Harden delete_files MCP tool: validate paths within repo root (consistency with commit_files) - #1636

…ng with a test (#86)

* security: re-pin claude-code-action to v1.0.195, pin neutral-cwd wiring with a test

Re-pins anthropics/claude-code-action from v1.0.191 to v1.0.195 at all five call
sites (the header comment undercounted at "three" — grep confirms five) plus the
two doc-URL references pinned to the same commit. Resolved v1.0.195's annotated
tag to its commit via the GitHub API (dereferenced, not trusted from prose) and
cross-checked against the /tags listing. action.yml's own interface (inputs/
outputs/structure) is byte-identical between the two pins, so no breaking change
to how this file invokes the action.

Two security fixes land in v1.0.194: delete_files MCP tool path-traversal
hardening (anthropics/claude-code-action#1636) and shell-quote bumped to 1.8.4
for CVE-2026-9277 (critical severity, #1557).

Closes the neutral-cwd wiring gap: run_gate() computes and containment-checks
neutral_cwd, but nothing proved that verified value actually reached
_run_agent()'s neutral_cwd parameter at the call site (11 positional args) —
only the isolated _run_agent()/provider_run() boundaries were tested. Adds a
source-inspection test deriving the expected argument position from
_run_agent's own live signature, verified with a negative-control mutation
(swapped in `workdir`) that the new test catches and the existing readonly-tier
test also independently catches.

* docs: pin references follow the live action.yml pin, with a drift test

* docs: register test_docs_pin_drift.py in CONTRIBUTING's pytest table (12 files)

Bumps the github-actions group with 2 updates: [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) and [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action).
Updates `docker/setup-buildx-action` from 4.2.0 to 4.3.0
Release notes

*Sourced from [docker/setup-buildx-action's releases](https://github.com/docker/setup-buildx-action/releases).*

> v4.3.0
> ------
>
> * Bump `@​docker/actions-toolkit` from 0.92.0 to 0.95.0 in [docker/setup-buildx-action#595](https://redirect.github.com/docker/setup-buildx-action/pull/595)
> * Bump brace-expansion from 1.1.13 to 1.1.18 in [docker/setup-buildx-action#600](https://redirect.github.com/docker/setup-buildx-action/pull/600)
> * Bump js-yaml from 5.2.0 to 5.3.0 in [docker/setup-buildx-action#585](https://redirect.github.com/docker/setup-buildx-action/pull/585)
> * Bump postcss from 8.5.10 to 8.5.25 in [docker/setup-buildx-action#598](https://redirect.github.com/docker/setup-buildx-action/pull/598)
> * Bump undici from 6.27.0 to 6.28.0 in [docker/setup-buildx-action#601](https://redirect.github.com/docker/setup-buildx-action/pull/601)
>
> **Full Changelog**: <docker/setup-buildx-action@v4.2.0...v4.3.0>


Commits

* [`37fe631`](docker/setup-buildx-action@37fe631) Merge pull request [#595](https://redirect.github.com/docker/setup-buildx-action/issues/595) from docker/dependabot/npm\_and\_yarn/docker/actions-to...
* [`b5c4f91`](docker/setup-buildx-action@b5c4f91) [dependabot skip] chore: update generated content
* [`3e93b63`](docker/setup-buildx-action@3e93b63) build(deps): bump `@​docker/actions-toolkit` from 0.92.0 to 0.95.0
* [`e527031`](docker/setup-buildx-action@e527031) Merge pull request [#600](https://redirect.github.com/docker/setup-buildx-action/issues/600) from docker/dependabot/npm\_and\_yarn/brace-expansion-1...
* [`c68814b`](docker/setup-buildx-action@c68814b) [dependabot skip] chore: update generated content
* [`3f891b0`](docker/setup-buildx-action@3f891b0) build(deps): bump brace-expansion from 1.1.13 to 1.1.18
* [`787db26`](docker/setup-buildx-action@787db26) Merge pull request [#585](https://redirect.github.com/docker/setup-buildx-action/issues/585) from docker/dependabot/npm\_and\_yarn/js-yaml-5.2.1
* [`f779368`](docker/setup-buildx-action@f779368) [dependabot skip] chore: update generated content
* [`7d5e604`](docker/setup-buildx-action@7d5e604) build(deps): bump js-yaml from 5.2.0 to 5.3.0
* [`292c2fb`](docker/setup-buildx-action@292c2fb) Merge pull request [#590](https://redirect.github.com/docker/setup-buildx-action/issues/590) from docker/dependabot/github\_actions/actions/setup-n...
* Additional commits viewable in [compare view](docker/setup-buildx-action@bb05f3f...37fe631)
  
Updates `anthropics/claude-code-action` from 1.0.192 to 1.0.198
Release notes

*Sourced from [anthropics/claude-code-action's releases](https://github.com/anthropics/claude-code-action/releases).*

> v1.0.198
> --------
>
> **Full Changelog**: <anthropics/claude-code-action@v1.0.197...v1.0.198>
>
> v1.0.197
> --------
>
> What's Changed
> --------------
>
> * fix: neutralize the checkout credential under actions/checkout v6+ include layout ([#1510](https://redirect.github.com/anthropics/claude-code-action/issues/1510)) by [`@​TemRevil`](https://github.com/TemRevil) in [anthropics/claude-code-action#1526](https://redirect.github.com/anthropics/claude-code-action/pull/1526)
>
> New Contributors
> ----------------
>
> * [`@​TemRevil`](https://github.com/TemRevil) made their first contribution in [anthropics/claude-code-action#1526](https://redirect.github.com/anthropics/claude-code-action/pull/1526)
>
> **Full Changelog**: <anthropics/claude-code-action@v1.0.196...v1.0.197>
>
> v1.0.196
> --------
>
> What's Changed
> --------------
>
> * fix(security): unify secret redaction in public comment outputs by [`@​Juwan-Hwang`](https://github.com/Juwan-Hwang) in [anthropics/claude-code-action#1693](https://redirect.github.com/anthropics/claude-code-action/pull/1693)
> * fix: strip unused ALL\_INPUTS environment variable from Claude subprocess env by [`@​Juwan-Hwang`](https://github.com/Juwan-Hwang) in [anthropics/claude-code-action#1692](https://redirect.github.com/anthropics/claude-code-action/pull/1692)
> * fix(github): match bot actors in comment filters using GraphQL \_\_typename by [`@​Neal006`](https://github.com/Neal006) in [anthropics/claude-code-action#1616](https://redirect.github.com/anthropics/claude-code-action/pull/1616)
>
> New Contributors
> ----------------
>
> * [`@​Juwan-Hwang`](https://github.com/Juwan-Hwang) made their first contribution in [anthropics/claude-code-action#1693](https://redirect.github.com/anthropics/claude-code-action/pull/1693)
>
> **Full Changelog**: <anthropics/claude-code-action@v1.0.195...v1.0.196>
>
> v1.0.195
> --------
>
> **Full Changelog**: <anthropics/claude-code-action@v1.0.194...v1.0.195>
>
> v1.0.194
> --------
>
> What's Changed
> --------------
>
> * Harden delete\_files MCP tool: validate paths within repo root (consistency with commit\_files) by [`@​GabrielOnRails`](https://github.com/GabrielOnRails) in [anthropics/claude-code-action#1636](https://redirect.github.com/anthropics/claude-code-action/pull/1636)
> * Only limit fetch depth when the checkout is already shallow by [`@​winklemad`](https://github.com/winklemad) in [anthropics/claude-code-action#1647](https://redirect.github.com/anthropics/claude-code-action/pull/1647)
> * fix(base-action): add ~/.local/bin to $GITHUB\_PATH after auto-install by [`@​anishesg`](https://github.com/anishesg) in [anthropics/claude-code-action#1643](https://redirect.github.com/anthropics/claude-code-action/pull/1643)
> * feat(context): include diffHunk in PR review comment context by [`@​rishavnaskar`](https://github.com/rishavnaskar) in [anthropics/claude-code-action#1584](https://redirect.github.com/anthropics/claude-code-action/pull/1584)
> * ci: skip Claude-backed test jobs on fork PRs by [`@​ashwin-ant`](https://github.com/ashwin-ant) in [anthropics/claude-code-action#1655](https://redirect.github.com/anthropics/claude-code-action/pull/1655)
> * fix: bump shell-quote to 1.8.4 to remediate CVE-2026-9277 by [`@​doshidhaval`](https://github.com/doshidhaval) in [anthropics/claude-code-action#1557](https://redirect.github.com/anthropics/claude-code-action/pull/1557)
> * fix(images): bound attachment downloads by [`@​abhinavkr26104`](https://github.com/abhinavkr26104) in [anthropics/claude-code-action#1625](https://redirect.github.com/anthropics/claude-code-action/pull/1625)
>
> New Contributors
> ----------------
>
> * [`@​GabrielOnRails`](https://github.com/GabrielOnRails) made their first contribution in [anthropics/claude-code-action#1636](https://redirect.github.com/anthropics/claude-code-action/pull/1636)
> * [`@​winklemad`](https://github.com/winklemad) made their first contribution in [anthropics/claude-code-action#1647](https://redirect.github.com/anthropics/claude-code-action/pull/1647)
> * [`@​doshidhaval`](https://github.com/doshidhaval) made their first contribution in [anthropics/claude-code-action#1557](https://redirect.github.com/anthropics/claude-code-action/pull/1557)
>
> **Full Changelog**: <anthropics/claude-code-action@v1.0.193...v1.0.194>
>
> v1.0.193
> --------
>
> **Full Changelog**: <anthropics/claude-code-action@v1.0.192...v1.0.193>


Commits

* [`3f854a8`](anthropics/claude-code-action@3f854a8) chore: bump Claude Code to 2.1.238 and Agent SDK to 0.3.238
* [`5ee796a`](anthropics/claude-code-action@5ee796a) chore: bump Claude Code to 2.1.237 and Agent SDK to 0.3.237
* [`cff8d3c`](anthropics/claude-code-action@cff8d3c) fix(git-config): neutralize checkout credential in include-based config ([#1526](https://redirect.github.com/anthropics/claude-code-action/issues/1526))
* [`e2a4b76`](anthropics/claude-code-action@e2a4b76) chore: bump Claude Code to 2.1.236 and Agent SDK to 0.3.236
* [`65b50df`](anthropics/claude-code-action@65b50df) fix(github): match bot actors in comment filters using GraphQL \_\_typename ([#1](https://redirect.github.com/anthropics/claude-code-action/issues/1)...
* [`0a80d21`](anthropics/claude-code-action@0a80d21) fix: strip unused ALL\_INPUTS environment variable from Claude subprocess env ...
* [`54eadc2`](anthropics/claude-code-action@54eadc2) fix(security): unify secret redaction in public comment outputs ([#1693](https://redirect.github.com/anthropics/claude-code-action/issues/1693))
* [`d40ddef`](anthropics/claude-code-action@d40ddef) chore: bump Claude Code to 2.1.235 and Agent SDK to 0.3.235
* [`459ad35`](anthropics/claude-code-action@459ad35) chore: bump Claude Code to 2.1.234 and Agent SDK to 0.3.234
* [`d721746`](anthropics/claude-code-action@d721746) fix: bound image attachment downloads ([#1625](https://redirect.github.com/anthropics/claude-code-action/issues/1625))
* Additional commits viewable in [compare view](anthropics/claude-code-action@e63208c...3f854a8)
  
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore  major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore  minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore  ` will remove the ignore condition of the specified dependency and ignore conditions