fix(deps): update anthropics/claude-code-action action to v1.0.71

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
anthropics/claude-code-action	action	patch	v1.0.33 → v1.0.71	v1.0.72

---

Release Notes

anthropics/claude-code-action (anthropics/claude-code-action)

v1.0.71

Compare Source

What's Changed

• docs: warn that allowed_bots can expose the action to external triggers by @​an-dustin in #​1039
• feat(inline-comment): add confirmed param + probe-pattern safety net by @​km-anthropic in #​1048

New Contributors

• @​an-dustin made their first contribution in #​1039

Full Changelog: anthropics/claude-code-action@v1...v1.0.71

v1.0.70

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.70

v1.0.69

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.69

v1.0.68

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.68

v1.0.67

Compare Source

What's Changed

• Improve gh.sh wrapper: stricter validation and better error messages by @​OctavianGuzu in #​996

Full Changelog: anthropics/claude-code-action@v1...v1.0.67

v1.0.66

Compare Source

What's Changed

• Only expose permission_denials count in sanitized output by @​ddworken in #​993

Full Changelog: anthropics/claude-code-action@v1...v1.0.66

v1.0.65

Compare Source

What's Changed

• Change the default display_report option to false to restrict exposed data by @​ddworken in #​992

Full Changelog: anthropics/claude-code-action@v1...v1.0.65

v1.0.64

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.64

v1.0.63

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.63

v1.0.62

Compare Source

What's Changed

• Add gh.sh wrapper for gh CLI commands in issue triage workflows by @​OctavianGuzu in #​975

Full Changelog: anthropics/claude-code-action@v1...v1.0.62

v1.0.61

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.61

v1.0.60

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.60

v1.0.59

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.59

v1.0.58

Compare Source

What's Changed

• Add non-write users check workflow by @​OctavianGuzu in #​973

Full Changelog: anthropics/claude-code-action@v1...v1.0.58

v1.0.57

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.57

v1.0.56

Compare Source

What's Changed

• Use wrapper script for label operations in issue triage by @​OctavianGuzu in #​968

Full Changelog: anthropics/claude-code-action@v1...v1.0.56

v1.0.55

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.55

v1.0.54

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.54

v1.0.53

Compare Source

What's Changed

• fix: grant write permissions and use @​main in claude workflow by @​ashwin-ant in #​950
• feat: add display_report option to disable step summary by @​ashwin-ant in #​952

Full Changelog: anthropics/claude-code-action@v1...v1.0.53

v1.0.52

Compare Source

What's Changed

• Fix stale claudeCodeVersion and update bump script to keep run.ts in sync by @​ashwin-ant in #​943
• fix: revert to colon-based wildcard syntax for git permissions by @​ashwin-ant in #​949

Full Changelog: anthropics/claude-code-action@v1...v1.0.52

v1.0.51

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.51

v1.0.50

Compare Source

What's Changed

• revert: undo PR checkout fork support and unique branch naming by @​ashwin-ant in #​937

Full Changelog: anthropics/claude-code-action@v1...v1.0.50

v1.0.49

Compare Source

What's Changed

• fix: replace deprecated :* with modern * wildcard in git permissions by @​Dave-London in #​929
• fix: skip CI MCP server installation when actions:read permission is missing by @​OctavianGuzu in #​933
• Fix/PR checkout branch name conflicts by @​kirisame-wang in #​931

New Contributors

• @​OctavianGuzu made their first contribution in #​933
• @​kirisame-wang made their first contribution in #​931

Full Changelog: anthropics/claude-code-action@v1...v1.0.49

v1.0.48

Compare Source

What's Changed

• Fix PR checkout to support fork PRs by @​Tsuesun in #​851

New Contributors

• @​Tsuesun made their first contribution in #​851

Full Changelog: anthropics/claude-code-action@v1...v1.0.48

v1.0.47

Compare Source

What's Changed

• Update claude-opus-4-5 to claude-opus-4-6 in workflow by @​ashwin-ant in #​909
• fix: skip dev dependencies in CI install step by @​Dave-London in #​919

New Contributors

• @​Dave-London made their first contribution in #​919

Full Changelog: anthropics/claude-code-action@v1...v1.0.47

v1.0.46

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.46

v1.0.45

Compare Source

What's Changed

• fix: use original body from webhook payload for TOCTOU hardening by @​ddworken in #​904
• refactor: simplify mode system by removing Mode interface and registry by @​ashwin-ant in #​899

Full Changelog: anthropics/claude-code-action@v1...v1.0.45

v1.0.44

Compare Source

What's Changed

• refactor: unify action into single composite step with run.ts entrypoint by @​ashwin-ant in #​898

Full Changelog: anthropics/claude-code-action@v1...v1.0.44

v1.0.43

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.43

v1.0.42

Compare Source

What's Changed

• fix: pass OpenTelemetry environment variables to Claude Code subprocess by @​csy1204 in #​886
• fix: pass GitHub token to setup-bun to avoid rate limits by @​peloyeje in #​861

New Contributors

• @​csy1204 made their first contribution in #​886
• @​peloyeje made their first contribution in #​861

Full Changelog: anthropics/claude-code-action@v1...v1.0.42

v1.0.41

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.41

v1.0.40

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.40

v1.0.39

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.39

v1.0.38

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.38

v1.0.37

Compare Source

What's Changed

• feat: add actor-based comment filtering to GitHub data fetching by @​ranyhb in #​812
• Revert "Revert "feat: send additional_permissions in token exchange request"" by @​ashwin-ant in #​866
• Revert "chore: bump Claude Code to 2.1.21 and Agent SDK to 0.2.21" by @​ashwin-ant in #​869

New Contributors

• @​ranyhb made their first contribution in #​812

Full Changelog: anthropics/claude-code-action@v1...v1.0.37

v1.0.36

Compare Source

What's Changed

• Revert "feat: send additional_permissions in token exchange request" by @​ashwin-ant in #​864

Full Changelog: anthropics/claude-code-action@v1...v1.0.36

v1.0.35

Compare Source

What's Changed

• feat: send additional_permissions in token exchange request by @​ashwin-ant in #​859
• chore: upgrade checkout-action to v6 by @​arthur-mountain in #​862

New Contributors

• @​arthur-mountain made their first contribution in #​862

Full Changelog: anthropics/claude-code-action@v1...v1.0.35

v1.0.34

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.34

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

This update upgrades anthropics/claude-code-action from v1.0.33 to v1.0.71, spanning 38 patch releases over approximately 2 months. The update includes:

Major Improvements:

• Architecture Refactor (v1.0.44): Unified action into single composite step with run.ts entrypoint for improved maintainability
• Security Enhancements:
  • v1.0.45: TOCTOU (Time-of-Check-Time-of-Use) hardening using original webhook payload
  • v1.0.65: Changed default display_report to false to restrict data exposure
  • v1.0.66: Limited permission denial output to count only (prevents information leakage)
  • v1.0.67: Improved gh.sh wrapper with stricter validation and better error messages

New Features:

• v1.0.53: Added display_report option to control step summary visibility
• v1.0.62: Added gh.sh wrapper for gh CLI commands in issue triage workflows
• v1.0.71: Added inline comment confirmed parameter and probe-pattern safety net

Bug Fixes:

• v1.0.52: Reverted to colon-based wildcard syntax for git permissions
• v1.0.50: Reverted PR checkout fork support to fix issues
• v1.0.49: Fixed CI MCP server installation when actions:read permission is missing
• v1.0.47: Fixed dev dependencies in CI install step

Documentation:

• v1.0.71: Added warning that allowed_bots can expose action to external triggers

No Breaking Changes: All releases are patch versions maintaining backward compatibility

🎯 Impact Scope Investigation

Current Usage in Codebase:

• This repository uses anthropics/claude-code-action/base-action in action.yml:109
• The action is invoked with standard inputs: anthropic_api_key, claude_code_oauth_token, claude_args, settings, and prompt
• No usage of display_report option found (will use new default of false)
• No usage of allowed_bots configuration
• The repository doesn't use any deprecated features

Configuration Analysis:

• Current configuration uses claude-code-settings input (added in recent version, supported in target version)
• Uses standard allowed-tools configuration passed via claude_args
• GitHub token properly configured
• No custom permission configurations that would be affected

Impact Assessment:

• ✅ No API changes affecting current usage
• ✅ No input/output interface changes
• ✅ No configuration file modifications required
• ✅ All security improvements are transparent to this implementation
• ✅ The display_report default change to false won't affect this action (it doesn't rely on step summary, uses outputs instead)

💡 Recommended Actions

Immediate Actions:

1. ✅ Merge this PR - The update is safe and includes important security improvements
2. ✅ No code changes required - Current implementation is fully compatible

Post-Merge Validation:

1. Monitor the workflow run to confirm successful execution
2. Verify that PR comments are still being created correctly
3. Ensure safety-assessment output continues working as expected

Optional Considerations:

• This update brings significant security hardening (TOCTOU protection, permission denial sanitization)
• The architectural refactoring in v1.0.44 provides better maintainability
• No action required regarding allowed_bots warning (this action doesn't use that feature)

🔗 Reference Links

• v1.0.71 Release Notes
• Full Changelog v1.0.33...v1.0.71
• v1.0.65 Security Change
• v1.0.66 Permission Sanitization
• v1.0.44 Architecture Refactor

Generated by koki-develop/claude-renovate-review