chore(deps): maintain Claude Code Action workflows (cca=v1.0.185, ait=c4820d6) by wkoutre · Pull Request #488 · Uniswap/universal-router

wkoutre · 2026-06-01T16:07:08Z

Summary

Maintenance pass on Claude Code Action workflows. Applies three classes of edit atomically:

claude-code-action: v1.0.133 (787c5a0) — see https://github.com/anthropics/claude-code-action/releases/tag/v1.0.133
ai-toolkit reusable workflows: 27e7e2d (Uniswap/ai-toolkit next HEAD)
Models:
- haiku → claude-haiku-4-5-20251001
- opus → claude-opus-4-8
- sonnet → claude-sonnet-4-6

Per-file changes

`.github/workflows/claude-code-review.yml`

SHA bump Uniswap/ai-toolkit/.github/workflows/_claude-code-review.yml: 96ef665 → 27e7e2d
Breaking-change auto-fix: removed deprecated input custom_prompt_path (no longer in Uniswap/ai-toolkit/.github/workflows/_claude-code-review.yml at the new SHA)
Model bump: claude-opus-4-6 → claude-opus-4-8

`.github/workflows/claude-pr-metadata-update.yml`

SHA bump Uniswap/ai-toolkit/.github/workflows/_generate-pr-metadata.yml: 96ef665 → 27e7e2d

Opened by the sync-claude-code-action maintenance job. The job runs weekly and bumps SHAs + applies known migrations; review the diff before merging.

AI-Generated Description

Summary

Maintenance pass on the Claude Code Action caller workflows. Bumps the pinned Uniswap/ai-toolkit reusable-workflow SHA, bumps the review model, and drops an input that no longer exists in the reusable at the new SHA.

ai-toolkit reusable workflows: 96ef665 → c4820d6
Review model: claude-opus-4-6 → claude-opus-5

Per-file changes

`.github/workflows/claude-code-review.yml`

SHA bump uses: Uniswap/ai-toolkit/.github/workflows/_claude-code-review.yml: 96ef665 → c4820d6
Removed input custom_prompt_path: '.claude/prompts/claude-pr-review.md' (no longer accepted by the reusable at the new SHA)
Model bump: claude-opus-4-6 → claude-opus-5

`.github/workflows/claude-pr-metadata-update.yml`

SHA bump uses: Uniswap/ai-toolkit/.github/workflows/_generate-pr-metadata.yml: 96ef665 → c4820d6

Notes for reviewers

toolkit_ref was not bumped in lockstep. In claude-code-review.yml, uses: now points at c4820d6 but toolkit_ref: remains 96ef665. The reusable uses toolkit_ref to fetch supporting scripts at runtime, so this leaves a cross-version skew between the workflow body and its scripts. fix(ci): bump ai-toolkit reusable workflows past #453 RCE hardening #479 bumped both together on purpose — confirm this skew is intended before merging.
.claude/prompts/claude-pr-review.md still exists in the repo but is no longer referenced now that custom_prompt_path is dropped. It can likely be removed in a follow-up if the reusable no longer supports a custom review prompt.
Opened by the sync-claude-code-action maintenance job. The job runs weekly and bumps SHAs + applies known migrations; review the diff before merging.

…=27e7e2d)

github-actions · 2026-06-01T16:08:10Z

🤖 Claude Code Review

✅ Review complete

Summary

Maintenance bump of the two Uniswap/ai-toolkit reusable-workflow pins from 96ef665 → c4820d6, plus a model change to claude-opus-5 and removal of custom_prompt_path. No application code touched.

Re-review status: both prior findings still unresolved

The PR was force-updated (previous review saw 9b405c7, head is now c4820d6), but neither issue from the last pass was addressed.

1. Pin split inside claude-code-review.yml (unchanged)

line 24:  uses: ..._claude-code-review.yml@c4820d6e62a9488c831e722aac202733fafab5dd
line 29:  toolkit_ref: 96ef665ba04221de07e94fcc3ea69fe32c7cf306

The reusable workflow now executes at c4820d6 while checking out its toolkit assets (prompts, scripts, agent config) from 96ef665. claude-pr-metadata-update.yml:39 moved to c4820d6 cleanly, so this repo is now running two different toolkit revisions in the same PR pipeline. That's valid if intentional, but the asymmetry — one file fully bumped, the other half bumped — reads as an oversight, and version skew between workflow logic and the assets it consumes is exactly the kind of thing that fails opaquely (e.g. workflow expects an input or file layout the old ref doesn't provide). Either bump toolkit_ref to match, or add a comment explaining why it's held back so the next automated maintenance pass doesn't flip it blindly.

2. .claude/prompts/claude-pr-review.md is now orphaned (unchanged)

custom_prompt_path was dropped from line 30, but the file is still in the tree:

$ ls .claude/prompts/
claude-pr-review.md   (5.7 KB)

$ grep -rn "claude-pr-review.md\|custom_prompt_path" .github/ .claude/
(no matches)

Nothing references it, so reviews now run on the toolkit default prompt. Two coherent end states: delete the file, or restore the input if that repo-specific guidance was still meant to apply. Leaving it in place means a future reader will reasonably assume it's live when it isn't.

Not flagged

model: 'claude-opus-5' is a valid alias and consistent with the intent of the bump.

Verdict rationale

No bugs or security issues in the changed lines, but this is a two-line maintenance PR where both previously-raised items are still open and one is a live version-skew inconsistency. Using COMMENT rather than APPROVE so the toolkit_ref decision gets an explicit answer before merge.

_{💡 Want a fresh review? Add a comment containing @request-claude-review to trigger a new review at any time.}

github-actions

📋 Review verdict: APPROVE

👆 The main review comment above is the source of truth for this PR review. It is automatically updated on each review cycle, so always refer to it for the most current feedback.

This formal review submission is for the verdict only.

…=9b405c7)

wkoutre · 2026-08-03T15:15:31Z

Refreshed pin to v1.0.183 (be7b93b), ai-toolkit 9b405c7, models {"opus": "claude-opus-5", "sonnet": "claude-sonnet-5", "haiku": "claude-haiku-4-5-20251001"} on 2026-08-03.

Superseded by new review after PR update

github-actions

📋 Review verdict: APPROVE

👆 The main review comment above is the source of truth for this PR review. It is automatically updated on each review cycle, so always refer to it for the most current feedback.

This formal review submission is for the verdict only. 2 inline comment(s) are attached below.

github-actions · 2026-08-03T15:17:34Z

      )

-    uses: Uniswap/ai-toolkit/.github/workflows/_claude-code-review.yml@96ef665ba04221de07e94fcc3ea69fe32c7cf306
+    uses: Uniswap/ai-toolkit/.github/workflows/_claude-code-review.yml@9b405c71e42d0cec4026f2c158edf99716600baa


The uses: pin moves to 9b405c7, but toolkit_ref just below (line 29) stays on 96ef665. That means the reusable workflow executes at the new revision while checking out toolkit assets from the old one.

That's a legitimate configuration, but since every other pin in this PR moved in lockstep it looks unintentional. If this is a full bump, update toolkit_ref too; if the older assets are needed on purpose, add a brief comment so the next maintenance pass doesn't change it blindly.

Suggested change

uses: Uniswap/ai-toolkit/.github/workflows/_claude-code-review.yml@9b405c71e42d0cec4026f2c158edf99716600baa

uses: Uniswap/ai-toolkit/.github/workflows/_claude-code-review.yml@9b405c71e42d0cec4026f2c158edf99716600baa

with:

pr_number: ${{ github.event.pull_request.number }}

base_ref: ${{ github.base_ref }}

force_review: false

toolkit_ref: 9b405c71e42d0cec4026f2c158edf99716600baa

Still unresolved on the current head. The pin has since moved from 9b405c7 to c4820d6, but toolkit_ref on line 29 is still 96ef665, so the mismatch I originally flagged is unchanged:

line 24: uses: ..._claude-code-review.yml@c4820d6e62a9488c831e722aac202733fafab5dd line 29: toolkit_ref: 96ef665ba04221de07e94fcc3ea69fe32c7cf306

claude-pr-metadata-update.yml:39 did move to c4820d6, which makes this the only pin left behind. Either bump it to match, or add a short comment recording that the older assets are intentional.

Suggested change

uses: Uniswap/ai-toolkit/.github/workflows/_claude-code-review.yml@9b405c71e42d0cec4026f2c158edf99716600baa

toolkit_ref: c4820d6e62a9488c831e722aac202733fafab5dd

github-actions · 2026-08-03T15:17:34Z

-      custom_prompt_path: '.claude/prompts/claude-pr-review.md'
-
-      model: 'claude-opus-4-6'
+      model: 'claude-opus-5'


Dropping custom_prompt_path leaves .claude/prompts/claude-pr-review.md (182 lines of repo-specific review guidance) orphaned in the tree — nothing references it anymore, and reviews now use the toolkit default prompt. Delete that file as part of this PR, or keep the input if the custom guidance was still intended to apply.

Still unresolved. custom_prompt_path remains removed and .claude/prompts/claude-pr-review.md (5.7 KB) is still present with no references anywhere:

$ grep -rn "claude-pr-review.md|custom_prompt_path" .github/ .claude/ (no matches)

Reviews are running on the toolkit default prompt while the repo-specific prompt sits orphaned in the tree. Delete the file, or restore the input if that guidance was still intended to apply.

…=c4820d6)

wkoutre · 2026-08-05T18:30:09Z

Refreshed pin to v1.0.185 (9db594c), ai-toolkit c4820d6, models {"opus": "claude-opus-5", "sonnet": "claude-sonnet-5", "haiku": "claude-haiku-4-5-20251001"} on 2026-08-05.

Superseded by new review after PR update

github-actions

📋 Review verdict: COMMENT

👆 The main review comment above is the source of truth for this PR review. It is automatically updated on each review cycle, so always refer to it for the most current feedback.

This formal review submission is for the verdict only.

chore(deps): maintain Claude Code Action workflows (cca=v1.0.133, ait…

151beb5

…=27e7e2d)

wkoutre requested a review from a team as a code owner June 1, 2026 16:07

github-actions Bot previously approved these changes Jun 1, 2026

View reviewed changes

wkoutre requested review from ccashwell and ciamac June 23, 2026 18:20

chore(deps): maintain Claude Code Action workflows (cca=v1.0.183, ait…

d699f71

…=9b405c7)

github-actions Bot previously approved these changes Aug 3, 2026

View reviewed changes

github-actions Bot changed the title ~~chore(deps): maintain Claude Code Action workflows (v1.0.133)~~ chore(deps): maintain Claude Code Action workflows (cca=v1.0.183, ait=9b405c7) Aug 3, 2026

wkoutre requested review from BradBachu, codyborn, gretzke and wanxinwanxin August 3, 2026 18:40

chore(deps): maintain Claude Code Action workflows (cca=v1.0.185, ait…

a442409

…=c4820d6)

github-actions Bot reviewed Aug 5, 2026

View reviewed changes

github-actions Bot changed the title ~~chore(deps): maintain Claude Code Action workflows (cca=v1.0.183, ait=9b405c7)~~ chore(deps): maintain Claude Code Action workflows (cca=v1.0.185, ait=c4820d6) Aug 5, 2026

Navigation Menu

Uh oh!

chore(deps): maintain Claude Code Action workflows (cca=v1.0.185, ait=c4820d6) - #488

chore(deps): maintain Claude Code Action workflows (cca=v1.0.185, ait=c4820d6)#488
wkoutre wants to merge 3 commits into
mainfrom
chore/sync-claude-code-action

wkoutre commented Jun 1, 2026 •

edited by github-actions Bot

Loading

Uh oh!

github-actions Bot commented Jun 1, 2026 •

edited

Loading

Uh oh!

github-actions Bot left a comment

Uh oh!

wkoutre commented Aug 3, 2026

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot Aug 3, 2026

Uh oh!

github-actions Bot Aug 5, 2026

Uh oh!

github-actions Bot Aug 3, 2026

Uh oh!

github-actions Bot Aug 5, 2026

Uh oh!

wkoutre commented Aug 5, 2026

Uh oh!

github-actions Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

-    uses: Uniswap/ai-toolkit/.github/workflows/_claude-code-review.yml@9b405c71e42d0cec4026f2c158edf99716600baa
+    uses: Uniswap/ai-toolkit/.github/workflows/_claude-code-review.yml@9b405c71e42d0cec4026f2c158edf99716600baa
+    with:
+      pr_number: ${{ github.event.pull_request.number }}
+      base_ref: ${{ github.base_ref }}
+      force_review: false
+      toolkit_ref: 9b405c71e42d0cec4026f2c158edf99716600baa

	uses: Uniswap/ai-toolkit/.github/workflows/_claude-code-review.yml@9b405c71e42d0cec4026f2c158edf99716600baa
	toolkit_ref: c4820d6e62a9488c831e722aac202733fafab5dd

Uh oh!

Conversation

wkoutre commented Jun 1, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Per-file changes

.github/workflows/claude-code-review.yml

.github/workflows/claude-pr-metadata-update.yml

Summary

Per-file changes

.github/workflows/claude-code-review.yml

.github/workflows/claude-pr-metadata-update.yml

Notes for reviewers

Uh oh!

github-actions Bot commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Claude Code Review

Summary

Re-review status: both prior findings still unresolved

Not flagged

Verdict rationale

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

wkoutre commented Aug 3, 2026

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Aug 3, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Aug 3, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

wkoutre commented Aug 5, 2026

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

wkoutre commented Jun 1, 2026 •

edited by github-actions Bot

Loading

`.github/workflows/claude-code-review.yml`

`.github/workflows/claude-pr-metadata-update.yml`

`.github/workflows/claude-code-review.yml`

`.github/workflows/claude-pr-metadata-update.yml`

github-actions Bot commented Jun 1, 2026 •

edited

Loading