chore(deps): bump claude-code-action to v1.0.133 and model versions

[wkoutre]

Summary

Maintenance pass on Claude Code Action workflows. Applies three classes of edit atomically:

• claude-code-action: v1.0.133 (787c5a0) — see https://github.com/anthropics/claude-code-action/releases/tag/v1.0.133
• ai-toolkit reusable workflows: 27e7e2d (Uniswap/ai-toolkit next HEAD)
• Models:
  • haiku → claude-haiku-4-5-20251001
  • opus → claude-opus-4-8
  • sonnet → claude-sonnet-4-6

Per-file changes

.github/workflows/_claude-code-review.yml

• SHA bump anthropics/claude-code-action: 476e359 → 787c5a0 (v1.0.133)
• SHA bump anthropics/claude-code-action: 476e359 → 787c5a0 (v1.0.133)

.github/workflows/_claude-docs-check.yml

• SHA bump anthropics/claude-code-action: 476e359 → 787c5a0 (v1.0.133)
• SHA bump anthropics/claude-code-action: 476e359 → 787c5a0 (v1.0.133)

.github/workflows/_claude-main.yml

• SHA bump anthropics/claude-code-action: 476e359 → 787c5a0 (v1.0.133)
• Model bump: claude-opus-4-7 → claude-opus-4-8
• Model bump: claude-haiku-4-5 → claude-haiku-4-5-20251001

.github/workflows/_claude-task-worker.yml

• SHA bump anthropics/claude-code-action: 476e359 → 787c5a0 (v1.0.133)
• Model bump: claude-opus-4-7 → claude-opus-4-8
• Model bump: claude-haiku-4-5 → claude-haiku-4-5-20251001
• Model bump: claude-opus-4-7 → claude-opus-4-8

.github/workflows/_generate-pr-metadata.yml

• SHA bump anthropics/claude-code-action: 476e359 → 787c5a0 (v1.0.133)
• SHA bump anthropics/claude-code-action: 476e359 → 787c5a0 (v1.0.133)
• Breaking-change auto-fix: removed deprecated input allowed_tools (no longer in anthropics/claude-code-action at the new SHA)
• Model bump: claude-opus-4-7 → claude-opus-4-8
• Model bump: claude-haiku-4-5 → claude-haiku-4-5-20251001

.github/workflows/_update-action-versions-worker.yml

• SHA bump anthropics/claude-code-action: 476e359 → 787c5a0 (v1.0.133)

.github/workflows/dev-ai-newsletter.yml

• SHA bump anthropics/claude-code-action: 476e359 → 787c5a0 (v1.0.133)
• Model bump: claude-opus-4-7 → claude-opus-4-8

Opened by the sync-claude-code-action maintenance job. The job runs weekly and bumps SHAs + applies known migrations; review the diff before merging.

AI-Generated Description

Summary

Maintenance pass on the Claude Code Action workflows. Bumps the pinned anthropics/claude-code-action SHA, updates Claude model identifiers, and drops one deprecated input. No behavioral changes beyond the version/model upgrades.

Changes

• anthropics/claude-code-action: 476e359 (v1.0.119) → 787c5a0 (v1.0.133) across all 7 workflows
• Model bumps:
  • claude-opus-4-7 → claude-opus-4-8
  • claude-haiku-4-5 → claude-haiku-4-5-20251001
• Deprecated input removed: dropped allowed_tools from the quality-gate step in _generate-pr-metadata.yml (no longer supported at the new action SHA)

Per-file detail

• .github/workflows/_claude-code-review.yml — action SHA bump (×2)
• .github/workflows/_claude-docs-check.yml — action SHA bump (×2)
• .github/workflows/_claude-main.yml — action SHA bump; opus/haiku model bumps in the model input docs
• .github/workflows/_claude-task-worker.yml — action SHA bump; opus/haiku model bumps in input docs; model default claude-opus-4-7 → claude-opus-4-8
• .github/workflows/_generate-pr-metadata.yml — action SHA bump (×2); model default → claude-opus-4-8; quality-gate claude_args model → claude-haiku-4-5-20251001; removed deprecated allowed_tools input
• .github/workflows/_update-action-versions-worker.yml — action SHA bump
• .github/workflows/dev-ai-newsletter.yml — action SHA bump; opus model choice claude-opus-4-7 → claude-opus-4-8

Notes

Opened by the sync-claude-code-action maintenance job, which runs weekly to bump SHAs and apply known migrations. Review the diff before merging.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ai-toolkit-slack-oauth-backend	Ready	Preview, Comment	Jun 17, 2026 5:09pm

[github-actions]

🤖 Claude Code Review

✅ Review complete

Summary

This PR bumps anthropics/claude-code-action from v1.0.119 to v1.0.133 across 6 workflows, updates model identifiers (claude-opus-4-7 → claude-opus-4-8, claude-haiku-4-5 → claude-haiku-4-5-20251001), and migrates the quality-gate step's tool allowlist into claude_args to match the newer action's input contract.

Re-Review of Existing Threads

Thread on _claude-main.yml:82 — claude-opus-4-8 model identifier

Status: still unresolved. Per the runtime model registry available to me, the most recent Opus identifier is claude-opus-4-7. There is no claude-opus-4-8 in the known model family, and the asymmetric treatment of Haiku (now claude-haiku-4-5-20251001, a dated form) versus Opus (an unversioned -4-8 alias) is a strong signal that something is off — either the bump skipped a version, or the alias needs to be a dated identifier as well.

This defaults to a non-routable ID in two downstream consumers (_claude-task-worker.yml:121 default and _generate-pr-metadata.yml:47 default), so the failure mode is silent until a workflow run actually invokes the action. Recommend confirming with the model availability docs / Anthropic console before merging, and rolling back to claude-opus-4-7 (or correcting to the proper dated form) if 4.8 is not yet GA.

Thread on _generate-pr-metadata.yml quality-gate step — allowed_tools removal

Status: addressed. The diff at line 166 now passes --allowed-tools Read,Write inside claude_args, preserving the prompt-injection defense-in-depth boundary that the original allowed_tools: [Read, Write] provided. Since the input the step processes (/tmp/pr-description-user.txt) is attacker-controlled PR-author content, retaining the allowlist matters; the fix here exactly matches the suggested mitigation.

Other Observations

No new blocking issues in the action-version bump itself — the SHA pin format is correct and consistent across all 7 occurrences. The remaining risk is concentrated in the model-ID change.

Verdict

Holding at COMMENT until the claude-opus-4-8 identifier is confirmed valid (or corrected). The security concern is resolved cleanly, but a non-routable default model would cause silent runtime failures in three workflows.

---

_{💡 Want a fresh review? Add a comment containing @request-claude-review to trigger a new review at any time.}

[github-actions]

📚 Documentation Check ✅

Verdict: Passed

All changes are workflow maintenance updates (action version bumps, model name renames, and a minor API parameter migration). No plugin files were modified, so no version bump is required. No structural documentation changes are needed.

---

PR #527 Documentation Check

This PR performs routine maintenance across 7 GitHub Actions workflow files:

1. Action version bump: anthropics/claude-code-action updated from v1.0.119 → v1.0.133 across all workflows.
2. Model name updates: claude-opus-4-7 → claude-opus-4-8 and claude-haiku-4-5 → claude-haiku-4-5-20251001 in workflow dispatch inputs and defaults.
3. Parameter migration in _generate-pr-metadata.yml: allowed_tools YAML key merged into claude_args as --allowed-tools Read,Write.

No plugin files modified — the plugin version bump requirement does not apply.

No structural changes — no new functions, APIs, or features introduced that would require CLAUDE.md or README updates.

The model name changes are self-documented within the workflow files themselves (in description fields of workflow_dispatch inputs). No external documentation is impacted.

✨ No Documentation Updates Needed

All documentation appears to be up to date with the code changes.

---

_{🤖 Generated by Claude Documentation Validator | Mode: suggest}

[github-actions]

📋 Review verdict: COMMENT

👆 The main review comment above is the source of truth for this PR review. It is automatically updated on each review cycle, so always refer to it for the most current feedback.

This formal review submission is for the verdict only. 2 inline comment(s) are attached below.

[github-actions]

📋 Review verdict: COMMENT

👆 The main review comment above is the source of truth for this PR review. It is automatically updated on each review cycle, so always refer to it for the most current feedback.

This formal review submission is for the verdict only.