CI: pin anthropics/claude-code-base-action@beta to a full commit SHA in ai-review-analysis.yml

Open Beginner friendly

#14,936 opened on Jul 14, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 2/5
Estimated time: 1-3 hours
Newbie friendliness: 78/100

Issue type: Refactor
Clarity: Clearly specified
Activity status: Quiet
Tech stack: github-actions
Domain: ci-cd, security

Research direction

Open .github/workflows/ai-review-analysis.yml and inspect every third-party action reference, starting with anthropics/claude-code-base-action@beta. Use the reported gh api tag lookup to identify the current commit and verify each replacement is a full SHA. Done means the mutable action references are pinned and the workflow remains valid.

Written by the indexing model from the issue text.

Description

Summary

.github/workflows/ai-review-analysis.yml references anthropics/claude-code-base-action@beta in several steps, each passing anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}. @beta is a mutable lightweight tag (the maintainer can re-point it at any time), and this reusable workflow is invoked from claude-review.yml on pull_request_target / issue_comment with secrets: inherit.

Why it's worth pinning

Because @beta is mutable, the exact code that runs with ANTHROPIC_API_KEY (and the other provider keys in scope) can change without any change in this repo — the third-party-action supply-chain risk (the 2025 tj-actions/changed-files incident is the reference case). GitHub's hardening guidance is to pin third-party actions to a full commit SHA and let Dependabot bump it.

I noticed you're already hardening this exact workflow in #14796 (sandbox flags, secret filtering, trimming allowed_tools) — this is meant as a small complement to that effort, not a separate concern: pinning claude-code-base-action (and any other third-party actions here) to full SHAs would close the mutable-ref gap too.

Vehicle

Raising as an issue since PRs here require the Meta CLA; happy to send a PR if you'd prefer and point me at the CLA.

Reproduction: gh api repos/anthropics/claude-code-base-action/git/refs/tags/beta --jq .object.type → commit (a mutable tag, not a pinned SHA). I used AI assistance to investigate and draft this; I reproduced the facts myself.

Dominant language: C++
Stars: 32.1k
Forks: 6.9k
PR merge metrics: No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

[Bug] NULL pointer dereference in llm_running_callback (NGZA-AX-LLM #3) Open

Difficulty 1/5 Under an hour Newbie friendliness 90/100

AXERA-TECH/ax-llm#77 · Opened Sep 22, 2026
resume() sends a second HTTP response (400) after a successful resume Open

Difficulty 1/5 Under an hour Newbie friendliness 90/100

games-on-whales/wolf#509 · Opened Sep 21, 2026
pn7160: reader goes permanently deaf — post-read IRQ-low check fails reads that succeeded Open

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

esphome/esphome#19452 · Opened Sep 21, 2026
Eval bug: Ministral-3 tool-calls during reasoning are not processed Open

bug-unconfirmed

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

ggml-org/llama.cpp#29248 · Opened Sep 21, 2026
run_tests.py fails on windows, but running tests individually works Open

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

NVIDIA/cuda-samples#453 · Opened Sep 21, 2026

More C++ issues