fix: pin claude-code-reusable.yml to SHA for action-pinning compliance

[don-petry]

Summary

• Pins petry-projects/.github/.github/workflows/claude-code-reusable.yml from @v1 to commit SHA ae9709f4466dec60a5733c9e7487f69dcd004e05 (v1) per the org action-pinning policy.
• The SHA was resolved by dereferencing the v1 annotated tag to its underlying commit.

Closes #155

Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@don-petry has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 57 minutes and 35 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 57 minutes and 35 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 361ee043-c640-4649-8941-a03e5e90844b

📥 Commits

Reviewing files that changed from the base of the PR and between a13e964 and 1bf98b0.

📒 Files selected for processing (1)

• .github/workflows/claude.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-155-20260414-1114

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Pins the org-level Claude Code reusable workflow reference in claude.yml to a specific commit SHA to comply with the action-pinning policy.

Changes:

• Updated the uses: reference from @v1 to @ae9709f4466dec60a5733c9e7487f69dcd004e05 (annotated as # v1) for action-pinning compliance.

[Copilot]

The header comment says you "MUST NOT change ... the uses: line", but this PR correctly updates the uses: ref to a pinned SHA. Consider updating that guidance to clarify that the workflow path must not change, but the ref may be updated when the org standard/pinning policy requires it, so future maintainers aren’t confused.

[don-petry]

Automated review — APPROVED

Risk: LOW
Reviewed commit: 1bf98b0e6bfaaf2ca7ab5f1faa7969a2cd06d0ce
Cascade: triage → deep (see triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6 for models)

Note: Formal GitHub approval could not be posted (cannot approve own PR). This comment serves as the review record.

Summary

This PR pins a reusable workflow reference from the mutable @v1 tag to the underlying commit SHA ae9709f4466dec60a5733c9e7487f69dcd004e05, which was verified to correctly dereference the v1 annotated tag. The change improves supply-chain security and satisfies the org's action-pinning compliance requirement (issue #155). The one CI failure (claude-code / claude) is in the workflow being modified and is unrelated to the correctness of the SHA pin; all security-relevant checks (CodeQL, SonarCloud, AgentShield, dependency-audit, build-and-test) pass.

Findings

Info

• ℹ️ .github/workflows/claude.yml — The 'claude-code / claude' check failed. This is the Claude Code automation workflow itself and the failure is unrelated to the correctness of the SHA pinning change. All other checks (CodeQL, SonarCloud, AgentShield, dependency audit, build-and-test, Node.js tests, Playwright) passed.
• ℹ️ .github/workflows/claude.yml:40 — The reusable workflow continues to use 'secrets: inherit', giving it access to all repository secrets. This was unchanged from before the PR and is not a regression; it is the expected configuration for this workflow.
• ℹ️ .github/workflows/claude.yml:39 — SHA ae9709f4466dec60a5733c9e7487f69dcd004e05 was independently verified as the commit object underlying the v1 annotated tag (tag object 208ec2d6 → commit ae9709f4). The PR description's claim about dereferencing the annotated tag is accurate.

CI status

All security-relevant checks pass (CodeQL, SonarCloud, AgentShield, dependency audit, build-and-test). One unrelated CI failure in claude-code / claude (the workflow being modified by this PR).

---

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[github-actions]

Auto-rebase blocked — the base branch contains .github/workflows/ changes that require the workflows permission to merge into this branch, but the auto-rebase workflow's token does not have that permission.

Please rebase this branch manually:

git fetch origin
git rebase origin/main
git push --force-with-lease

[petry-projects-pr-review-agent]

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[don-petry]

Closing as duplicate of #224 — same fix for issue #179. The newest attempt is kept open.