fix(ci): fix claude-pr-review failing on fork PRs

[diegomrsantos]

Issue Addressed

claude-pr-review fails on all fork PRs since Feb 11 with:

fatal: couldn't find remote ref pull/N/head

pull_request_target reads workflow files from the default branch (stable), so this fix must land here.

Proposed Changes

• Remove fork-specific repository/ref overrides from checkout (origin must point to base repo where PR refs live)
• Generate the GitHub App token before checkout and pass it via token:

Root cause: claude-code-action@v1 merged anthropics/claude-code-action#851 on Feb 10, changing branch fetch from git fetch origin <branchName> to git fetch origin pull/N/head:<branchName>. The action calls setupBranch() before configureGitAuth(), so it uses the token embedded by actions/checkout. The default github.token cannot fetch fork PR refs.

Additional Info

• Same fix was merged to unstable via fix(ci): fix claude-pr-review checkout for fork PRs #827 and fix(ci): use app token for checkout in claude-pr-review #828 but had no effect since pull_request_target reads from stable
• Same-repo runs (merge queue) are unaffected since github.token can access those refs

[claude-code-actions-sigp]

Claude Code is working…

I'll analyze this and get back to you.

View job run

[shane-moore]

LGTM. Root cause was anthropics/claude-code-action@v1 updating to v1.0.48 on Feb 10, which changed PR checkout from git fetch origin <branch-name> to git fetch origin pull/N/head:..... The new approach assumes origin is the base repo, but our workflow was overriding it to the fork. The app token change is fine but the real fix is removing the fork-specific checkout overrides imo

[shane-moore]

regarding the CI failures:

• this PR aims to fix the Claude PR Review issue
• target-branch-check would have to be bypassed since we dont want to merge everything from unstable to stable for some time
• check-code failure was resolved with fix: update bytes to 1.11.1 to fix RUSTSEC-2026-0007 #797 to unstable, so those changes will get into stable eventually

[shane-moore]

ran this flow locally w/o issue to prove to myself we wouldn't see merge issues later:

1. merge this PR → stable: fast-forward (no merge needed, stable
   was behind)
2. merge stable → unstable: auto-merged cleanly (Git
   resolved overlapping changes automatically since the
   diffs were compatible)
3. merge unstable → stable: fast-forward again

[shane-moore]

Closing this since claude has resolve the issue on their end anthropics/claude-code-action#931

[diegomrsantos]

Closing this since claude has resolve the issue on their end anthropics/claude-code-action#931

Imo it's better to use fixed versions for everything, so we avoid disruptions lile that. It consumes time and it's not the first time it happens