[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change
scality/workflows	workflow	patch	v2.12.0 → v2.12.1

---

Release Notes

scality/workflows

v2.12.1

Compare Source

What's Changed

• fix(claude-code-review): use the job token instead of the OIDC app token exchange by @​matthiasL-scality in #​114

Full Changelog: scality/workflows@v2.12.0...v2.12.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Dependency Bump Evaluation

Version change: scality/workflows v2.12.0 -> v2.12.1 (pinned SHA 91619d8, verified to match tag v2.12.1)
Semver bump type: patch

Changes:

• Only claude-code-review.yml changed upstream (fix(claude-code-review): use the job token instead of the OIDC app token exchange workflows#114): claude-code-action now gets github_token: ${{ github.token }} and skips the OIDC-to-GitHub-App token exchange, which has rejected checks: write with a 401 since 2026-10-30. Before this fix the review step failed silently because of continue-on-error.
• Drops additional_permissions. The job already declares checks: write.
• New guard step: the reusable review workflow now fails if it runs on pull_request_target.
• promote.yaml, release.yaml and claude-code-dependency-review.yml are unchanged between the two tags. In this repo only the pinned refs change.

Breaking changes: None for this repo. In review.yml, the review job calls claude-code-review.yml only when github.event_name == "pull_request", so the new pull_request_target guard never fires. review-dependency-bump (the only job that runs on pull_request_target) uses claude-code-dependency-review.yml, which this release does not touch.

Security concerns: None. The job token is limited to the permissions the job already declares, and the new guard keeps that write-capable token away from untrusted pull_request_target runs. No new third-party actions.

Impact on codebase: CI workflow refs only (.github/workflows/promote.yaml, release.yaml, review.yml). No Go code is affected. This should make Claude code reviews post again on human PRs.

Recommendation: SAFE TO MERGE once the in-progress tests and golangci-lint checks pass. I am posting a comment rather than approving because the PR was authored by scality-renovate[bot], and automatic approval is limited to dependabot PRs.

Notes: Low risk. An upstream maintainer authored the fix, and the tag SHA matches the pinned commit.

— Claude Code