Skip to content

fix(deps): update anthropics/claude-code-action action to v1.0.93 - #38

Merged
koki-develop merged 1 commit into
mainfrom
renovate/anthropics-claude-code-action-1.x
Apr 20, 2026
Merged

koki-develop merged 1 commit into
mainfrom
renovate/anthropics-claude-code-action-1.x

Conversation

@renovate

@renovate renovate Bot commented Jan 25, 2026 •

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change Pending
anthropics/claude-code-action action patch v1.0.33 → v1.0.93 v1.0.101 (+7)

Release Notes

anthropics/claude-code-action (anthropics/claude-code-action)

v1.0.93

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.93

v1.0.92

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.92

v1.0.91

Compare Source

What's Changed

Full Changelog: anthropics/claude-code-action@v1...v1.0.91

v1.0.90

Compare Source

What's Changed

  • fix: forward MCP_TIMEOUT, MCP_TOOL_TIMEOUT, MAX_MCP_OUTPUT_TOKENS to action step by @​qozle in #​1162
  • security: reject PATH_TO_CLAUDE_CODE_EXECUTABLE with control characters by @​qozle in #​1185

Full Changelog: anthropics/claude-code-action@v1...v1.0.90

v1.0.89

Compare Source

What's Changed

New Contributors

Full Changelog: anthropics/claude-code-action@v1...v1.0.89

v1.0.88

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.88

v1.0.87

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.87

v1.0.86

Compare Source

What's Changed

Full Changelog: anthropics/claude-code-action@v1...v1.0.86

v1.0.85

Compare Source

What's Changed

Full Changelog: anthropics/claude-code-action@v1...v1.0.85

v1.0.84

Compare Source

What's Changed

Full Changelog: anthropics/claude-code-action@v1...v1.0.84

v1.0.83

Compare Source

What's Changed

Full Changelog: anthropics/claude-code-action@v1...v1.0.83

v1.0.82

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.82

v1.0.81

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.81

v1.0.80

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.80

v1.0.79

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.79

v1.0.78

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.78

v1.0.77

Compare Source

Subprocess environment scrubbing for untrusted-input workflows

Workflows that configure allowed_non_write_users now automatically get CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1, which makes Claude Code (v2.1.79+) strip Anthropic and cloud provider credentials from the environment of subprocesses it spawns (Bash tool, hooks, MCP stdio servers). The parent Claude process keeps these vars for its own API calls — only child subprocess environments are scrubbed.

Why: Workflows that process untrusted input (issue triage, PR review from non-write users) are exposed to prompt injection. A malicious issue body could trick Claude into running a Bash command that reads $ANTHROPIC_API_KEY via shell expansion and leaks it through an observable side channel. Scrubbing the subprocess environment removes the read primitive entirely.

What's scrubbed: Anthropic auth tokens, cloud provider credentials, GitHub Actions OIDC and runtime tokens, OTEL auth headers.

What's kept: GITHUB_TOKEN / GH_TOKEN — so wrapper scripts can still call the GitHub API.

Opt out: Set CLAUDE_CODE_SUBPROCESS_ENV_SCRUB: "0" at the job or step level if your workflow legitimately needs a subprocess to inherit these credentials.

No action required for most users — if you've configured allowed_non_write_users, scrubbing is now on automatically. If your workflow breaks because a subprocess expected inherited credentials, re-inject them explicitly (e.g., via MCP server env: config) or use the opt-out.

What's Changed

Full Changelog: anthropics/claude-code-action@v1.0.76...v1.0.77

v1.0.76

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.76

v1.0.75

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.75

v1.0.74

Compare Source

What's Changed

Full Changelog: anthropics/claude-code-action@v1...v1.0.74

v1.0.73

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.73

v1.0.72

Compare Source

What's Changed

Full Changelog: anthropics/claude-code-action@v1...v1.0.72

v1.0.71

Compare Source

What's Changed

New Contributors

Full Changelog: anthropics/claude-code-action@v1...v1.0.71

v1.0.70

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.70

v1.0.69

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.69

v1.0.68

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.68

v1.0.67

Compare Source

What's Changed

Full Changelog: anthropics/claude-code-action@v1...v1.0.67

v1.0.66

Compare Source

What's Changed

Full Changelog: anthropics/claude-code-action@v1...v1.0.66

v1.0.65

Compare Source

What's Changed

  • Change the default display_report option to false to restrict exposed data by @​ddworken in #​992

Full Changelog: anthropics/claude-code-action@v1...v1.0.65

v1.0.64

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.64

v1.0.63

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.63

v1.0.62

Compare Source

What's Changed

Full Changelog: anthropics/claude-code-action@v1...v1.0.62

v1.0.61

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.61

v1.0.60

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.60

v1.0.59

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.59

v1.0.58

Compare Source

What's Changed

Full Changelog: anthropics/claude-code-action@v1...v1.0.58

v1.0.57

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.57

v1.0.56

Compare Source

What's Changed

Full Changelog: anthropics/claude-code-action@v1...v1.0.56

v1.0.55

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.55

v1.0.54

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.54

v1.0.53

Compare Source

What's Changed

Full Changelog: anthropics/claude-code-action@v1...v1.0.53

v1.0.52

Compare Source

What's Changed

Full Changelog: anthropics/claude-code-action@v1...v1.0.52

v1.0.51

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.51

v1.0.50

Compare Source

What's Changed

Full Changelog: anthropics/claude-code-action@v1...v1.0.50

v1.0.49

Compare Source

What's Changed

New Contributors

Full Changelog: anthropics/claude-code-action@v1...v1.0.49

v1.0.48

Compare Source

What's Changed

New Contributors

Full Changelog: anthropics/claude-code-action@v1...v1.0.48

v1.0.47

Compare Source

What's Changed
New Contributors

Full Changelog: anthropics/claude-code-action@v1...v1.0.47

v1.0.46

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.46

v1.0.45

Compare Source

What's Changed

Full Changelog: anthropics/claude-code-action@v1...v1.0.45

v1.0.44

Compare Source

What's Changed

Full Changelog: anthropics/claude-code-action@v1...v1.0.44

v1.0.43

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.43

v1.0.42

Compare Source

What's Changed
New Contributors

Full Changelog: anthropics/claude-code-action@v1...v1.0.42

v1.0.41

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.41

v1.0.40

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.40

v1.0.39

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.39

v1.0.38

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.38

v1.0.37

Compare Source

What's Changed

New Contributors

Full Changelog: anthropics/claude-code-action@v1...v1.0.37

v1.0.36

Compare Source

What's Changed

Full Changelog: anthropics/claude-code-action@v1...v1.0.36

v1.0.35

Compare Source

What's Changed

New Contributors

Full Changelog: anthropics/claude-code-action@v1...v1.0.35

v1.0.34

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.34


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions

github-actions Bot commented Jan 25, 2026 •

Copy link
Copy Markdown
Contributor

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

This update spans 60 patch versions (v1.0.33 → v1.0.93) with 115 commits. The changes are entirely within the v1.0.x line, maintaining backward compatibility. Key improvements include:

Security Enhancements:

  • v1.0.90: Security hardening for PATH_TO_CLAUDE_CODE_EXECUTABLE with control character rejection
  • v1.0.77: Automatic subprocess environment scrubbing for allowed_non_write_users workflows (strips Anthropic/cloud provider credentials from child processes)
  • v1.0.74: Security restore of .claude/ and .mcp.json from PR base branch before CLI execution
  • v1.0.72: Hardened tag mode tool permissions against prompt injection attacks
  • v1.0.62: Added gh.sh wrapper for GitHub CLI commands in issue triage workflows

Bug Fixes and Stability:

  • v1.0.89: Major bug fix release including:
    • Skip token revocation when no token was acquired
    • Fix ripgrep execute bits after bun install --production
    • Allow # in branch names for PR checkout
    • Prevent hang in restoreConfigFromBase on repos with .gitmodules
    • Snapshot PR's .claude/ to .claude-pr/ before security restore
  • v1.0.91: Use pinned bun binary for post-steps with allowed_non_write_users
  • v1.0.90: Forward MCP_TIMEOUT, MCP_TOOL_TIMEOUT, MAX_MCP_OUTPUT_TOKENS to action step
  • v1.0.86: Fix subprocess isolation install step and pass env to git calls
  • v1.0.85: Fall back to repo default_branch instead of hardcoded "main"

New Features:

  • v1.0.71: Add confirmed param for inline comments with probe-pattern safety net
  • v1.0.58: Add non-write users check workflow
  • v1.0.56: Use wrapper script for label operations in issue triage
  • v1.0.53: Add display_report option to disable step summary (default changed to false in v1.0.65)
  • v1.0.42: Pass OpenTelemetry environment variables to Claude Code subprocess
  • v1.0.37: Add actor-based comment filtering (include_comments_by_actor / exclude_comments_by_actor)

Architecture Changes:

  • v1.0.44: Major refactor unifying action into single composite step with run.ts entrypoint (maintains backward compatibility)
  • v1.0.49: Replace deprecated :* wildcard with modern * wildcard in git permissions

Version Pins:

  • v1.0.84: Pin Claude Code to version 2.1.87

🎯 Impact Scope Investigation

Current Usage in Codebase:
The action is used in a single location in action.yml:109:

- uses: anthropics/claude-code-action/base-action@b47fd721da662d48c5680e154ad16a73ed74d2e0 # v1.0.93

Usage Analysis:

  • Uses the base-action subpath of the action
  • Passes inputs: anthropic_api_key, claude_code_oauth_token, claude_args, settings, prompt
  • Expects outputs: structured_output, execution_file
  • The action configuration uses standard inputs that have remained stable

Compatibility Assessment:

  • All changes are patch-level updates within v1.0.x
  • No breaking changes to inputs/outputs interface
  • The base-action interface remains stable
  • Security enhancements are opt-in or backward compatible
  • The refactor in v1.0.44 maintained the same external interface

No Migration Required:

  • Current usage in action.yml doesn't use any deprecated features
  • The action doesn't configure allowed_non_write_users, so security changes don't affect behavior
  • No custom git permission patterns that would be affected by wildcard syntax changes
  • The display_report default change doesn't affect this action (it uses structured_output directly)

💡 Recommended Actions

Immediate Actions:

  • ✅ Safe to merge immediately - This is a straightforward dependency update with no breaking changes
  • ✅ No code modifications required - The action interface remains fully compatible

Post-Merge Verification:

  • Monitor the next workflow run to ensure the updated action executes successfully
  • Verify that Claude Code reviews continue to generate properly formatted reports
  • Check that the structured_output and execution_file outputs are still correctly populated

Optional Considerations:

  • Review the new security features (subprocess environment scrubbing, prompt injection hardening) for potential future use
  • Consider exploring the new display_report option if you want to control step summary visibility
  • Evaluate the new actor-based comment filtering features for future workflow enhancements

🔗 Reference Links

Generated by koki-develop/claude-renovate-review

@renovate
renovate Bot force-pushed the renovate/anthropics-claude-code-action-1.x branch from c19b46b to 5920814 Compare January 29, 2026 01:57
@renovate renovate Bot changed the title fix(deps): update anthropics/claude-code-action action to v1.0.34 fix(deps): update anthropics/claude-code-action action to v1.0.35 Jan 29, 2026
@renovate
renovate Bot force-pushed the renovate/anthropics-claude-code-action-1.x branch from 5920814 to abdb689 Compare January 29, 2026 06:08
@renovate renovate Bot changed the title fix(deps): update anthropics/claude-code-action action to v1.0.35 fix(deps): update anthropics/claude-code-action action to v1.0.36 Jan 29, 2026
@renovate
renovate Bot force-pushed the renovate/anthropics-claude-code-action-1.x branch from abdb689 to 363e62a Compare January 30, 2026 08:49
@renovate renovate Bot changed the title fix(deps): update anthropics/claude-code-action action to v1.0.36 fix(deps): update anthropics/claude-code-action action to v1.0.37 Jan 30, 2026
@renovate renovate Bot changed the title fix(deps): update anthropics/claude-code-action action to v1.0.37 fix(deps): update anthropics/claude-code-action action to v1.0.38 Jan 31, 2026
@renovate
renovate Bot force-pushed the renovate/anthropics-claude-code-action-1.x branch from 363e62a to e2ac981 Compare January 31, 2026 04:38
@renovate
renovate Bot force-pushed the renovate/anthropics-claude-code-action-1.x branch from e2ac981 to d838fa5 Compare January 31, 2026 21:13
@renovate renovate Bot changed the title fix(deps): update anthropics/claude-code-action action to v1.0.38 fix(deps): update anthropics/claude-code-action action to v1.0.39 Jan 31, 2026
@renovate
renovate Bot force-pushed the renovate/anthropics-claude-code-action-1.x branch from d838fa5 to 2dc923e Compare February 2, 2026 00:32
@renovate renovate Bot changed the title fix(deps): update anthropics/claude-code-action action to v1.0.39 fix(deps): update anthropics/claude-code-action action to v1.0.40 Feb 2, 2026
@renovate
renovate Bot force-pushed the renovate/anthropics-claude-code-action-1.x branch from 2dc923e to e069455 Compare February 3, 2026 00:58
@renovate renovate Bot changed the title fix(deps): update anthropics/claude-code-action action to v1.0.40 fix(deps): update anthropics/claude-code-action action to v1.0.41 Feb 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant