From 8bfda672890787ded584ff30c1b5a7e33922cfbe Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sun, 25 Oct 2026 23:44:56 -0400
Subject: [PATCH] ci(review): repin the review callers to ci-workflows v0.65.14

v0.65.14 reports a failed "Isolate the runner" install as install-failed
instead of no-outcome (ci-workflows#893). Only pr-review-cli.yml and the
actions it loads from its own ref changed, so only its two callers move.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/pr-review-hosted.yml          | 2 +-
 .github/workflows/pr-review-security-hosted.yml | 2 +-
 scripts/ci-review-lanes.test.sh                 | 6 +++---
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/pr-review-hosted.yml b/.github/workflows/pr-review-hosted.yml
index b43151aa7f..05a6a64162 100644
--- a/.github/workflows/pr-review-hosted.yml
+++ b/.github/workflows/pr-review-hosted.yml
@@ -169,7 +169,7 @@ jobs:
       contents: read
       pull-requests: write   # the review, its inline comments and the lane's
                              # reviewed-head marker comment
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@ba7af78d291f10bd75651857a0db2357c23df0fe # v0.65.13
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@3180217076b19bbdfccc43026c7f91c604da673d # v0.65.14
     with:
       lane: code
       publish: comments
diff --git a/.github/workflows/pr-review-security-hosted.yml b/.github/workflows/pr-review-security-hosted.yml
index 969864c263..389a59635e 100644
--- a/.github/workflows/pr-review-security-hosted.yml
+++ b/.github/workflows/pr-review-security-hosted.yml
@@ -174,7 +174,7 @@ jobs:
       contents: read
       pull-requests: write   # the review, its inline comments and the lane's
                              # reviewed-head marker comment
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@ba7af78d291f10bd75651857a0db2357c23df0fe # v0.65.13
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@3180217076b19bbdfccc43026c7f91c604da673d # v0.65.14
     with:
       lane: security
       publish: comments
diff --git a/scripts/ci-review-lanes.test.sh b/scripts/ci-review-lanes.test.sh
index 9a29a57ac5..edc8d1d294 100755
--- a/scripts/ci-review-lanes.test.sh
+++ b/scripts/ci-review-lanes.test.sh
@@ -76,10 +76,10 @@ for pair in 'pr-review-hosted.yml pr-review:' 'pr-review-security-hosted.yml pr-
   caller="$ROOT/.github/workflows/$file"
   if grep -qxF "  $job" "$caller" && grep -qxF '      publish: comments' "$caller" &&
     grep -qxF '      hold-label: needs-human' "$caller" &&
-    grep -qE '^    uses: melodic-software/ci-workflows/\.github/workflows/pr-review-cli\.yml@ba7af78d291f10bd75651857a0db2357c23df0fe # v0\.65\.13$' "$caller"; then
-    ok "$file calls pr-review-cli v0.65.13 as job ${job%:} with publish: comments and hold-label: needs-human"
+    grep -qE '^    uses: melodic-software/ci-workflows/\.github/workflows/pr-review-cli\.yml@3180217076b19bbdfccc43026c7f91c604da673d # v0\.65\.14$' "$caller"; then
+    ok "$file calls pr-review-cli v0.65.14 as job ${job%:} with publish: comments and hold-label: needs-human"
   else
-    fail "$file lost its job id, publish: comments, hold-label or v0.65.13 pin"
+    fail "$file lost its job id, publish: comments, hold-label or v0.65.14 pin"
   fi
   # pr-review-cli's check-key-credit job requests actions: read; a caller that
   # does not grant it fails at startup.