[kyle-sexton]

No related issue: fleet repin to ci-workflows v0.39.0 in the GitHub Actions conventions migration.

Summary

Moves this repository's repo-owned ci-workflows pins from v0.38.2 (cf316d1) to v0.39.0 (6ba73b97b058602c4dd2bb6e2cce234d11011787), so the fleet runs one release.

Fix

Pin SHA and # v0.39.0 comment only, plus any repo-owned file that asserts the pin. Sync-managed callers and the synced runner-policy contracts are left to the standards sync. No pinned path moved between v0.38.2 and v0.39.0, and no caller-facing input changed for the reusables pinned here.

Verification

• Every repo-owned uses: melodic-software/ci-workflows/... pin is at 6ba73b9; every pinned path exists at that commit.
• actionlint passes on the changed workflows; the diff touches pin lines only.
• The runner-policy contracts for 6ba73b9 merged in feat(runner-policy): add ci-workflows v0.39.0 contracts standards#732; this PR's runner-policy check passes once the standards sync delivers them.

Related

• feat(runner-policy): add ci-workflows v0.39.0 contracts standards#732 (v0.39.0 runner-policy contracts)
• ci-workflows v0.39.0 release

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-07T14:08:06.906132Z	1af1c00	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 1m 34s —— View job

---

Claude's review of PR #450

• Gather context (PR diff, changed files, repo instructions)
• Understand the request (CI review lane for this repin PR)
• Verify SHA/version consistency across changed files
• Check for any other stale ci-workflows references in the repo
• Post findings / summary

No blocking findings. This is a clean, mechanical pin bump.

What I checked

• Internal consistency: every changed uses: line pairs the new SHA 6ba73b9 with the # v0.39.0 comment, in both .github/workflows/pr-automerge-dependabot.yml and .github/workflows/pr-require-checks.yml. release/dependencies.json's repositoryPins entry (commit + source URL) matches the same SHA. No line mixes an old SHA with the new comment or vice versa.

• Completeness of the "repo-owned only" claim: I grepped the whole repo for the old SHA/v0.38.2 and for every melodic-software/ci-workflows reference. Three callers still pin the old SHA and were not touched by this PR:

  • pr-check-managed-files-hosted.yml#L105
  • pr-review-security-hosted.yml#L84
  • pr-review-hosted.yml#L83

  I confirmed each of these three carries a SYNC-MANAGED FILE: DO NOT EDIT IN THE CONSUMING REPOSITORY header pointing at a melodic-software/standards component, so leaving them for the standards sync (per the PR's "Fix" section) is correct — the PR's scoping claim holds.

• Two touched workflow files (pr-automerge-dependabot.yml, pr-require-checks.yml) carry no such sync-managed header, confirming they are genuinely repo-owned and in scope for a manual repin.

• No caller-facing input changes: the diff in both workflows is pin-line-only (SHA + comment); no with: blocks, triggers, or permissions changed.

Not independently verified (author-claimed)

• That 6ba73b97b058602c4dd2bb6e2cce234d11011787 is in fact the commit tagged v0.39.0 in melodic-software/ci-workflows, and that every pinned path exists at that commit — my sandboxed environment here has no network/gh api access to the upstream repo, so I could not re-derive this independently.
• That actionlint passes on the changed workflows — no actionlint binary available in this sandbox to re-run it. (YAML structure around the edited lines is otherwise unremarkable: only existing uses: scalar values changed, no indentation or key changes.)
• Merge status of melodic-software/standards#732 and its effect on the runner-policy check.

Note

release/dependencies.json's repositoryPins entry has no version field (unlike the version-bearing entries above it in the same file), but that's a pre-existing shape this PR didn't touch — out of scope here.

[claude]

Claude finished @kyle-sexton's task in 58s —— View job

---

Security review: no issues found

• Gather context (PR diff, changed files)
• Apply skip gate
• Review changed files for security-relevant surface
• Check for instruction-surface deletions
• Adversarial validation of any candidate findings
• Post final results

Scope: .github/workflows/pr-automerge-dependabot.yml, .github/workflows/pr-require-checks.yml, release/dependencies.json — diff.

Finding: none. Every change in this PR is a mechanical re-pin of melodic-software/ci-workflows references from cf316d1 (v0.38.2) to 6ba73b9 (v0.39.0):

• All 16 uses: lines in pr-require-checks.yml and the one in pr-automerge-dependabot.yml move to the same new full-length commit SHA, each still paired with a matching # v0.39.0 version comment (no pin loosened to a branch/tag, no mismatch between SHA and comment within the diff).
• release/dependencies.json records the identical SHA, consistent with the workflow pins.
• No permissions: blocks, triggers, secrets handling, or run:/expression-injection surfaces are touched — only the pinned ref on each uses: line changes.
• No CLAUDE.md/AGENTS.md/rules-file edits in this diff, so the instruction-surface-deletion check does not apply.

Supply-chain risk from the pin bump itself (whether 6ba73b9 is genuinely what ci-workflows@v0.39.0 points to, and whether anything shifted under that tag) is zizmor's advisory lane per this review's scope and is not re-reported here. Within this lane's remit (logic/trust-boundary/injection reasoning static analysis misses), there is nothing to flag.

[github-actions]

claude-security-review has reviewed this pull request through 1af1c00; a later push is reviewed from there.

[github-actions]

claude-review has reviewed this pull request through 1af1c00; a later push is reviewed from there.