[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change
scality/workflows	workflow	patch	v2.12.0 → v2.12.1

---

Release Notes

scality/workflows

v2.12.1

Compare Source

What's Changed

• fix(claude-code-review): use the job token instead of the OIDC app token exchange by @​matthiasL-scality in #​114

Full Changelog: scality/workflows@v2.12.0...v2.12.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Dependency Bump Evaluation

Version change: scality/workflows v2.12.0 -> v2.12.1 (pinned SHA 91619d8, which matches the upstream v2.12.1 tag)
Semver bump type: patch

Changes:

• Upstream diff touches only claude-code-review.yml (fix(claude-code-review): use the job token instead of the OIDC app token exchange workflows#114). promote.yaml, release.yaml and claude-code-dependency-review.yml are unchanged, so the bumps in promote.yaml, release.yaml and the review-dependency-bump job change nothing.
• claude-code-action now gets github_token: ${{ github.token }} instead of using the OIDC -> GitHub App token exchange. Since 2026-10-30 that exchange has been returning 401 for checks: write, and because the step is continue-on-error the review was silently not posted.
• additional_permissions is removed.
• A new first step fails the job when it runs on pull_request_target.

Breaking changes: None for this repo. The new pull_request_target guard cannot fire here: the review job in .github/workflows/review.yaml already only runs when github.event_name == 'pull_request'.

Security concerns: This changes how the review job gets its GitHub token, which is credential handling, so it is flagged for human review. The change itself looks like a hardening: the job now uses its own GITHUB_TOKEN, limited to the permissions it declares (checks: write, contents: read, pull-requests: write), and it refuses to run on pull_request_target. The commits are by a Scality maintainer, and no new third-party actions or dependencies are added.

Impact on codebase: Only .github/workflows/review.yaml (the review job) is affected. It should start posting Claude code reviews again. No changes needed in the caller workflow.

Recommendation: REVIEW REQUIRED

Notes: This is a low-risk patch. It is not auto-approved for two reasons: it changes GitHub token handling, and the PR is authored by scality-renovate[bot], not dependabot. CI checks (agent-ci, rpm-ci) were still running when this was evaluated. Merge once they are green.

— Claude Code