chore(deps): update scality/workflows action to v2.11.0

[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change
scality/workflows	workflow	minor	v2.10.0 → v2.11.0

---

Release Notes

scality/workflows (scality/workflows)

v2.11.0

Compare Source

What's Changed

• PTFE-3527: migrate claude-code-review from Vertex AI to Anthropic native WIF by @​matthiasL-scality in #​111

Full Changelog: scality/workflows@v2.10.0...v2.11.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Dependency Bump Evaluation

Version change: scality/workflows v2.10.0 → v2.11.0 (minor)

Changes:

• Migrates claude-code-review workflow authentication from Vertex AI to Anthropic native Workload Identity Federation (WIF)
• New optional anthropic inputs added, defaulting to org-level variables — callers need no changes
• Old GCP secrets retained as deprecated (unused but accepted), so existing callers keep working
• Adds cost tracking per-repo for reviews
• No changes to promote.yaml or release.yaml workflows upstream — only the version pin is bumped

Breaking changes: None — the migration was designed for full backward compatibility

Security concerns: None — the change moves from a Google Vertex AI proxy to direct Anthropic API authentication via WIF. No CVEs, no suspicious patterns

Impact on codebase: review.yml still passes GCP secrets (GCP_WORKLOAD_IDENTITY_PROVIDER, GCP_SERVICE_ACCOUNT, ANTHROPIC_VERTEX_PROJECT_ID, CLOUD_ML_REGION) which are now deprecated upstream but harmless. No code or workflow logic changes needed in this repo. Consider cleaning up the deprecated secret references in a follow-up

Recommendation: SAFE TO MERGE (once CI is green)

Notes: PR authored by scality-renovate[bot] — automated approval restricted to dependabot PRs per policy, so posting this evaluation as a comment. CI checks were still in progress at time of review

— Claude Code