fix(ci): pin claude-code-reusable.yml to SHA for action pinning compliance

[don-petry]

Summary

• Pins petry-projects/.github/.github/workflows/claude-code-reusable.yml from @v1 to its exact commit SHA (208ec2d69b75227d375edf8745d84fbac05a76b2) with # v1 comment for readability
• Resolves the unpinned-actions-claude.yml compliance finding from the weekly audit

Standard

ci-standards.md#action-pinning-policy

Closes #86

Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@don-petry has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 57 minutes and 51 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 57 minutes and 51 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: f95de83f-d150-40ee-b4f3-12bb365a56e8

📥 Commits

Reviewing files that changed from the base of the PR and between 256f909 and 5b12164.

📒 Files selected for processing (1)

• .github/workflows/claude.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-86-20260414-1313

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

@don-petry This PR is ready for your review. It pins the reusable workflow SHA to resolve the action-pinning compliance finding (#86).

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Pins the claude.yml reusable workflow reference to an immutable commit SHA to satisfy the repository’s action pinning compliance requirement and resolve issue #86.

Changes:

• Updated the reusable workflow uses: reference from @v1 to a full commit SHA.
• Added an inline # v1 comment to preserve human-readable version intent.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[don-petry]

Superseded by automated re-review at 5b12164653d36de631e071a82fd01d9c9e5e6d98 — click to expand prior review.

Automated review — APPROVED

Risk: LOW
Reviewed commit: 5b12164653d36de631e071a82fd01d9c9e5e6d98
Cascade: triage → deep (see triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6 for models)

Summary

This PR pins the reusable workflow reference in .github/workflows/claude.yml from a mutable @v1 tag to an immutable SHA, resolving compliance finding #86. All CI checks pass (CodeQL, SonarCloud, AgentShield), the SHA was verified to correctly correspond to the v1 tag in petry-projects/.github, and the change is a net security improvement. One minor finding: the pinned SHA is the annotated tag object SHA rather than the underlying commit SHA, but GitHub Actions resolves this correctly.

Findings

Info

• [info] .github/workflows/claude.yml:39 — The pinned SHA (208ec2d69b75227d375edf8745d84fbac05a76b2) is the annotated tag object SHA, not the underlying commit SHA (ae9709f4466dec60a5733c9e7487f69dcd004e05). GitHub Actions resolves annotated tag SHAs correctly, so this is functional, but tooling like Dependabot and security scanners prefer commit SHAs for true immutability pinning. Consider updating to the commit SHA in a follow-up.
• [info] .github/workflows/claude.yml:40 — The workflow passes 'secrets: inherit' to the SHA-pinned reusable workflow. This was pre-existing before this PR. By pinning to a SHA, the risk from this pattern is now reduced — the secrets will only flow to the exact version of code at that commit, not a potentially-updated mutable tag.

CI status

All CI checks pass (CodeQL, SonarCloud, AgentShield) per the deep-review verdict.

---

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[github-actions]

Auto-rebase blocked — the base branch contains .github/workflows/ changes that require the workflows permission to merge into this branch, but the auto-rebase workflow's token does not have that permission.

Please rebase this branch manually:

git fetch origin
git rebase origin/main
git push --force-with-lease

[petry-projects-pr-review-agent]

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[petry-projects-pr-review-agent]

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[donpetry-bot]

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[github-actions]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved manually.

Please resolve the conflicts and push:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

@dev-lead - please fix this PR

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 5b12164653d36de631e071a82fd01d9c9e5e6d98
Review mode: triage-approved (single reviewer)

Summary

Single-line change in .github/workflows/claude.yml pinning the reusable workflow petry-projects/.github/.github/workflows/claude-code-reusable.yml from the mutable @v1 tag to commit SHA 208ec2d69b75227d375edf8745d84fbac05a76b2 with a # v1 comment for readability. This is a net security improvement and exactly matches the remediation requested by the compliance audit. Confirming the triage tier's low-risk assessment.

Linked issue analysis

Closes #86 — a compliance-audit finding (unpinned-actions-claude.yml, severity error) flagging the unpinned @v1 reference. The change directly addresses the finding by pinning to a SHA per the action-pinning policy. The issue is already closed.

Findings

None. The diff is +1/-1, the SHA format with trailing # v1 comment matches the convention recommended by the standard, and no other lines in the workflow were touched.

CI status

All required checks pass: AgentShield ✓, CodeQL (actions + python) ✓, SonarCloud ✓, CodeRabbit ✓, Dependency audit ✓. Note: the PR currently has merge conflicts with main (mergeStateStatus: DIRTY) — this is a rebase concern for the author, not a review blocker.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.

[don-petry]

Closing due to merge conflict that cannot be auto-rebased. Re-implementing from fresh main via dev-lead.