ci(claude): upgrade claude-code-action from @beta to @v1

[ajitpratap0]

Summary

On @beta, @claude doesn't work on fork PRs. The action checks out the PR's head branch by name from origin, which causes two problems:

• If origin has no branch with that name, the run fails with fatal: couldn't find remote ref (fix(ast): preserve IS NOT NULL and ClickHouse parametric aggregate params in output #529, feat(parser,ast): preserve parenthesized expressions (fix #519) #532–feat(parser): ClickHouse array/tuple element access via dot (d.1) #535).
• If origin happens to have a branch with the same name, the action silently reviews the wrong code. That happened on fix(tokenizer): restore default dialect on pool return #525, where origin's branch differs from the fork head in 16 files.

v1 detects fork PRs (isCrossRepository) and fetches them through refs/pull/N/head (src/github/operations/branch.ts), which fixes both.

Changes, following the v1 migration guide:

• @beta → @v1 in claude.yml and claude-code-review.yml
• model: → claude_args: --model claude-sonnet-5-5
• direct_prompt → prompt, with REPO/PR NUMBER context (v1 requires it for PR reviews)
• Automatic review: track_progress + use_sticky_comment keep the single progress comment. --allowedTools lets Claude post inline and top-level comments, since v1 automation mode doesn't comment by default.
• track_progress is set only for pull_request events, because v1 throws on workflow_dispatch.
• Removed commented-out examples that used removed v0 inputs.

The fork-PR skip from #538 stays in place. Fork PRs still get no secrets on pull_request events.

Test Plan

• Both workflow files parse; the action inputs match v1's action.yml
• This PR's claude-review run (a same-repo PR) posts a review on v1
• After merge: @claude on a fork PR (e.g. feat(parser): ClickHouse array/tuple element access via dot (d.1) #535) checks out the fork head and replies

Breaking Changes

None for contributors. The review comment may be formatted slightly differently under v1.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VCRwrpJY25CRtyTcu6aD8V

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
gosqlx-website	Ready	Preview	Oct 10, 2026 6:10pm UTC

[github-actions]

Claude finished @ajitpratap0's task in 17s —— View job

---

Review of PR #539: upgrade claude-code-action @beta → @v1

I only read the diff, so I haven't run these workflows. Overall the migration looks correct and the diff is tidy.

• Read the diff of both workflow files
• Check the changes against the v1 migration

What looks good

• model: → claude_args: --model ..., direct_prompt → prompt, and @beta → @v1 match the v1 migration.
• track_progress is limited to pull_request events, which avoids the workflow_dispatch error you described.
• Removing the commented-out blocks that used v0 inputs (allowed_tools, custom_instructions, claude_env, assignee_trigger) is a good cleanup. Those inputs are gone in v1.
• Security: the fork-PR skip from ci(claude-review): skip automatic review on fork PRs #538 stays, so fork PRs still don't get secrets on pull_request events. The --allowedTools list is narrow: inline comments plus gh pr comment/diff/view. It has no general Bash access.

Suggestions

1. workflow_dispatch runs (claude-code-review.yml). github.event.pull_request.number is empty on workflow_dispatch, so the prompt will say PR NUMBER: with no value. If that trigger is meant to review a PR, add a dispatch input and use ${{ github.event.pull_request.number || inputs.pr_number }}. If the trigger is only there for manual testing, this is harmless.
2. Pinning. @v1 is a floating major tag. That's fine, and it's what the action recommends. If you want stricter supply-chain hygiene for a workflow that holds an OAuth token, pin to a commit SHA and let Dependabot bump it.
3. Allowed tools in claude.yml. v1 interactive mode no longer inherits the old defaults for some tools. If you want @claude to run go test, task, or go vet on PRs, add something like --allowedTools "Bash(go test:*),Bash(go vet:*),Bash(task:*)". Otherwise it can edit code but not verify it. This is optional.
4. Wording nit. The comment "Keep the v0-style sticky progress comment" is slightly confusing, since use_sticky_comment is a v1 input. Something like "Post the review into a single sticky progress comment" would read better.
5. Test plan. The remaining unchecked items can only be confirmed by this PR's own claude-review run and by the fork-PR check after merge. Please confirm both before closing out fix(ast): preserve IS NOT NULL and ClickHouse parametric aggregate params in output #529 and feat(parser,ast): preserve parenthesized expressions (fix #519) #532–feat(parser): ClickHouse array/tuple element access via dot (d.1) #535.

Test coverage

Workflow YAML has no unit tests, so the test plan above is the right validation. The Go code is untouched, so task test:race isn't affected.

No blocking issues found. Approving is up to a human reviewer.

[github-actions]

Claude finished @ajitpratap0's task in 14s —— View job

---

Review of PR #539: upgrade claude-code-action @beta → @v1

I read the full diff against origin/main for both workflow files. I did not run the workflows, so the two unchecked test-plan items are still unverified.

Looks good

• @v1, model: → claude_args: --model ..., and direct_prompt → prompt all follow the v1 migration.
• track_progress is gated to pull_request events, so workflow_dispatch runs won't hit the v1 error.
• The --allowedTools list is narrow: the inline comment tool plus gh pr comment, gh pr diff and gh pr view. It grants no general Bash.
• The fork-PR skip from ci(claude-review): skip automatic review on fork PRs #538 is untouched, so fork PRs still get no secrets on pull_request events.
• The commented-out blocks used removed v0 inputs (allowed_tools, custom_instructions, claude_env, assignee_trigger), so deleting them is a good cleanup.

Suggestions (none blocking)

1. Comment wording (claude-code-review.yml, near track_progress): "Keep the v0-style sticky progress comment" is confusing, because use_sticky_comment is a v1 input. Something like "Post the review into a single sticky progress comment" would be clearer.
2. workflow_dispatch prompt (claude-code-review.yml): github.event.pull_request.number is empty on dispatch, so the prompt reads PR NUMBER: with no value. If you use that trigger to review a PR, add a dispatch input and use ${{ github.event.pull_request.number || inputs.pr_number }}. If it's only for manual testing, you can leave it.
3. @claude tool access (claude.yml): there is no --allowedTools here, so @claude may not be able to run go test, go vet or task to check its own changes. If you want that, add something like --allowedTools "Bash(go test:*),Bash(go vet:*),Bash(task:*)". This is optional.
4. Pinning: @v1 is a floating major tag. That's what the action recommends. If you want stricter supply-chain hygiene for workflows holding an OAuth token, pin to a SHA and let Dependabot bump it.
5. Test plan: please confirm the two unchecked items before closing fix(ast): preserve IS NOT NULL and ClickHouse parametric aggregate params in output #529 and feat(parser,ast): preserve parenthesized expressions (fix #519) #532–feat(parser): ClickHouse array/tuple element access via dot (d.1) #535. They are this PR's own claude-review run, and @claude on a fork PR after merge (e.g. feat(parser): ClickHouse array/tuple element access via dot (d.1) #535).

Test coverage

There are no Go changes and workflow YAML has no unit tests, so task test:race is unaffected. The test plan is the right validation.

No blocking issues found. Approval is up to a human reviewer.

[github-actions]

Claude finished @ajitpratap0's task in 13s —— View job

---

Review of PR #539: upgrade claude-code-action @beta → @v1

I read the diff against origin/main for both workflow files. I did not run the workflows, so the two unchecked test-plan items are still unverified.

Looks good

• @v1, model: → claude_args: --model ..., and direct_prompt → prompt follow the v1 migration.
• track_progress is gated to pull_request events, so workflow_dispatch runs avoid the v1 error.
• The --allowedTools list is narrow: the inline comment tool plus gh pr comment, gh pr diff and gh pr view. It grants no general Bash.
• The fork-PR skip from ci(claude-review): skip automatic review on fork PRs #538 is untouched, so fork PRs still get no secrets on pull_request events.
• The deleted commented-out blocks used inputs that v1 removed (allowed_tools, custom_instructions, claude_env, assignee_trigger), so removing them is a good cleanup.

Suggestions (none blocking)

1. Comment wording (claude-code-review.yml, above track_progress): "Keep the v0-style sticky progress comment" is confusing, because use_sticky_comment is a v1 input. Something like "Post the review into a single sticky progress comment" would be clearer.
2. workflow_dispatch prompt (claude-code-review.yml): github.event.pull_request.number is empty on dispatch, so the prompt reads PR NUMBER: with no value. If you use that trigger to review a PR, add a dispatch input and use ${{ github.event.pull_request.number || inputs.pr_number }}. If it's only for manual testing, you can leave it.
3. Claude's tool access in claude.yml: there is no --allowedTools here, so @claude may not be able to run go test, go vet or task to check its own changes. If you want that, add something like --allowedTools "Bash(go test:*),Bash(go vet:*),Bash(task:*)". This is optional.
4. Pinning: @v1 is a floating major tag, which is what the action recommends. For stricter supply-chain hygiene on workflows that hold an OAuth token, you could pin to a SHA and let Dependabot bump it.
5. Test plan: please confirm the two unchecked items before closing fix(ast): preserve IS NOT NULL and ClickHouse parametric aggregate params in output #529 and feat(parser,ast): preserve parenthesized expressions (fix #519) #532–feat(parser): ClickHouse array/tuple element access via dot (d.1) #535. They are this PR's own claude-review run, and @claude on a fork PR after merge (e.g. feat(parser): ClickHouse array/tuple element access via dot (d.1) #535).

Test coverage

There are no Go changes and workflow YAML has no unit tests, so task test:race is unaffected. The test plan is the right validation.

No blocking issues found. Approval is up to a human reviewer.

[github-actions]

Claude finished @ajitpratap0's task in 13s —— View job

---

Review of PR #539: upgrade claude-code-action @beta → @v1

I read the diff against origin/main for both workflow files. I didn't run the workflows, so the two unchecked test-plan items are still unverified.

Looks good

• @v1, model: → claude_args: --model ..., and direct_prompt → prompt follow the v1 migration.
• track_progress is limited to pull_request events, so workflow_dispatch runs avoid the v1 error.
• --allowedTools is narrow: the inline comment tool plus gh pr comment/diff/view. It grants no general Bash.
• The fork-PR skip from ci(claude-review): skip automatic review on fork PRs #538 is untouched, so fork PRs still get no secrets on pull_request events.
• The deleted commented-out blocks used inputs v1 removed, so removing them is a good cleanup.

Suggestions (none blocking)

1. Comment wording (claude-code-review.yml, above track_progress): "Keep the v0-style sticky progress comment" is confusing, because use_sticky_comment is a v1 input. Something like "Post the review into a single sticky progress comment" would be clearer.
2. workflow_dispatch prompt (claude-code-review.yml): github.event.pull_request.number is empty on dispatch, so the prompt reads PR NUMBER: with no value. If you use that trigger to review a PR, add a dispatch input and use ${{ github.event.pull_request.number || inputs.pr_number }}.
3. Tool access in claude.yml: with no --allowedTools, @claude may not be able to run go test, go vet or task on its own changes. If you want that, add --allowedTools "Bash(go test:*),Bash(go vet:*),Bash(task:*)".
4. Pinning: @v1 is a floating major tag, which is what the action recommends. For stricter supply-chain hygiene on workflows holding an OAuth token, you could pin to a SHA and let Dependabot bump it.
5. Test plan: please confirm the two unchecked items before closing fix(ast): preserve IS NOT NULL and ClickHouse parametric aggregate params in output #529 and feat(parser,ast): preserve parenthesized expressions (fix #519) #532–feat(parser): ClickHouse array/tuple element access via dot (d.1) #535. They are this PR's own claude-review run, and @claude on a fork PR after merge (e.g. feat(parser): ClickHouse array/tuple element access via dot (d.1) #535).

Test coverage

There are no Go changes and workflow YAML has no unit tests, so task test:race is unaffected. The test plan is the right validation.

No blocking issues found. I can't modify .github/workflows files, so any of the above would need to be applied by you. Approval is up to a human reviewer.