Problem

The Claude Code Review workflow fails on PRs with:

Restoring .claude, .mcp.json, .claude.json, .gitmodules, .ripgreprc, CLAUDE.md, CLAUDE.local.md, .husky from origin/main (PR head is untrusted)
Action failed with error: ENOENT: no such file or directory, symlink

Failed run: https://github.com/alltuner/vibetuner/actions/runs/24132160598

Root Cause

Upstream bug in anthropics/claude-code-action, introduced in v1.0.89
(anthropics/claude-code-action#1187).

The action's "restore trusted files" step uses cpSync with dereference: false
(the default). When it encounters CLAUDE.md — which is a symlink to AGENTS.md
in this repo — it tries to recreate the symlink instead of copying file contents.
The symlink() call fails with ENOENT because the parent directory for the
temporary copy doesn't exist yet.

Upstream Fix

PR anthropics/claude-code-action#1186 adds dereference: true to follow symlinks
and copy actual file contents. Not yet merged as of v1.0.90.

Stopgap

Both workflow files pinned to v1.0.88 (pre-regression):

1. .github/workflows/claude-code-review.yml
2. vibetuner-template/.github/workflows/claude-code-review.yml

TODO

• Unpin to @v1 once upstream fix ships
• Verify scaffolded projects work after unpin

Filed by Claude Code.