chore(deps): update anthropics/claude-code-action action to v1.0.181

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
anthropics/claude-code-action	action	patch	v1.0.180 → v1.0.181	v1.0.183 (+1)

---

Release Notes

anthropics/claude-code-action (anthropics/claude-code-action)

v1.0.181

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

v1.0.181 contains 2 commits over v1.0.180:

• Bug fix (#1407): Share one exchanged WIF (Workload Identity Federation) credential across spawned Claude processes.

  • Root cause: GitHub OIDC tokens are single-use at the Anthropic token-exchange endpoint. When plugins are configured, the action spawns multiple short-lived Claude processes (plugin marketplace add, plugin installs, main query), and each was independently exchanging the same identity token — causing jti_reused 401 errors on subsequent processes.
  • Fix: Write a profile config file and select it via ANTHROPIC_CONFIG_DIR / ANTHROPIC_PROFILE so the first process exchanges once and subsequent processes reuse the cached access token.
  • Additional hardening: fingerprints the federation config in the cache dir name, skips the managed profile if the operator already set those env vars, and removes the token dir in stop().

• Chore: Bump bundled Claude Code to 2.1.218 and Agent SDK to 0.3.218.

No breaking changes. No migration steps required.

🎯 Impact Scope Investigation

The action is used in two jobs in .github/workflows/ci.yml:

Job	Line	Purpose
content-review	151	Reviews Zenn article content changes with Claude
code-review	241	Reviews tool code changes with Claude

Both jobs authenticate via claude_code_oauth_token (OAuth token), not WIF/OIDC federation. The primary bug fix in this release does not apply to this repo's configuration, but there are no regressions either.

The pinned SHA 44423bdec74b97d67543eb16c110546762c110b2 was verified against the GitHub API and correctly corresponds to the v1.0.181 tag.

No changes to action inputs, outputs, or behavior for OAuth token usage.

💡 Recommended Actions

• No code or configuration changes needed.
• Merge as-is.

🔗 Reference Links

• v1.0.181 Release Notes
• PR #1407: fix: share one exchanged WIF credential across spawned Claude processes
• Compare v1.0.180...v1.0.181

Generated by koki-develop/claude-renovate-review