ci: skip claude-review on Dependabot PRs; SHA-pin every action

[mazze93]

Two CI/supply-chain defects found while sweeping open Dependabot PRs.

1. claude-review failed in ~7-13s on EVERY Dependabot PR (chore(deps): bump @radix-ui/react-toast from 1.2.15 to 1.2.17 #23,24,25,30,32). Cause: GitHub resolves secrets.* on a Dependabot-authored PR against the Dependabot secret store, not Actions secrets, so CLAUDE_CODE_OAUTH_TOKEN is empty and the action fails auth. Guarded the job with if: github.actor != 'dependabot[bot]'. The alternative — copying the token into Dependabot secrets to keep review coverage — was rejected: it widens credential surface for little signal on mechanical lockfile bumps, which tsc and Dependabot's advisory data already gate. Rationale recorded inline so the tradeoff stays reversible on purpose, not by accident.

2. All 13 third-party action references used MUTABLE tags (@v6/@v7/@v1/@V3). Under GUARDIAN posture a mutable tag is a supply-chain hole: the tag can be repointed at new code. Pinned every one to a full commit SHA with a trailing version comment, matching the convention codeql.yml's own header cites. Each SHA verified by dereferencing the tag object through the API.

Also drops the dead commented-out author-filter block it replaced.

Claude-Session: https://claude.ai/code/session_0172CPa6YcAjMwj6ajYDBXx1

What

Integrity

• Group: 1 / 2 / 3 / 4 / 5
• Tesserae resolved: T-xxx / none
• Tesserae opened: T-xxx / none

Test

• npx tsc --noEmit passes
• Dev server starts clean

Confidence Score: 4/5

Not safe to merge until the Dependabot guard identifies the pull request author rather than the account that triggered the event.

Findings

1.  Check the PR author ▶

Fix with agent prompt

### Issue 1
.github/workflows/claude-code-review.yml:24
This condition checks the account that triggered the workflow rather than the pull request author. When a maintainer reopens a Dependabot-authored pull request, `github.actor` is the maintainer, so this evaluates true and starts the Claude review job. The pull request still receives Dependabot's secret context, leaving `CLAUDE_CODE_OAUTH_TOKEN` empty and producing a failed authentication check. Check `github.event.pull_request.user.login` instead so Dependabot-authored pull requests are skipped regardless of who triggers the event.

```suggestion
    if: github.event.pull_request.user.login != 'dependabot[bot]'
```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

The Dependabot exclusion can still start the Claude review job when a maintainer triggers activity on a Dependabot-authored pull request. The job then lacks its required token and produces a failed check, so this must be corrected before merging.

_{Reviews (1) · Last reviewed commit: "ci: skip claude-review on Dependabot PRs..."}

[greptile-apps]

Check the PR author

This condition checks the account that triggered the workflow rather than the pull request author. When a maintainer reopens a Dependabot-authored pull request, github.actor is the maintainer, so this evaluates true and starts the Claude review job. The pull request still receives Dependabot's secret context, leaving CLAUDE_CODE_OAUTH_TOKEN empty and producing a failed authentication check. Check github.event.pull_request.user.login instead so Dependabot-authored pull requests are skipped regardless of who triggers the event.

Suggested change

	if: github.actor != 'dependabot[bot]'
	if: github.event.pull_request.user.login != 'dependabot[bot]'

Artifacts

Evidence from the check

• Authored Python evaluator reads the exact current workflow guard and compares its result with the proposed PR-author guard across three pull-request contexts; it provides the executed test source.

Command output from the check

• Captured command output for the evaluator, including command, working directory, and exit code 0; it shows the current guard runs while the PR-author guard skips a maintainer-triggered Dependabot pull request.

_{Ran code and verified through T-Rex}

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/claude-code-review.yml
Line: 24

Comment:
**Check the PR author**

This condition checks the account that triggered the workflow rather than the pull request author. When a maintainer reopens a Dependabot-authored pull request, `github.actor` is the maintainer, so this evaluates true and starts the Claude review job. The pull request still receives Dependabot's secret context, leaving `CLAUDE_CODE_OAUTH_TOKEN` empty and producing a failed authentication check. Check `github.event.pull_request.user.login` instead so Dependabot-authored pull requests are skipped regardless of who triggers the event.

```suggestion
    if: github.event.pull_request.user.login != 'dependabot[bot]'
```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Comments Outside Diff

These findings sit on lines the diff does not cover, so they could not be posted inline. Each one leaves this list once its file changes.

•  Claude review guard checks the workflow actor rather than the PR author ▶

  • Bug
    • For maintainer-triggered activity on a Dependabot-authored pull request, github.actor is maintainer, so github.actor != 'dependabot[bot]' evaluates true and starts the secret-dependent review job. The PR remains Dependabot-authored and therefore uses the Dependabot secret context described in the workflow comments, so the token is unavailable and the job can fail authentication.
  • Cause
    • The job condition uses the identity that initiated the workflow run instead of github.event.pull_request.user.login, which identifies the pull request author.
  • Fix
    • Replace line 24 with if: github.event.pull_request.user.login != 'dependabot[bot]' so every Dependabot-authored pull request is skipped regardless of the triggering actor.