Update GitHub Action Versions

[morisil]

GitHub Actions Version Updates

• actions/setup-java published a new release v5.5.0 on 2026-07-07T20:32:28Z
• anthropics/claude-code-action published a new release v1.0.168 on 2026-07-08T00:29:35Z

[claude]

Review

This is a routine, automated dependency-update PR (from action-version-updater.yml per the repo's CLAUDE.md), bumping two GitHub Actions to their latest releases:

• actions/setup-java: v5.4.0 → v5.5.0
• anthropics/claude-code-action: v1.0.165 → v1.0.168 (used in both claude-code.yml and claude-code-review.yml)

Code quality / conventions: Consistent with the existing style in this repo — all third-party actions here are pinned to tag versions rather than commit SHAs, and this PR follows that same pattern. No structural or formatting issues.

Bugs: None. The diff is a pure version bump with no logic changes; workflow structure, inputs, and secrets usage are untouched.

Security: Worth flagging (pre-existing, not introduced by this PR): actions are pinned to mutable version tags (e.g. @v1.0.168) rather than immutable commit SHAs. Tags can be moved by the upstream maintainer, which is a supply-chain risk for actions with write permissions like claude-code.yml (it's granted contents/pull-requests/issues write per CLAUDE.md). Since anthropics/claude-code-action and actions/setup-java are reputable, actively maintained actions, this is low risk in practice, but pinning to SHA + Dependabot/version-updater comments is the stronger hardening option if you want to close that gap. Not a blocker for this PR since it's just following existing convention.

Performance: No impact — these are CI-only version bumps.

Test coverage: N/A — no testable logic changed. Recommend just confirming CI passes on this PR (workflow syntax lint / a normal run) before merging, since that's the only real validation needed for an action-version bump.

Overall: looks safe to merge as-is.