chore(workflows): bump claude-code-action to v1.0.231

[wkoutre]

What changed

Bumps the pinned SHA for anthropics/claude-code-action from a874e9e (v1.0.210) to cfc3eb22bfed5c26ef66e3223c982af27e4524de (v1.0.231). Eight uses: pins across five reusable workflows, SHA and trailing version comment only:

• .github/workflows/_claude-code-review.yml (2 pins)
• .github/workflows/_claude-docs-check.yml (2 pins)
• .github/workflows/_generate-pr-metadata.yml (2 pins)
• .github/workflows/_claude-main.yml (1 pin)
• .github/workflows/_update-action-versions-worker.yml (1 pin)

Release notes: https://github.com/anthropics/claude-code-action/releases/tag/v1.0.231

No workflow inputs, permissions, with: blocks, or prompts changed. The maintenance job's other two edit classes were no-ops here: the model aliases already point at pinned Claude 5-family IDs, and this repo's callers reference the ai-toolkit reusable workflows at @main rather than a pinned SHA.

Why

Weekly maintenance pass from the sync-claude-code-action job, keeping the pinned action current.

How it was verified

gh pr diff against the merge base: 5 files, 8 pin replacements, 8 deletions, every added pin on cfc3eb22bfed5c26ef66e3223c982af27e4524de # v1.0.231. No occurrence of a874e9e, 9cdae7f, or c81e3bc survives in the diff.

Note for reviewers

The branch carries three sync commits (v1.0.217, then v1.0.223, then v1.0.231), so only the final SHA survives in the diff. No pin lands on either intermediate version. These reusable workflows are consumed by Uniswap/universe and Uniswap/backend at @main; this PR targets next, so rollout happens when next reaches main.

AI-Generated Description

What changed

Bumps the pinned SHA for anthropics/claude-code-action from a874e9e (v1.0.210) to
cfc3eb22bfed5c26ef66e3223c982af27e4524de (v1.0.231). Eight uses: pins across five reusable
workflows — SHA and trailing version comment only:

Workflow	Pins	Steps
.github/workflows/_claude-code-review.yml	2	Run Claude Code Review, Run Claude Auto-Fix
.github/workflows/_claude-docs-check.yml	2	Run Claude Docs Check, Run Claude Auto-Fix
.github/workflows/_generate-pr-metadata.yml	2	quality-gate-eval, Run Claude Code Generation
.github/workflows/_claude-main.yml	1	Run Claude Code
.github/workflows/_update-action-versions-worker.yml	1	Run Claude Code
The diff is 8 insertions and 8 deletions. No workflow inputs, permissions, with: blocks, or
prompts were touched.
Release notes: https://github.com/anthropics/claude-code-action/releases/tag/v1.0.231

Why

Weekly maintenance pass from the sync-claude-code-action job, keeping the pinned action current.

Notes

• The net bump is v1.0.210 → v1.0.231. The branch carries three sync commits — v1.0.217, then
  v1.0.223, then v1.0.231, with a merge from next in between. Only the final SHA survives in the
  diff, so the PR title and any description text naming v1.0.217 or v1.0.223 was stale. No pin
  lands on either intermediate version.
• Eight pins, not nine. Earlier passes of this job also listed _claude-task-worker.yml. That
  workflow was deleted by #586, so the number of
  live pins dropped from 9 to 8.
• The job's other two edit classes were no-ops. Model aliases are already on pinned Claude
  5-family IDs, and this repo's callers reference the ai-toolkit reusable workflows at @main
  rather than a pinned SHA — so the ait=c4820d6 sync named in the commit messages corresponds to
  nothing in this diff.
• Downstream impact. These are reusable workflows consumed by other repositories
  (Uniswap/universe, Uniswap/backend) at @main. This PR targets next, so rollout to callers
  happens when next reaches main, not on this merge. Check the v1.0.210 → v1.0.231 changelog for
  input or behavior changes first.
• Two non-pin matches deliberately left alone: the # v1.0.0 format example in the version-worker
  prompt (_update-action-versions-worker.yml:274) and the sed/grep patterns in
  update-claude-code-action.yml, which match any SHA rather than pinning one.

Verification

• git grep 'anthropics/claude-code-action@' — all 8 pins on cfc3eb22 # v1.0.231.
• Repo-wide grep for a874e9e, 9cdae7f, c81e3bc, v1.0.210, v1.0.217, and v1.0.223 — zero
  matches, no stragglers.
• git diff --stat against the merge base — 5 files, 8 insertions, 8 deletions.
• No packages/plugins/ files touched, so no plugin version bump applies.
  Opened by the sync-claude-code-action maintenance job. The job runs weekly and bumps SHAs +
  applies known migrations; review the diff before merging.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
ai-toolkit-slack-oauth-backend	Ready	Preview	Sep 21, 2026 4:03pm UTC

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T17:06:27.024714Z	e12d389	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

📚 Documentation Check ✅

Verdict: Passed

This PR only bumps the pinned SHA/version comment for anthropics/claude-code-action (v1.0.210 to v1.0.231) across five reusable workflow files under .github/workflows/. No files under packages/plugins/ were touched, so the mandatory plugin version-bump rule does not apply. No APIs, structural behavior, or usage patterns changed; this is a routine dependency-pin maintenance commit matching the repo's established pattern (recent commits 56f256b, 8b61ff2 do the same thing).

---

Summary

PR #585 updates the pinned commit SHA (and version comment) for anthropics/claude-code-action from v1.0.210 to v1.0.231 in five workflow files:

• .github/workflows/_claude-code-review.yml (2 occurrences)
• .github/workflows/_claude-docs-check.yml (2 occurrences)
• .github/workflows/_claude-main.yml (1 occurrence)
• .github/workflows/_generate-pr-metadata.yml (2 occurrences)
• .github/workflows/_update-action-versions-worker.yml (1 occurrence)

All 8 changed lines follow the same pattern: replacing one full-length commit SHA with another, with the trailing version comment updated to match. This mirrors the routine dependency-maintenance pattern seen in recent commit history (56f256b, 8b61ff2 - "chore(deps): maintain Claude Code Action workflows").

Checks performed

1. CLAUDE.md - No CLAUDE.md (root or .github/workflows/) references the specific claude-code-action version number, so nothing needs updating.
2. README.md - No README describes this action version; not applicable.
3. Plugin version bumps - No files under packages/plugins/ were touched, so the mandatory plugin version-bump rule does not apply. No blocking issue.
4. Changelog - Routine pinned-dependency bump with no user-facing behavior change; informational only, consistent with prior unlogged bumps of the same kind.

No documentation, README, or plugin version updates are required for this PR.

✨ No Documentation Updates Needed

All documentation appears to be up to date with the code changes.

---

_{🤖 Generated by Claude Documentation Validator | Mode: suggest}

[github-actions]

_{● Reviewed · against 56f256b · 2026-09-21 16:06 UTC · 4 reviews · view run ↗}

Note

Approved — PR title and body still say v1.0.223; the pins on disk are v1.0.231.

Bumps the anthropics/claude-code-action pin to cfc3eb2 (v1.0.231) across all 8 uses in the 5 reusable workflows — the tag dereferences to the pinned SHA, no old pin survives anywhere in the tree, and the upstream delta is limited to bundled CLI/SDK version bumps with no change to the action's input/output interface.

Assessment

These workflows are consumed by other repositories at @main, so promotion of next rolls v1.0.231 out to every caller at once. action.yml is byte-identical between the old and new SHAs and the 21 upstream commits only touch version constants, so no with: key or default changes underneath those callers. The PR title and body describe v1.0.223 / 9cdae7f, which is now an intermediate commit in the bumped range; a squash merge would take its message from the stale title, so refresh both before merging to keep the merged history accurate.

Iteration history · 4 reviews

2026-09-21 16:06 UTC · ✅ approved · 0 findings · 56f256b · run ↗

_{(no findings)}

2026-09-14 16:05 UTC · ✅ approved · 0 findings · 8b61ff2 · run ↗

_{(no findings)}

2026-09-10 23:28 UTC · ✅ approved · 0 findings · 903f9ba · run ↗

_{(no findings)}

2026-09-07 17:15 UTC · ✅ approved · 0 findings · e12d389 · run ↗

_{(no findings)}

Tip

Teach the reviewer. React 👍 on findings that helped, 👎 on false positives. Reply to push back or add context — we aggregate this weekly to tune the bot.

Comment @request-claude-review to re-run.

[github-actions]

Note

✅ Approved — see full review in the sticky comment ↑

[wkoutre]

Refreshed pin to v1.0.223 (9cdae7f), ai-toolkit c4820d6, models {"opus": "claude-opus-5", "sonnet": "claude-sonnet-5", "haiku": "claude-haiku-4-5-20251001"} on 2026-09-14.

[wkoutre]

Refreshed pin to v1.0.231 (cfc3eb2), ai-toolkit c4820d6, models {"opus": "claude-opus-5", "sonnet": "claude-sonnet-5", "haiku": "claude-haiku-4-5-20251001"} on 2026-09-21.