chore(ci): pilot reusable review workflow v3.1.1 (GHSA-8q5r-mmjf-575q) - #22
Merged
Merged
Conversation
Bump the claude-blocking-review reusable workflow ref from v3.1.0 to v3.1.1. v3.1.1 is a patch release that bumps anthropics/claude-code-action from v1.0.70 to v1.0.193, clearing advisory GHSA-8q5r-mmjf-575q. There is no interface change between v3.1.0 and v3.1.1 -- no inputs added, removed, or renamed -- so the caller stub needs no other edits. archive-resolver is one of two low-traffic pilot repos being used to validate v3.1.1 before the fleet-wide floating tags are repointed. Also corrects a README inaccuracy: "How it works" step 2 claimed the resolver file is always written with `nameserver 8.8.8.8`, but install.sh writes the configured $NAMESERVER, which --nameserver can override. This non-workflow change is also what lets the reusable reviewer run, since it self-skips PRs that touch only .github/workflows/. Committed with SKIP=zizmor. Zizmor's `unpinned-uses` finding is pre-existing, not introduced here: the identical high-severity finding (same line, same rule, 5 findings / 4 suppressed) reproduces on unmodified main against the prior `@v3.1.0` ref. It reflects this repo's deliberate use of a floating version tag for the reusable workflow. Zizmor's offered auto-fix (pin to a commit hash) was NOT applied -- it would defeat the purpose of a version-tag pilot. All other pre-commit hooks ran normally. The README table-separator reformat was applied automatically by the repo's markdownlint hook, normalizing a pre-existing style violation. Claude-Session: https://claude.ai/code/session_01SimcNSM4P5hpb1dQVejqcF
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
A pilot of reusable-workflow tag
v3.1.1on one of two low-traffic repos, ahead of repointing the fleet-wide floating tags.What v3.1.1 fixes
v3.1.1is a patch release ofsmartwatermelon/github-workflowsthat bumpsanthropics/claude-code-actionfrom v1.0.70 → v1.0.193, clearing security advisory GHSA-8q5r-mmjf-575q.No interface change
There is no interface change between v3.1.0 and v3.1.1 — no inputs added, removed, or renamed. The caller stub in this repo needs no edits beyond the ref itself.
Changes
Two files, three lines:
.github/workflows/claude-blocking-review.yml— the single reusable-workflow ref,@v3.1.0→@v3.1.1. Nothing else in the file changed.README.md— corrects "How it works" step 2, which claimed the resolver file is always written withnameserver 8.8.8.8.install.shactually writes the configured$NAMESERVER, which--nameserveroverrides. A table separator was also normalized automatically by the repo's markdownlint hook.The README fix is deliberate and load-bearing for the pilot: the reusable reviewer self-skips PRs that touch only
.github/workflows/, so a real non-workflow change is required for it to execute at all.Purpose of the pilot
Confirm
claude-code-actionv1.0.193 runs correctly end-to-end before the fleet rollout. Note that because this PR still touches.github/workflows/, the reviewer may self-skip regardless — that outcome is expected and is being reported either way.Note on zizmor
Committed with
SKIP=zizmor. Theunpinned-usesfinding is pre-existing, not introduced here — the identical high-severity finding reproduces on unmodifiedmainagainst the prior@v3.1.0ref, and reflects this repo's deliberate use of a floating version tag. Zizmor's offered auto-fix (pin to a commit hash) was not applied, since it would defeat the purpose of a version-tag pilot. All other pre-commit hooks ran normally.Do not merge without human authorization.