[kyle-sexton]

No related issue: release v0.1.35 failed pedantic zizmor (run 39374988850)

Summary

v0.1.35 (run 39374988850) failed Audit workflow security: zizmor 1.30.1 --persona pedantic reports undocumented-permissions on pr-check-managed-files-hosted.yml:85 (pull-requests: read with no comment). That file is sync-managed from melodic-software/standards, so as with v0.1.25 the fix lands upstream: melodic-software/standards#816, then the next standards sync PR here.

Fix

• docs/releases.md: record v0.1.35 as reserved, no release assets.
• No local edit to the managed caller; the managed-files guard would reject it.

Release order: merge standards#816, merge the resulting chore: sync standards components PR here, then tag v0.1.36 from that main commit. Tagging before the sync lands repeats the failure.

Verification

Every step of release-publish-image.yml job Verify exact tagged source, run locally against this branch head (d9f7380) with Go 1.27.2, Node 24.21.0, PowerShell 7.6.7:

Step	Command	Result
Release version and main ancestry	git merge-base --is-ancestor HEAD origin/main	n/a before merge (exits 1: the branch head is not on main yet); the tag regex is checked at tag time
Immutable pins	pwsh ./scripts/Test-ReleasePins.ps1	pass
Dependency freshness	GITHUB_TOKEN=$(gh auth token) ./scripts/Test-DependencyFreshness.ps1 -OutputPath …	pass (hardFail=False)
Module graph	go mod tidy -diff; go mod verify	pass
Vet	go vet ./...	pass
Tests	go test ./...	pass
Race	go test -race ./...	pass
govulncheck	go run golang.org/x/vuln/cmd/govulncheck@v1.8.0 ./...	pass
Workflow scripts	node --test .github/scripts/*.test.cjs	pass
actionlint + shellcheck	go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 -color -ignore 'unexpected key "queue" for "concurrency" section'	pass
zizmor (branch head)	pinned ghcr.io/zizmorcore/zizmor:1.30.1@sha256:a2eb396d…, --persona pedantic, online, over .	fail: 1 undocumented-permissions (expected until the sync lands)
zizmor (post-sync simulation)	same, over this tree with standards#816's template at .github/workflows/pr-check-managed-files-hosted.yml	pass, no findings
Worker image build	docker buildx build --load (local default builder, not the pinned BuildKit v0.34.0 builder)	pass
Worker image contract	./scripts/verify-worker-image.sh ci-runner-worker:release-verification	pass
Windows compilation	GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build -trimpath for ci-runner and ci-runner-controller (-H=windowsgui)	pass

Not reproduced locally: the checksum-verified Buildx install and the pinned BuildKit builder setup (the image was built with the local Docker builder).

Related

• melodic-software/standards#816: the upstream fix.
• docs: record v0.1.25 as a reserved release tag #387, chore: sync standards components #388: the same path for v0.1.25.
• build(deps): refresh release dependencies past the freshness window #484: the v0.1.34 freshness fix.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Q6B1MWhz73WFRYyyrKjtjY

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T05:36:22.178512Z	d9f7380	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review needs no new review of d9f73805e8e62a8ff8954dc2ac808e38012337fe: every file in scope matches docs-only-paths.

[github-actions]

claude-review reviewed d9f73805e8e62a8ff8954dc2ac808e38012337fe: 0 finding(s), 0 as inline comments.

No findings. The PR changes one file, docs/releases.md, and adds v0.1.35 to the list of reserved release tags. It follows the existing entries (v0.1.25, v0.1.34) in wording and punctuation. I read the diff and the surrounding text of docs/releases.md and found no formatting or consistency problems.

The PR body says there is no related issue, and the file's only path-scoped rule (.claude/rules/pr-body-contract.md) is advisory. The body has an issue-linkage line and fills the Summary, Fix, Verification and Related sections.

I did not independently verify the author's claimed local checks (zizmor, tests, image build) or the upstream standards#816 fix. Those are author-claimed and unverified.