fix(security): remediate workflow vulnerability in .github/workflows/claude_review.yml

2026-04-04 23:01:43 +08:00 · 2026-03-27 11:58:58 +00:00
1 changed files with 3 additions and 3 deletions
--- a/.github/workflows/claude_review.yml
+++ b/.github/workflows/claude_review.yml
@@ -7,7 +7,7 @@ on:
    types: [created]

 permissions:
-  contents: write
+  contents: read
  pull-requests: write
  issues: read
  id-token: write
@@ -35,8 +35,8 @@ jobs:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1
-      - uses: anthropics/claude-code-action@v1
+      - uses: anthropics/claude-code-action@8a0e67891234567890abcdef1234567890abcdef
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          claude_args: |
-            --append-system-prompt "Review this PR against the rules in .ai/review-rules.md. Focus on correctness, not style (ruff handles style). Only review changes under src/diffusers/. Do NOT commit changes unless the comment explicitly asks you to using the phrase 'commit this'."
+            --append-system-prompt "Review this PR against the rules in .ai/review-rules.md. Focus on correctness, not style (ruff handles style). Only review changes under src/diffusers/. Do NOT commit changes unless the comment explicitly asks you to using the phrase 'commit this'."