chore(deps): bump claude-code-action to v1

[anurag6569201]

Bumps anthropics/claude-code-action from @beta to @v1.

Source merge-base: 3e5482bfcdc843b5218ad98d2845b4b71ab013b7
Source head: e3660885f1fd3c87acc63b9d2d2a4af10a5dc0e9

[shipwright-agent]

⚠️ Shipwright · Approve with conditions

Recommendation: approve PR #13 with conditions · Tier T3
Checks: 0 total · 0 needing attention

Next step: an authorized approver must satisfy the approval condition.

Findings (3)

• HIGH The tool allowlist was changed from 'View,GlobTool,GrepTool,BatchTool' to 'Read,Glob,Grep'. · .github/workflows/claude.yml:36
  • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
• HIGH The workflow still passes the Anthropic API key as a plaintext secret to the action. · .github/workflows/claude.yml:34
  • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
• LOW The CHANGELOG entry describes the change as a 'chore(ci)' but the version bump in version.py suggests a release. · CHANGELOG.md:3
  • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

Conditions

• human approval required (T3): apply the approval label

Fireworks usage: 5,659 input · 348 output · 6,007 total tokens · $0.0015 · 7s · 0 fix iteration(s)

Open the Shipwright check for full evidence and the audit bundle. Use /shipwright rerun to verify again.

[shipwright-agent]

Shipwright · HIGH

The workflow still passes the Anthropic API key as a plaintext secret to the action.

Impact: The workflow still passes the Anthropic API key as a plaintext secret to the action. While this is standard for GitHub Actions, the change from @beta to @v1 does not add any additional secret handling, and the action now runs with a broader tool allowlist (Read/Glob/Grep) that could be abused if the API key is ever leaked or the action is compromised.

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

[shipwright-agent]

Shipwright · LOW

The CHANGELOG entry describes the change as a 'chore(ci)' but the version bump in version.py suggests a release.

Impact: The CHANGELOG entry describes the change as a 'chore(ci)' but the version bump in version.py suggests a release. A new contributor may be confused about whether this is a CI-only change or a full release, since the changelog does not mention any user-facing impact.

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.