chore(deps)(deps): bump the github-actions group with 12 updates #117
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # AI-driven security review on every PR, complementing the existing static | |
| # tooling (CodeQL, gosec, Trivy, npm audit, gitleaks, Dependency Review, | |
| # Scorecard). Claude reviews the diff for auth/authz logic bugs, business- | |
| # logic flaws, prompt-injection, and the LLM-class antipatterns from | |
| # Arcanum-Sec/sec-context that pattern matchers can't catch. | |
| # | |
| # One-time setup in repo settings: | |
| # 1. Secrets and variables -> Actions -> New repository secret | |
| # Name: CLAUDE_API_KEY | |
| # Value: Anthropic API key with Claude API + Claude Code entitlement | |
| # (https://console.anthropic.com/settings/keys) | |
| # 2. Actions -> General -> "Fork pull request workflows from outside | |
| # contributors" -> Require approval for all external contributors. | |
| # This repo is PUBLIC -- the action is not hardened against prompt | |
| # injection in untrusted PR diffs, so external forks must be gated | |
| # on maintainer review before the workflow runs. | |
| # | |
| # The action has no tagged releases yet (May 2026); pinned to a SHA per | |
| # OWASP CI/CD-SEC-2. Bump when v1 is cut. | |
| name: claude-security-review | |
| on: | |
| pull_request: | |
| branches: [main] | |
| concurrency: | |
| group: claude-sec-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| permissions: {} | |
| jobs: | |
| review: | |
| name: Claude Security Review | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write # post inline review comments | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| fetch-depth: 2 # action diffs against the parent commit | |
| - name: Claude Security Review | |
| uses: anthropics/claude-code-security-review@0c6a49f1fa56a1d472575da86a94dbc1edb78eda | |
| with: | |
| comment-pr: true | |
| claude-api-key: ${{ secrets.CLAUDE_API_KEY }} | |
| # Skip non-source paths the static scanners already cover, plus | |
| # generated Go files (templ output) where false positives are common. | |
| exclude-directories: "docs" |