ci: bump Actions pins, add track_progress, add claude-debug label toggle

[jnasbyupgrade]

Summary

Combines three related, independently-motivated CI-workflow fixes into one PR (touching only claude-code-review.yml and claude.yml), per ~/test-fixes.md items #4, #7, and #11:

1. Bump actions/checkout@v4 -> @v7 (current latest major, confirmed via gh api repos/actions/checkout/releases) in both workflow files, to clear the "Node.js 20 is deprecated" warning it triggers on every run. anthropics/claude-code-action@v1 is left as-is — it's a floating major tag still tracking current releases (latest release v1.0.185), not a stale pin.

   This supersedes/incorporates ci: bump GitHub Actions to latest versions #13 ("ci: bump GitHub Actions to latest versions") and the ci/bump-actions-versions fork branch, which made the identical v4 -> v7 change to the same two lines. Once this PR merges, ci: bump GitHub Actions to latest versions #13 should be closed (not merging it separately — same diff, now folded in here alongside the other two changes per the "one PR" request). I did not close ci: bump GitHub Actions to latest versions #13 myself.

2. Add track_progress: true to the claude-code-action step in claude-code-review.yml. Without it, the action posts nothing to the PR until the entire run finishes — combined with this workflow's cost gate (which already waits for sibling CI), a run can go dark for the better part of an hour with no visible progress. track_progress: true makes it post/update a live checklist comment instead.

   Caveat found while implementing: the action's own track_progress validation only permits opened/synchronize/reopened/ready_for_review for pull_request/pull_request_target events and throws for any other action — including labeled, which is exactly the new claude-debug trigger added in (3). So track_progress is conditionally disabled (${{ github.event.action != 'labeled' }}) for labeled-triggered runs to avoid that throw.

3. Add a claude-debug PR-label toggle so a maintainer can skip the cost-gate wait and turn on full transcript output (show_full_output: true) just by labeling the PR, with no workflow-file edit/push needed per debug iteration:

   • The label is queried live inside the step (gh pr view <pr> --json labels --jq ...), not from github.event.pull_request.labels — GitHub's "Re-run jobs" replays the original stored event payload, so a payload-based check would miss a label added after the run started.
   • labeled was added to the workflow's trigger types:, scoped tightly in the job's if: (github.event.action != 'labeled' || github.event.label.name == 'claude-debug') so applying an unrelated label doesn't re-trigger this paid workflow.
   • Both the cost-gate wait step and the show_full_output behavior are gated on the live label check.

Note on ci.yml: this repo's .github/workflows/ci.yml does not exist on upstream/master yet (it's in-progress, uncommitted work elsewhere — a separate parallel PR) so there was nothing to bump there in this branch. It only has actions/checkout@v4 there too, which that other PR (or a follow-up) should bump when it lands.

Verification (actual observed results)

Broader finding than anticipated: because claude-code-review.yml runs on pull_request_target, GitHub Actions sources the entire workflow file — not just the track_progress line, but the checkout version, the on:/types: trigger list, and the new debug-label step — from the base branch (master), never from a PR's own head branch. This PR's own claude-review check (run 30961053711) confirmed this concretely: its log shows Run actions/checkout@v4 (not v7) and has no Check for claude-debug label step at all — i.e. it ran the unmodified master copy end to end. None of this PR's three changes to claude-code-review.yml are verifiable from this PR's own check; verification for all three (not just track_progress) is deferred to after merge.

• Actions version bump: python3 -c "import yaml; yaml.safe_load(open(f))" passed for both files. Repo-wide grep -rn 'actions/checkout@v4' under .github/workflows/ finds nothing left. Real-run confirmation that the Node-20-deprecation warning disappears for the changed lines is deferred to the next PR that runs post-merge (see broader finding above) — claude.yml's checkout step is likewise only exercised via non-pull_request_target events (issue_comment, etc.) which also load the workflow from the default branch, so it has the same deferred-verification status.
• track_progress: as documented above and in the file's own comment — unverifiable pre-merge, confirmed by the run log showing no track_progress input was even passed (old workflow).
• claude-debug label toggle: added the label to this PR (gh pr edit 15 --add-label claude-debug) and confirmed via gh api .../check-runs that no new run was triggered at all — because master's currently-live workflow doesn't have labeled in its on: trigger types either, for the same base-branch-sourcing reason above. This is a cleaner/stronger negative result than the "trusted-fork gate" structural reason anticipated going in — it's not that the job runs and is filtered out, it never even queues. Removed the label afterward (gh pr edit 15 --remove-label claude-debug) to leave the PR unlabeled since it had no observable effect. Real testing of this toggle requires a PR opened after this one merges.

Separate, pre-existing, unrelated finding: the one claude-review run this PR did trigger (using the current master workflow, actions/checkout@v4) failed at its checkout step with actions/checkout's "pwn request" safety refusal: "Refusing to check out fork pull request code from a 'pull_request_target' workflow ... set 'allow-unsafe-pr-checkout: true'". This reproduces on master today regardless of this PR (the version pin isn't the cause — v4 already exhibits this) since the step checks out jnasbyupgrade/object_reference, which actions/checkout treats as a fork relative to the base repo Postgres-Extensions/object_reference. This means claude-review currently fails at checkout for every PR from this fork, independent of anything in this PR. Flagging it since it's real and currently broken, but leaving it out of scope here — fixing it (allow-unsafe-pr-checkout: true) is a real security-tradeoff decision that intersects with this file's existing extensive pull_request_target security comments, and wasn't part of the three items this PR was scoped to.

Test plan

• YAML syntax validated for both files
• Repo-wide grep for stale actions/checkout@v4 pins — none remaining
• Watched this PR's claude-review check run to completion — confirmed (see above) it runs the pre-merge master workflow, so none of the three changes are exercised by it; also surfaced a pre-existing, unrelated checkout failure
• Added claude-debug label to this PR — confirmed no run fires pre-merge (master's workflow has no labeled trigger yet); label removed afterward
• (Deferred to next PR, post-merge) Confirm track_progress posts a live updating checklist comment
• (Deferred to next PR, post-merge) Confirm the claude-debug label toggle skips the cost gate and enables show_full_output

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 23d049f7-a787-4bbb-8b60-7228598b044b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}