMBER: ${{ github.event.pull_request.number }}