chore(pr-pipeline): decide code-owner review on .github/** and verify the ci-status lanes hold step's runner tools #9422

Activity

1. github-actions

   added

   needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

   on Oct 23, 2026
2. github-actions commented on Oct 23, 2026

   

   github-actionsBot

   on Oct 23, 2026 – with GitHub Actions

   Contributor

   More actions

   Proposed work class: none

   Thanks for the report. Automated triage handed this issue to a maintainer.

   _{Automated triage. A maintainer reviews it.}
3. github-actions

   added

   needs-humanHuman-in-the-loop required; autonomous sessions must not resolve items carrying this.Human-in-the-loop required; autonomous sessions must not resolve items carrying this.

   and removed

   needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

   on Oct 23, 2026
4. github-actions

   added the

   Task

   issue type on Oct 23, 2026
5. melodic-automation-lanes

   added

   status: needs-decisionAwaiting a human or maintainer judgment call.Awaiting a human or maintainer judgment call.

   on Oct 23, 2026
6. kyle-sexton commented on Oct 26, 2026

   

   kyle-sexton

   on Oct 26, 2026

   MemberAuthor

   More actions

   Decision recorded. The owner answered in the Issue Triage session (2026-10-25), accepting the recommended answers below:

   go with whatever the facts/data/metrics + /discovery:research says and ensure we're aligned with SOLID, DRY/SSOT principles

   AND whatever is aligned with my overall goal of lowest friction, highest throughput (within our environmental, github, rate limit, etc. constraints)

   Question asked: Keep the permission-based mitigation without required code-owner review on .github/** (security call)?

   Standing rule: none found on this issue. No owner decision record or owner-approved body text answers item 1; the body names it the owner's call. No intake refinement exists; triage handed the issue to a maintainer. Open items are the body's two gaps.

   1. Require code-owner or ruleset review on .github/**, or keep the permission-based mitigation? Security call.
      Accepted: Keep the permission-based mitigation (the lanes App has no workflows permission, and apply-patch refuses .github/workflows paths). CODEOWNERS on main already requests owner review on /.github/workflows/** and says required code-owner review is off by owner decision. Basis: origin/main .github/CODEOWNERS:1-5,22. That file text is not a decision record on this issue, so the owner confirms here.
   2. The ci-status job's hold step needs node with path.matchesGlob and yq.
      Accepted: The Node half is done: ci-status now sets up Node from the base .node-version on pull_request and merge_group, the events the hold step runs on. yq still comes from the runner image; read one lanes App PR's ci-status log for the hold step's verdict line, or pin yq in the job. Basis: .github/workflows/pr-require-checks.yml:3705-3709 (setup-node in the ci-status job, which starts at :3106), :4746 (yq use). Correction to the body: its "no setup-node" no longer holds on main.

   Acceptance criteria:

   • The ci-status job sets up Node before the hold step on pull_request and merge_group.

   Checks a person runs:

   • None for item 1: this record decides it.
   • A lanes App pull request's ci-status log shows the hold step reaching its verdict line, or the job pins yq. (From the body's Acceptance, narrowed to yq.)

   Verified, closing as done. The person check holds: on lanes App PR #10123, ci-status (run https://github.com/melodic-software/claude-code-plugins/actions/runs/40235200462, job 121296674087) ran step 8 Set up Node and step 15 Fail a lanes App pull request its body or a member holds, both success, so the hold step reached its verdict with the runner image's yq. Item 1 keeps the existing mitigation, which matches .github/CODEOWNERS:22.
7. kyle-sexton

   closed this as completedon Oct 26, 2026
8. kyle-sexton

   removed

   status: needs-decisionAwaiting a human or maintainer judgment call.Awaiting a human or maintainer judgment call.

   needs-humanHuman-in-the-loop required; autonomous sessions must not resolve items carrying this.Human-in-the-loop required; autonomous sessions must not resolve items carrying this.

   on Oct 26, 2026
9. kyle-sexton commented on Oct 26, 2026

   

   kyle-sexton

   on Oct 26, 2026

   MemberAuthor

   More actions

   Released for re-triage under the owner's 2026-10-26 rule: a person is involved only for "1. A change in original intent/vision 2. Something comes up during implementation ... that alters intent/vision or the primary design 3. If there is a HIGH/CRITICAL security issue". None applies here, so the hold label came off and intake triage runs again now.

   To hold this issue again, add needs-human (or status: needs-decision) and name which of the three applies.