Repository navigation
ci: bump anthropics/claude-code-action from 1.0.252 to 1.0.254 - #83
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
AlexKantor87
pushed a commit
that referenced
this pull request
Oct 22, 2026
…llow-ups (#90) Closes #89. Supersedes #83 (folded in as its own commit, `b3d6841`). ## Why Every push re-ran a full Opus review. Each round found fresh nits instead of checking whether the last round's findings were fixed: 6 full runs on #87, 3 on #45 for an unchanged dependency diff. ## What changes - **Triggers:** adds `ready_for_review` and skips drafts. The fork guard stays on every job. - **Rebase detection:** on `synchronize`, a shell step compares the PR's own diff with the previous push's using `git patch-id`. A pure rebase onto newer `main` runs no review in any job. If the old SHA can't be fetched after a force-push, the step assumes the diff changed. - **Dependabot / catalog jobs:** run their full review again only when their diff changed. - **General job:** a full review on open. Later pushes get a Sonnet follow-up scoped to the new commits: `git diff BEFORE AFTER`, or `git range-diff` after a rebase so main's changes aren't included. It reports resolved / partially addressed / not addressed for earlier findings, resolves fixed threads, and flags only bugs, security issues and regressions. If the first full review was cancelled, it reviews the whole PR instead. - **Full review prompt:** adds a "what not to report" section, cuts Phase 3 to one sentence, and lets the reviewer read CI results with `gh pr checks` instead of running `npm`. - **Outdated rules in the prompt:** the general prompt now points at `CLAUDE.md` instead of restating it. The restated list said `org` falls back to `config.org`, the opposite of the rule, and left the version out of `User-Agent`. The dependency prompt now says tools are registered in `src/server.ts`. - `CLAUDE.md` documents the phasing. ## Testing - Rebase detection was tested in a throwaway repo: a pure rebase compared equal, a real change differed, and `range-diff` output was checked. - `actionlint` (with shellcheck) passes. ## Needs a manual review The action refuses to run when its workflow differs from the default branch (see `CLAUDE.md`, #33), so **this PR can't review itself**. It takes effect after merge; check the first follow-up run on the next PR. Points to look at: - **Model:** the follow-up uses `claude-sonnet-5-5`; the full reviews stay on `claude-opus-5`. - **Thread resolving:** not confirmed that the job's `pull-requests: write` is enough for the GraphQL `resolveReviewThread` mutation. If it isn't, threads stay open and the rest still works. - **`gh api` access:** the follow-up allows `Bash(gh api:*)`, as in the CLI repo's workflow. The token is limited to `contents: read` and `pull-requests: write`. - **Limits:** the follow-up is capped at 30 turns and $2; the full reviews keep 60.
Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.252 to 1.0.254. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@f27be6b...db77d4d) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.252 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/github_actions/anthropics/claude-code-action-1.0.252
branch
from
October 22, 2026 11:31
c967643 to
41af337
Compare
Contributor
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/github_actions/anthropics/claude-code-action-1.0.252
branch
October 22, 2026 11:32
dangrondahl
added a commit
that referenced
this pull request
Oct 22, 2026
…pendabot (#87) Gives more confidence before the next release by adding checks for things that so far were only tested by unit tests, or not at all. The new checks immediately turned up two bugs that were already on `main`, and both are fixed here: a mistyped test, and a `.mcpb` bundle that doesn't start on Node 22.0–22.6. ## Fix: the `.mcpb` bundle didn't start on Node 22.0–22.6 `pack-mcpb.sh` deleted `package.json` from the bundle, so nothing declared `dist/` as ESM. Node 22.7+ detects ESM from the syntax and prints a warning. Earlier versions parse the file as CommonJS and fail with `Cannot use import statement outside a module`. Both `engines` and `manifest.json` allow those versions. The bundle now ships a one-line `package.json` with `{ "type": "module" }`, and nothing from the repo's own `package.json`. I reproduced the failure on the official Node 22.6.0 binary, and confirmed the fixed bundle starts on 22.0.0, 22.6.0 and 22.7.0. ## Type-check tests and scripts `tsconfig.json` is `src`-only because it emits `dist/`, and vitest strips types without checking them. So a type error in `test/` or `scripts/` never failed anything. One had already slipped through: the fetch mock in `test/client/kosli-client.test.ts` was typed `ReturnType<typeof vi.fn>`, which doesn't match `KosliClient`'s `fetchFn`. That is fixed here. `tsconfig.test.json` and `npm run typecheck` cover the TypeScript in `src`, `test` and `scripts`. `scripts/sync-version.mjs` is plain JS and isn't covered. CI runs the typecheck after the build. ## Stdio smoke test `scripts/smoke.ts` (`npm run smoke`) starts a built server over real stdio and checks three things: - the version it advertises matches `package.json` - it lists exactly the three tools - the tools carry the right safety hints: `execute_write_action` is marked `destructiveHint` and not read-only, and `execute_read_action` and `search_actions` are marked `readOnlyHint`. These hints are what make an MCP client ask before a write, and no other test checks them. - `search_actions` finds `list_environments` A failed tool call reports the server's own error message rather than a JSON parse error. This covers what `test/server.test.ts` can't, because that test runs in memory: whether the bin starts, whether the JSON imports load, and whether a bundle's `node_modules` resolve. The test is offline by default. It does one live read only when `KOSLI_API_TOKEN` and `KOSLI_SMOKE_ORG` are both set, and CI never sets them, so it's fork-safe. CI now runs: 1. build 2. **typecheck** 3. test 4. **smoke `dist/`** 5. pack 6. **unzip the `.mcpb`, run `mcpb validate` on its manifest, and smoke-test it** 7. **on the leg that sets `consumer-floor` in the matrix: switch to exactly Node 22.0.0 and smoke-test the bundle again** There's also a **negative check**: the smoke test must fail against a missing entry point. That way a later refactor can't turn the smoke steps into checks that always pass. Some notes on those steps: - Validating the bundled manifest, not the repo's copy, matters: the repo's `manifest.json` holds a placeholder version, and the real one is only injected at pack time. - The 22.0.0 step exists because the matrix floor is the *dev* floor (vitest needs a newer 22.x, see #47), so nothing tested the version users are promised. The smoke test doesn't need vitest, so it can run there. I rehearsed it locally on the real 22.0.0 binary: it fails on the old bundle and passes on the fixed one. - `@anthropic-ai/mcpb` is now a devDependency rather than an `npx` pin, so Dependabot keeps it up to date. It adds 49 dev-only packages. None of them ship (`files: ["dist"]`), and the server's own `zod` is unchanged at 4.3.6. ## Release workflow: publish only after every check `release.yml` used to run only build and test, then `npm publish`, and only then build the bundle. So a failed pack could leave a version on npm with no GitHub Release. It now runs the same checks as CI: 1. build, typecheck, test 2. smoke `dist/` 3. pack, `mcpb validate`, smoke the bundle 4. only then `npm publish` and the GitHub Release `npm publish` can't be undone, so it stays last. This also checks the bundle under the `npm@latest` that the release job installs, which CI never uses. Both jobs now have a `timeout-minutes` (15 for CI, 20 for release) instead of the 6-hour default. ## Dependabot grouping and cooldown - **Actions:** all SHA bumps go in one group. They edit the same lines, so as separate PRs they conflict (#80 and #82 do today). - **npm dev dependencies:** minor and patch bumps are grouped. - **`@modelcontextprotocol/sdk`:** its minor and patch bumps get their own group, because it's the only runtime dependency. - **Majors** stay one PR each. - **Cooldown:** new releases wait 7 days before being proposed. Security updates aren't affected. ## Docs `CONTRIBUTING.md` gets a "Testing locally" section covering typecheck, smoke (offline and live), MCP Inspector, Claude Code against a checkout, and installing the `.mcpb`. `README.md` and `CLAUDE.md` are updated to match. ## Verification On Node 24 locally: - `build`, `typecheck` and `npm test` (110 tests) pass. - The smoke test passes against `dist/` and against the unzipped bundle. - The smoke test exits 1 when the server fails to start. - `mcpb validate` passes on the bundled manifest, which carries version `0.5.0`. - The live-API smoke test passed against a real org (with SDK 1.30.1). - The bundle smoke test passes on Node 22.0.0, 22.6.0 and 22.7.0. Not run locally: the Node 22 matrix leg, which CI covers. Not run: `release.yml` itself, which only runs on a tag. Its new steps are the same commands CI runs. After merge, check the next Dependabot run is still green. `cooldown` support varies by ecosystem, and an unsupported key invalidates the whole config, not just that block. ## Merge order for the open PRs Suggested order once this lands: #47, then this PR, then #80 → #82 → #83 → #74 → #79 → #84 → #45. Before #79 (SDK), rerun the live smoke test on its branch. #47 conflicts with this PR on the matrix line: when resolving, change the `include:` entry to `node-version: '22.12'` as well. Merge #45 (TypeScript 7) last, after diffing `dist/` output against 5.9.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps anthropics/claude-code-action from 1.0.252 to 1.0.254.
Release notes
Sourced from anthropics/claude-code-action's releases.
Commits
db77d4dchore: bump Claude Code to 2.1.304 and Agent SDK to 0.3.3045eb090fchore: bump Claude Code to 2.1.303 and Agent SDK to 0.3.303