[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change
scality/workflows	workflow	patch	v2.12.0 → v2.12.1

---

Release Notes

scality/workflows

v2.12.1

Compare Source

What's Changed

• fix(claude-code-review): use the job token instead of the OIDC app token exchange by @​matthiasL-scality in #​114

Full Changelog: scality/workflows@v2.12.0...v2.12.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Dependency Bump Evaluation

Version change: scality/workflows v2.12.0 -> v2.12.1
Semver bump type: patch

Changes:

• Single upstream commit (fix(claude-code-review): use the job token instead of the OIDC app token exchange workflows#114, e80ed38): claude-code-review.yml now passes github_token: ${{ github.token }} to claude-code-action instead of using the OIDC -> GitHub App token exchange. That exchange started rejecting checks: write (401 permission_not_allowed), so reviews silently posted nothing.
• Drops additional_permissions. The job already declares checks: write.
• New guard step that fails the review job when triggered on pull_request_target.
• promote.yaml, release.yaml and claude-code-dependency-review.yml are unchanged upstream; only their pinned SHA moves.

Breaking changes: None for this repo. The new pull_request_target guard only fires if claude-code-review.yml is called on that event; here the review job is gated on github.event_name == 'pull_request', and only review-dependency-bump runs on pull_request_target.

Security concerns: None. This is a hardening change: the job token is scoped to the permissions the job declares, and the review workflow now refuses to run with write permissions on untrusted PR content. The pinned SHA 91619d883650e6238f517757f7b978757c2cb086 matches the v2.12.1 tag.

Impact on codebase: Only .github/workflows/promote.yaml, release.yaml and review.yml change (SHA pin + version comment). No application code is affected.

Recommendation: SAFE TO MERGE (once CI passes)

Notes: Not auto-approved for two reasons. The PR is authored by scality-renovate[bot], and only pure dependabot PRs are approved automatically. Pre Merge checks (build, lint, test, test-e2e) were still in progress at the time of review. Merge once they are green.

— Claude Code