Summary
.github/workflows/ai-review-analysis.yml references anthropics/claude-code-base-action@beta in several steps, each passing anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}. @beta is a mutable lightweight tag (the maintainer can re-point it at any time), and this reusable workflow is invoked from claude-review.yml on pull_request_target / issue_comment with secrets: inherit.
Why it's worth pinning
Because @beta is mutable, the exact code that runs with ANTHROPIC_API_KEY (and the other provider keys in scope) can change without any change in this repo — the third-party-action supply-chain risk (the 2025 tj-actions/changed-files incident is the reference case). GitHub's hardening guidance is to pin third-party actions to a full commit SHA and let Dependabot bump it.
I noticed you're already hardening this exact workflow in #14796 (sandbox flags, secret filtering, trimming allowed_tools) — this is meant as a small complement to that effort, not a separate concern: pinning claude-code-base-action (and any other third-party actions here) to full SHAs would close the mutable-ref gap too.
Vehicle
Raising as an issue since PRs here require the Meta CLA; happy to send a PR if you'd prefer and point me at the CLA.
Reproduction: gh api repos/anthropics/claude-code-base-action/git/refs/tags/beta --jq .object.type → commit (a mutable tag, not a pinned SHA). I used AI assistance to investigate and draft this; I reproduced the facts myself.
Summary
.github/workflows/ai-review-analysis.ymlreferencesanthropics/claude-code-base-action@betain several steps, each passinganthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}.@betais a mutable lightweight tag (the maintainer can re-point it at any time), and this reusable workflow is invoked fromclaude-review.ymlonpull_request_target/issue_commentwithsecrets: inherit.Why it's worth pinning
Because
@betais mutable, the exact code that runs withANTHROPIC_API_KEY(and the other provider keys in scope) can change without any change in this repo — the third-party-action supply-chain risk (the 2025 tj-actions/changed-files incident is the reference case). GitHub's hardening guidance is to pin third-party actions to a full commit SHA and let Dependabot bump it.I noticed you're already hardening this exact workflow in #14796 (sandbox flags, secret filtering, trimming allowed_tools) — this is meant as a small complement to that effort, not a separate concern: pinning
claude-code-base-action(and any other third-party actions here) to full SHAs would close the mutable-ref gap too.Vehicle
Raising as an issue since PRs here require the Meta CLA; happy to send a PR if you'd prefer and point me at the CLA.
Reproduction:
gh api repos/anthropics/claude-code-base-action/git/refs/tags/beta --jq .object.type→commit(a mutable tag, not a pinned SHA). I used AI assistance to investigate and draft this; I reproduced the facts myself.