[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change
scality/workflows	workflow	minor	v2.10.0 → v2.12.0

---

Release Notes

scality/workflows

v2.12.0

Compare Source

What's Changed

• PTFE-3527: migrate claude-code-dependency-review from Vertex AI to Anthropic native WIF by @​matthiasL-scality in #​113

Full Changelog: scality/workflows@v2.11.0...v2.12.0

v2.11.0

Compare Source

What's Changed

• PTFE-3527: migrate claude-code-review from Vertex AI to Anthropic native WIF by @​matthiasL-scality in #​111

Full Changelog: scality/workflows@v2.10.0...v2.11.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Dependency Bump Evaluation

Version change: v2.10.0 → v2.12.0 (minor)
Semver bump type: minor (2 intermediate releases: v2.11.0, v2.12.0)

Changes:

• v2.11.0: Migrated claude-code-review workflow from Vertex AI to Anthropic native WIF authentication
• v2.12.0: Migrated claude-code-dependency-review workflow from Vertex AI to Anthropic native WIF authentication
• Default model for dependency review upgraded from claude-opus-4-6 to claude-opus-5-5
• Per-repo cost reporting added (requires ACTIONS_APP_PRIVATE_KEY, already passed)
• Improved credential hygiene: git credentials removed before Claude runs

Breaking changes: None. Both upstream PRs (#111, #113) explicitly state no breaking changes. The old GCP secrets (GCP_WORKLOAD_IDENTITY_PROVIDER, GCP_SERVICE_ACCOUNT, ANTHROPIC_VERTEX_PROJECT_ID, CLOUD_ML_REGION) are kept as deprecated/unused/optional for backward compatibility.

Security concerns: None — the migration improves security posture (credential hygiene improvements, scoped tokens). No suspicious patterns in the upstream changes.

Impact on codebase:

• promote.yaml, release.yaml: Version pin update only; these workflows don't pass any of the affected auth secrets/inputs.
• review.yml: Still passes the now-deprecated GCP secrets — harmless (accepted but unused). The four new anthropic_* inputs default to org-level variables automatically. ACTIONS_APP_PRIVATE_KEY is already being passed.

Recommendation: SAFE TO MERGE (once CI is green)

Notes:

• CI checks are still in progress at time of review — wait for all checks to pass before merging.
• The deprecated GCP secrets in review.yml (lines 15-18, 32-35) can be cleaned up in a follow-up PR, but are not blocking.

— Claude Code