Skip to content

ci(lanes): repin the Claude lane callers to ci-workflows v0.65.11 - #10147

Merged
kyle-sexton merged 2 commits into
mainfrom
ci/repin-lanes-v0.65.11
Oct 26, 2026
Merged

ci(lanes): repin the Claude lane callers to ci-workflows v0.65.11#10147
kyle-sexton merged 2 commits into
mainfrom
ci/repin-lanes-v0.65.11

Conversation

@kyle-sexton

@kyle-sexton kyle-sexton commented Oct 26, 2026

Copy link
Copy Markdown
Member

Refs: melodic-software/ci-workflows#889

Summary

Repins every Claude lane caller to ci-workflows
v0.65.11
(e5167fc29d948ab7d0923cf62f5ea9eeeef8e9e8), so the lane-outcome record
carries each leg's token usage and subscription rate-limit windows
(ci-workflows#889).

Fix

  • Reusable-workflow callers: pr-review-hosted.yml and
    pr-review-security-hosted.yml (pr-review-cli.yml, from v0.65.9) and
    intake-triage.yml (from v0.65.10). In v0.65.11 those reusables pass
    log-file to report-lane-outcome themselves. No input, secret or
    permission changes.
  • Composite-action callers: pr-run-activity-read.yml,
    pr-run-activity-write.yml, pr-unblock.yml and pr-verify.yml move
    run-claude-cli, report-lane-outcome and apply-claude-managed-settings
    from v0.65.0 (d02b8697). Between those SHAs the three actions change only
    by claude-config: audit-instructions — add step-list-culling eval case (absorb candidate from audit-model-fit) #889: the new optional log-file input and a usage warning.
  • pr-run-activity-read.yml and pr-verify.yml wire run-claude-cli to
    report-lane-outcome themselves, so their report steps now pass the leg's
    log-file.
  • pr-run-activity-write.yml reports on a claude-code-action leg, which
    writes no run-claude-cli log. It gets the pin only, so its record gains no
    usage or windows.
  • pr-unblock.yml has no report-lane-outcome step. It gets the pin and the
    usage warning only.
  • Tests: callers.test.mjs adds e5167fc2 to the launchers checked to pass
    --permission-prompts none (lane.cjs:357-358 at that SHA). The
    replay.mjs pin, ci-review-lanes.test.sh and
    ci-review-plugin-source.test.sh move with it.

Verification

  • node --test .github/actions/resolve-config/callers.test.mjs: 182 pass, 0 fail.
  • node --test .github/scripts/pr-verify/probe/parity.test.mjs .github/scripts/pr-verify/probe/replay.test.mjs: 24 pass, 0 fail.
  • bash scripts/ci-review-lanes.test.sh: 88 pass, 0 fail. bash scripts/ci-review-plugin-source.test.sh: 10 pass, 0 fail.
  • bash scripts/check-changelog-fragments.sh --check-required origin/main: no fragment-mode plugin changed, so none is required.
  • The runner-policy contracts for this SHA landed in standards and synced here first (see Related).

Related

🤖 Generated with Claude Code

kyle-sexton and others added 2 commits October 25, 2026 19:50
@kyle-sexton @claude
ci(lanes): repin the Claude lane callers to ci-workflows v0.65.11
a079813 
Moves the review, intake, pr-run-activity, pr-unblock and pr-verify callers
to e5167fc29d948ab7d0923cf62f5ea9eeeef8e9e8 (ci-workflows#889), and passes
run-claude-cli's log-file to report-lane-outcome where the caller wires the
two actions itself, so the lane-outcome record carries token usage and
rate-limit windows.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@kyle-sexton
Merge remote-tracking branch 'origin/main' into ci/repin-lanes-v0.65.11
4c9acc1
@kyle-sexton
kyle-sexton marked this pull request as ready for review October 26, 2026 00:57
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-26T00:59:09.487800Z 4c9acc1 Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@kyle-sexton
kyle-sexton enabled auto-merge October 26, 2026 00:58
@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown
Contributor

claude-review reviewed 4c9acc1cc68e95b8f9598b7bbd1d91097e2e4d2d: 0 finding(s), 0 as inline comments.

No findings. This is a pin bump of the Claude lane callers to ci-workflows v0.65.11 (e5167fc2).

What I checked in the diff:

  • Pins: Every changed uses: line carries the new SHA with a # v0.65.11 comment. A grep of the repository, excluding .claude-lane/, finds no leftover d02b8697, 4fbceb4b or 215cec5c in a workflow uses: line. The remaining hits are:
    • policy.json entries for the older pins.
    • callers.test.mjs:1481, a PINNED constant for intake-triage.yml.
    • The d02b8697 entry in the PERMISSION_PROMPTS_NONE_LAUNCHERS set, which still lists the older launcher SHAs.
  • Runner policy: .github/standards/runner-policy/policy.json already has entries for intake-triage.yml@e5167fc2 (line 388) and pr-review-cli.yml@e5167fc2 (line 1171), as the PR description says.
  • New log-file wiring: pr-run-activity-read.yml passes steps.act-key.outputs.log-file || steps.act-token.outputs.log-file, and pr-verify.yml passes steps.judge.outputs.log-file. Both match the existing execution-file wiring. I could not read the ci-workflows action source, so I did not confirm that run-claude-cli@e5167fc2 declares a log-file output or that report-lane-outcome accepts the input. An unset output would resolve to an empty string, so this is low risk.
  • pr-run-activity-write.yml and pr-unblock.yml: Pin only, as the description says. Nothing here sets a hold class.
  • Tests: The new launcher SHA is added to the --permission-prompts none set and the lane test patterns are updated. I did not run any tests. The pass counts in the PR body are author-claimed and unverified.
  • Cost: No billing change. Reporting the extra token and rate-limit data in the lane-outcome record spends no extra credits.

@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown
Contributor

claude-security-review reviewed 4c9acc1cc68e95b8f9598b7bbd1d91097e2e4d2d: 0 finding(s), 0 as inline comments.

No security findings.

critical-findings: 0

This PR repins the Claude lane callers to ci-workflows v0.65.11 (e5167fc29d948ab7d0923cf62f5ea9eeeef8e9e8) and adds a log-file input to the report-lane-outcome steps. It also updates the tests and the replay pin to match.

  • Pins: Every changed uses: is the same-org melodic-software/ci-workflows at a full 40-character SHA, with a version comment. I found no tag refs, short SHAs, foreign repositories or unpinned references. The pins in the old d02b8697 and 4fbceb4b form that remain are in callers.test.mjs and .github/standards/runner-policy/policy.json. The callers.test.mjs references are the intentional allowlist history. I did not read policy.json. It is not in this diff.
  • Permissions and triggers: No workflow permissions:, triggers, secrets or with: inputs changed, except the added log-file.
  • log-file wiring: It passes steps.<launcher>.outputs.log-file, a step output from the pinned run-claude-cli. No PR-controlled or github-context text is interpolated into a run: block. I could not read the pinned action's code, so whether log-file is safe to pass downstream rests on the PR description. The description says the new input is optional and used only for the usage and rate-limit record.
  • Permission-mode allowlist: PERMISSION_PROMPTS_NONE_LAUNCHERS gains e5167fc2, backed by the cited lane.cjs:357-358. The test still fails on any pin that is not listed, so the check is not weakened. I did not read that line at the pinned SHA, since it is outside the checkout.
  • Trusted paths: None of the 11 changed files match the listed globs.
  • Manifests: No plugin manifests changed.
  • Instruction surface: No instruction or guardrail text was removed or softened.
  • PR context: I found no embedded directives.
  • Cost: None. The PR adds only a usage and rate-limit record and changes no billing, plan or turn limit.

@kyle-sexton
kyle-sexton added this pull request to the merge queue Oct 26, 2026
Merged via the queue into main with commit b8216d9 Oct 26, 2026
67 checks passed
@kyle-sexton
kyle-sexton deleted the ci/repin-lanes-v0.65.11 branch October 26, 2026 01:06
This was referenced Oct 26, 2026
Merged
Merged
kyle-sexton added a commit to melodic-software/standards that referenced this pull request Oct 26, 2026
@kyle-sexton @claude
feat(claude-lanes): repin only the ci-workflows paths a release chang…
0a96fd4 
…ed (#884)

Refs: melodic-software/claude-code-plugins#10151

## Summary

Owner decision (2026-10-25): a ci-workflows repin moves only the pinned
paths a
release actually changed, not every pin, and the existing repin tool
(`components/claude-lanes/repin-callers.sh`) stays the single source of
truth for
repins.

Evidence:

- The `v0.65.12...v0.65.13` compare changed only
`.github/workflows/pr-review-cli.yml`
  and `.github/scripts/pr-review-cli.test.cjs`.
- Even so, the consumer repin melodic-software/claude-code-plugins#10151
rewrote 21 `uses:`
lines: intake-triage, the `run-claude-cli`,
`apply-claude-managed-settings` and
  `report-lane-outcome` composites, and pr-review-cli.
- Each needless move forces runner-policy contract PRs for job-level
reusable workflows.
- Each needless move also fails lane runs already in flight with a
workflow-modified 403
  (4 intake runs on melodic-software/claude-code-plugins#10147).

## Fix

`repin-callers.sh apply` now decides each
`melodic-software/ci-workflows/<path>@<sha>` ref
separately:

- **One compare per distinct pinned SHA**,
`compare/<pinned>...<release>`, cached for the
run. The same response feeds the downgrade fence and the file list. The
fence is
unchanged in meaning: a fallback-form pin the release does not contain
(`behind` or
  `diverged` in this direction) is left as is.
- **Moved**: the release changed the reusable workflow file, anything
under the composite
directory (tests included), or a path the pin reaches through a
commit-relative
  `uses:`. Those are a step-level `$/<dir>` action or a job-level
`./.github/workflows/<file>` nested workflow, the two forms
runner-policy diffs. Each is
read once from the release, transitively. intake-triage, for example,
runs
`$/.github/actions/run-claude-cli` and `report-lane-outcome`, so a
change to those moves
  intake-triage too.
- **Fail closed**, moving every pin at that SHA, in two cases: the
compare lists 300 or
more files (the documented cap), or it changed a file that is not a test
(`*.test.*`),
not a `README.md`, not under `docs/`, and not reached by any pin (for
example a shared
  `.github/scripts/*.cjs` or `schemas/`). That is today's behavior.
- **Unchanged pins stay byte-identical.** Moved pins get the release SHA
with the
  `# vX.Y.Z` comment. The version note lists what moved and what stayed.
- **`--root <dir>`** runs the same tool against any repository. It
discovers every
git-tracked `.github/` YAML file that pins ci-workflows, so a consumer
checkout such as
claude-code-plugins repins with this tool instead of hand edits. The
rename map is read
from beside the script. The standards lane's invocation (no `--root`,
enumerated
callers) is unchanged. The apply step now gets `GH_TOKEN`, because it
calls `gh` on any
  day a new release resolves.

`repin-policy-lockstep.mjs` plans only the pins apply moved, so an
unchanged reusable pin
keeps its existing contract and needs no contract copy. Its own caller
rewrite
(`rewriteCallerFiles`) is removed: it rewrote every pin in its target
files to the new
SHA, which would have undone the selective repin, and apply already
rewrites those files.
Its two unit tests go with it.

Out of scope and unchanged: no runner-policy contract rule is loosened,
nothing
auto-admits a secret-bearing runner-input contract, and
`components/runner-policy/policy.json`
semantics are untouched.

## Verification

Run from the worktree root:

- `bash harness/shell/run-tests.sh
components/claude-lanes/repin-callers.test.sh`: pass,
  161 assertions (the existing 129 plus 32 new). New cases:
- only `pr-review-cli.yml` changed moves only that ref, with one compare
call;
  - a shared-script change moves all refs;
  - a composite-directory change moves only that composite;
  - a composite reached through a nested workflow moves the reusable;
- an inert-only change moves nothing, while the same files at the
300-file cap move
    everything;
  - two distinct SHAs cost two compares;
- the standards lane's own invocation moves only the changed lane
caller.
- Mutation check: forcing every decision to `move`, dropping
fail-closed, dropping reach,
dropping the cap, dropping the compare cache, counting tests, or
dropping the directory
prefix rule each turns new cases red. Inverting the fence statuses turns
20 assertions
  red.
- `node --test components/claude-lanes/repin-policy-lockstep.test.mjs`:
23 pass. The two
new tests (only moved pins are planned; `settleLockstep` leaves an
unmoved caller pin
  alone) fail against the previous script.
- `bash harness/shell/run-tests.sh
components/claude-lanes/claude-lanes.test.sh` and
`node --test components/runner-policy/runner-policy.test.mjs` (355):
pass.
- `shellcheck --rcfile .shellcheckrc`, biome, actionlint and zizmor on
the changed files:
  clean.
- End to end against the live v0.65.13 compare on a copy of
claude-code-plugins'
  `.github/` from before #10151 (442 files, 47 pins):
- Real snapshot: 46 of 47 pins move, because none of the pinned SHAs is
v0.65.12. The
    lane pins were at v0.65.11, and `v0.65.11...v0.65.13` also changed
`schemas/lane-outcome.v1.schema.json`, so they fail closed exactly as
#10151 moved
them. The v0.55, v0.58 and v0.59 pins fail closed on
`.github/scripts/*.cjs` and
    `.claude/rules/*.md`.
- Synthetic variant with every pin set to v0.65.12: only the two
`pr-review-cli.yml`
    lines move, and the other 45 stay byte-identical.

Consumer command, from any directory with an authenticated `gh`, `jq`,
GNU sed and bash
4.4 or newer:

```bash
GITHUB_OUTPUT=/tmp/repin.out bash <standards-checkout>/components/claude-lanes/repin-callers.sh resolve melodic-software/ci-workflows
GITHUB_OUTPUT=/tmp/repin.out bash <standards-checkout>/components/claude-lanes/repin-callers.sh apply <tag> <sha> <date> --root <consumer-checkout>
```

`resolve` writes `tag`, `sha` and `date` to the output file. `apply`
leaves the moved pins
in the consumer's working tree and writes `changed`, `old-sha`,
`old-tags` and
`version-note`.

## Related

- Refs melodic-software/claude-code-plugins#10147 (in-flight intake runs
failed with a
  workflow-modified 403 by the full repin).
- The inert set stays tests, `README.md` and `docs/` by owner decision:
lanes may load other
`.md` files as instructions, so a change to one can change what a pin
runs.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01DpzEJAE4EMndcWQXiKSZYn

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@kyle-sexton