[kyle-sexton]

No related issue: fleet repin to ci-workflows v0.39.3 in the GitHub Actions conventions migration.

Summary

Moves this repository's repo-owned ci-workflows pins from v0.39.0 (6ba73b9) to v0.39.3 (ab83b01273026ab5c23c6f3b40e946d97a863fa2), so the fleet runs one release.

Fix

Pin SHA and # v0.39.3 comment only. Sync-managed callers and the synced runner-policy contracts are left to the standards sync. Between v0.39.0 and v0.39.3 no pinned path moved, every reusable workflow blob is byte-identical, and the only action.yml that changed is check-managed-files (Dependabot-skip hardening, ci-workflows#709). The rest of the release is shell re-indentation (ci-workflows#712) and a golangci-lint bump in pr-run-checks-go (ci-workflows#713).

Verification

• Every repo-owned uses: melodic-software/ci-workflows/... pin is at ab83b01; every pinned path exists at that commit.
• actionlint passes on the changed workflows; the diff touches pin lines only; the lefthook pre-commit passed.
• The runner-policy contracts for ab83b01 are in feat(runner-policy): add ci-workflows v0.39.3 contracts standards#742. Until it merges and the standards sync delivers them, this PR's runner-policy check fails on the new reusable keys; that is expected.

Related

• feat(runner-policy): add ci-workflows v0.39.3 contracts standards#742 (v0.39.3 runner-policy contracts)
• ci-workflows v0.39.3 release

🤖 Generated with Claude Code

https://claude.ai/code/session_01T7GukBojtE99rLCPY7Cw3R

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T02:08:36.553854Z	3b545b6	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 39s —— View job

---

Code review — skip gate triggered

• Gather context (diff, CLAUDE.md/AGENTS.md, REVIEW.md)
• Understand the request (invoke /review:code-review lane)
• Review changed file(s) for correctness/maintainability
• Report findings

Result: no findings — trivial, automated pin bump.

The entire diff is a one-line SHA + version-comment update in .github/workflows/pr-automerge-dependabot.yml:

-    uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
+    uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3

This matches the review skip gate ("change is trivial/automated with no meaningful review surface"):

• Pin and version comment are consistent (ab83b01273026ab5c23c6f3b40e946d97a863fa2 → v0.39.3, a valid 40-char SHA).
• No logic, permissions, or with: inputs changed — only the pinned ref moved forward within the same reusable workflow.
• The PR body's own Verification section (author-claimed, not independently re-run by me) explains the v0.39.0→v0.39.3 diff is byte-identical for this workflow's path, actionlint passed, and the diff touches pin lines only.
• PR title (ci: ...) and body shape (No related issue: escape + ## Summary/## Fix/## Verification/## Related) satisfy AGENTS.md's PR conventions.

No inline comments posted; nothing here rises to a blocking or flagged issue.

[claude]

Claude finished @kyle-sexton's task in 38s —— View job

---

Security Review (/review:security-review)

• Gather context (diff, changed files)
• Apply skip gate
• Post result

Skip gate applied: criterion 2 — the change has no security-relevant surface after reading the diff.

The only change in this PR is a single reusable-workflow pin bump in .github/workflows/pr-automerge-dependabot.yml:

-    uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
+    uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3

• The reference stays pinned to a full 40-character commit SHA both before and after — nothing is loosened or unpinned.
• permissions: is unchanged (contents: write, pull-requests: write), so no privilege widening.
• No workflow trigger, run: block, or secret handling is touched.
• This is exactly the kind of pin-version update that falls under zizmor's advisory lane for supply-chain pin changes; per this skill's instructions, loosened/unpinned-pin findings are deferred there, and in any case the pin here remains a full SHA, so there's nothing to defer either.
• No instruction-surface deletions (no CLAUDE.md/AGENTS.md/rules/skill/agent/hook changes) in this diff.

No security issues found.

[github-actions]

claude-review has reviewed this pull request through 3b545b6; a later push is reviewed from there.

[github-actions]

claude-security-review has reviewed this pull request through 3b545b6; a later push is reviewed from there.