chore(deps): maintain Claude Code Action workflows (v1.0.217)

[wkoutre]

Summary

Maintenance pass on Claude Code Action workflows. Applies three classes of edit atomically:

• claude-code-action: v1.0.217 (9c5ddab) — see https://github.com/anthropics/claude-code-action/releases/tag/v1.0.217
• ai-toolkit reusable workflows: c4820d6 (Uniswap/ai-toolkit main HEAD, the released branch)
• Models:
  • haiku → claude-haiku-4-5-20251001
  • opus → claude-opus-5
  • sonnet → claude-sonnet-5

Per-file changes

.github/workflows/claude-code-review.yml

• SHA bump anthropics/claude-code-action: 1298632 → 9c5ddab (v1.0.217)

---

Opened by the sync-claude-code-action maintenance job. The job runs weekly and bumps SHAs + applies known migrations; review the diff before merging.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T17:07:42.206484Z	2c361c2	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Thanks for contributing to Uniswap Docs! 🦄

Quick heads up on how this repo works: the docs you see on developers.uniswap.org are built from a separate source repo. When we accept a change here, we port it over there, so your fix might show up on the live site before it lands in this repo.

Updates to this repo come in batches on a regular cadence. When yours is included, you'll be credited as a co-author on the commit, so the contribution counts on your GitHub profile and in Uniswap/docs.

We review every PR but can't merge everything. Either way, someone from the docs team will follow up here once we've taken a look.

One legal bit: by submitting a PR you agree your contribution is licensed under the repo's MIT license.

[github-actions]

Review summary

This PR only bumps the pinned anthropics/claude-code-action SHA in .github/workflows/claude-code-review.yml from 1298632… (v1.0.175) to 9c5ddab… (v1.0.217).

• Verified: 9c5ddab2e6d17b83ea679153b31f1d5f023cf636 is indeed the commit the v1.0.217 tag points to on anthropics/claude-code-action — no supply-chain mismatch.
• No documentation content, links, contract addresses, or chain IDs are touched by this diff.
• Change is minimal and mechanical; nothing further to flag.

Looks good to merge from a docs/content-review perspective.

[wkoutre]

Refreshed pin to v1.0.223 (9cdae7f), ai-toolkit c4820d6, models {"opus": "claude-opus-5", "sonnet": "claude-sonnet-5", "haiku": "claude-haiku-4-5-20251001"} on 2026-09-14.

[github-actions]

I verified this SHA against GitHub: 9cdae7f0d995e3ba7c33f226087fdf82a59cd520 does correspond to claude-code-action v1.0.223, so the pin and version comment are internally consistent and correct.

However, this doesn't match the PR description, which claims the bump is to v1.0.217 (SHA 9c5ddab..., which is actually the SHA for v1.0.217, not what's used here) and also describes ai-toolkit reusable-workflow updates and model-name changes (haiku/opus/sonnet → dated model IDs). None of that appears in this diff — only this one line in this one file changed. Worth double-checking that the correct diff/branch was pushed for this automated PR, since the description over-promises what the code actually does.

[github-actions]

Review summary

This PR is a CI-only change (.github/workflows/claude-code-review.yml), no docs content, links, or contract addresses are touched — outside the usual risk areas for this repo.

What it does: Bumps the pinned SHA for anthropics/claude-code-action on line 47.

Verified: The new SHA (9cdae7f0d995e3ba7c33f226087fdf82a59cd520) does correspond to claude-code-action v1.0.223 per GitHub's release page — the pin and its # v1.0.223 comment are correct and consistent with each other. Pinning by full SHA (with a version comment) is the right pattern for supply-chain safety here.

Issue found: The PR title/description don't match the actual diff:

• Description claims the bump is to v1.0.217 (SHA 9c5ddab...), but the diff actually bumps to v1.0.223 (SHA 9cdae7f0...). 9c5ddab2e6d17b83ea679153b31f1d5f023cf636 is genuinely the SHA for v1.0.217, so it looks like the description is just stale/wrong, not that a wrong SHA was used in code.
• Description also claims updates to "ai-toolkit reusable workflows" and model name changes (haiku/opus/sonnet → dated IDs), but the diff only touches this single line in this single file (changedFiles: 1, +1/-1). Those other changes aren't present.

Left an inline comment with details. No security or content concerns with what's actually in the diff — recommend just double-checking that this automated PR pushed the intended full diff, or correcting the description before merge.