chore(deps): update anthropics/claude-code-action action to v1.0.155

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
anthropics/claude-code-action	action	patch	v1.0.154 → v1.0.155	v1.0.159 (+3)

---

Release Notes

anthropics/claude-code-action (anthropics/claude-code-action)

v1.0.155

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

v1.0.155 contains 4 commits over v1.0.154:

• [Security Fix] TOCTOU protection for PR reviews and inline comments (#1385)
  PR review comments and inline review comments were previously not filtered by trigger timestamp, allowing content created or edited after an authorized trigger to be injected into Claude's prompt. This fix wires filterReviewsToTriggerTime into the returned reviewData, closing the TOCTOU window. This is a meaningful security hardening.

• [Bug Fix] Allow @ in branch names (#1411)
  validateBranchName incorrectly rejected branches with @ (e.g., TICKET-123@feature, @hotfix/...). Since git calls use execFileSync argv arrays (no shell interpolation), @ carries no injection risk. The bare name "@" and "@{" are still rejected. No impact on this repo.

• [Test Only] Coverage for format-turns content-type fallbacks (#1421)
  Adds unit tests only; no source changes to production code.

• [Chore] Bump Claude Code to 2.1.187 and Agent SDK to 0.3.187
  Internal dependency bumps; no interface changes.

No breaking changes. No new required inputs or configuration changes.

🎯 Impact Scope Investigation

The action is referenced in 2 places within .github/workflows/ci.yml:

Step	Job	Configuration
Review content with Claude (line 149)	Content review	claude_code_oauth_token, allowed_bots, prompt
Review code with Claude (line 239)	Code review	claude_code_oauth_token, allowed_bots, prompt

Both usages are pinned by full commit SHA (secure practice). The diff correctly updates both SHA pins from 30544b6... (v1.0.154) to 80b3182... (v1.0.155). No input/output interface changes affect the existing workflow configuration.

No other files in the repository reference this action.

💡 Recommended Actions

• No migration steps required.
• No code modifications needed.
• The security fix in this release (TOCTOU protection) is a positive reason to merge promptly, especially since this repository uses the action for automated PR reviews involving user-submitted content.

🔗 Reference Links

• Compare v1.0.154...v1.0.155
• Security fix PR #1385
• Branch name fix PR #1411

Generated by koki-develop/claude-renovate-review