[kyle-sexton]

No related issue: catch-up repin after standards#884 (owner-approved changed-paths repin)

Summary

This moves the lagging melodic-software/ci-workflows pins to the latest release, v0.65.15 (30b251532b2e9f7e0c4215e1dee5be0d3c688743). The pins were written by the standards repin tool (components/claude-lanes/repin-callers.sh apply ... --root, standards 6081206), not by hand.

Counts:

• Moved: 46 pin lines in 8 workflow files. Before the move, 22 were on v0.58.0, 22 on v0.65.13 and 2 on v0.65.14.
• Kept by the tool's changed-paths check: 0.
• Already at v0.65.15: 1 (intake-triage.yml, from ci(intake): repin intake triage to ci-workflows v0.65.15 #10258).
• Reverted after apply: 3 pins in 3 files (below).

Fix

• Reverted: .github/workflows/intake-label-needs-triage.yml stays on v0.58.0 (5e18f3d). It needs a standards contract. Runner-policy has no reviewed runner-input contract for intake-label-needs-triage.yml@30b2515, and auto-approval declined: the workflow carries a reviewed allowedCallerPermissions grant, and the surface diff cannot prove its steps unchanged. policy.json is synced, so the contract belongs in standards.
• Reverted: two standards-managed callers. maintenance-check-links-online-claude-code-plugins.yml stays on v0.59.0 and pr-check-managed-files-hosted.yml stays on v0.65.14. Both are managed by the sync manifest, and the managed-files guard rejected the hand-edit (run 40315903587). Their pins move when standards-sync lands them.
• run-claude-cli hardcodes. The tree SHA of .github/actions/run-claude-cli is 009acf74 at both ba7af78 and 30b2515, and the same holds for apply-claude-managed-settings (1301e911). The compare ba7af78...30b2515 touches no file under either directory. So --permission-prompts none (lane.cjs:404-405), cliArgs, LEG_ENV, CLI_VERSION, MANAGED_SETTINGS and SUMMARY_NOTES are unchanged. The tool moved these pins under its fail-closed rule, because other files in that release changed. This PR therefore:
  • bumps RUN_CLAUDE_CLI_PIN in .github/scripts/pr-verify/probe/replay.mjs, with no behavior change;
  • adds 30b2515 to PERMISSION_PROMPTS_NONE_LAUNCHERS in .github/actions/resolve-config/callers.test.mjs, and updates the pinned-SHA comments there.

Verification

• node --test .github/actions/resolve-config/callers.test.mjs .github/scripts/pr-verify/probe/*.test.mjs: 211 pass, 0 fail.
• bash scripts/ci-review-lanes.test.sh: PASS=98 FAIL=0.
• bash scripts/check-affected.sh --tests: 9 passed, 5 skipped over 12 changed files.
• node .github/standards/runner-policy/runner-policy.mjs --root .:
  • After apply, the only finding was the intake-label-needs-triage pin. pr-review-cli and the composite actions passed.
  • A rerun after the revert could not fetch commit trees, because the local run is unauthenticated and hit the anonymous rate limit (403). CI's runner-policy step runs with a token and decides this.

Related

• standards#884: the changed-paths repin tool.
• ci(intake): repin intake triage to ci-workflows v0.65.15 #10258: intake-triage repin to v0.65.15.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DpzEJAE4EMndcWQXiKSZYn

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T11:40:36.967148Z	7439094	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed 7cd905f13a9a1728ea267ddfeadef006d76ff731: 0 finding(s), 0 as inline comments.

No findings. I read the whole diff and the PR context. I could not check anything against upstream ci-workflows or run any tests.

What the change is. It moves 46 melodic-software/ci-workflows pin lines to v0.65.15 (30b2515), and the diff shows the same 46. In callers.test.mjs, it adds 30b2515 to PERMISSION_PROMPTS_NONE_LAUNCHERS and updates the pinned-SHA comments. In replay.mjs, it bumps RUN_CLAUDE_CLI_PIN.

What I checked myself.

• No stale launcher pins. No ba7af78 pin remains on any run-claude-cli or apply-claude-managed-settings step. parity.test.mjs:119 requires those steps to match RUN_CLAUDE_CLI_PIN, and the diff moves all of them together with that constant.
• ba7af78 kept on purpose. It is still in the launcher allowlist and in the policy.json entries for intake-triage.yml and pr-review-cli.yml. Dropping it would break nothing, and keeping it is harmless.
• policy.json has no pr-review-cli.yml@30b2515 entry. Only intake-triage.yml@30b2515 (line 468) is there. Runner-policy can approve a bumped SHA automatically when the workflow's runner surface is unchanged (runner-policy.mjs around line 1056). The PR says it did this for pr-review-cli.yml. I did not run runner-policy, so CI's runner-policy step is what decides this.

Author-claimed and not verified by me:

• That the trees for run-claude-cli and apply-claude-managed-settings are identical at ba7af78 and 30b2515. The --permission-prompts none claim at lane.cjs:404-405 rests on this.
• That the other actions moved here (report-lane-outcome, check-managed-files, detect-changes, and so on) behave the same.
• The test counts under Verification.

Trusted paths. pr-require-checks.yml changes only the pin lines, including the check-managed-files guard step. Nothing else on a trusted path changes.

Spend. None. This changes no billing, plan, or usage settings.

Left undone, as the PR says. Three pins were reverted and move later through standards: intake-label-needs-triage.yml (needs a standards contract), and two standards-managed callers that move with standards-sync.

[github-actions]

claude-security-review reviewed 7cd905f13a9a1728ea267ddfeadef006d76ff731: 0 finding(s), 0 as inline comments.

I found no security issues in this pull request, and I'm not holding it.

The diff is a pin bump of melodic-software/ci-workflows to v0.65.15 (30b251532b2e9f7e0c4215e1dee5be0d3c688743). It has no logic changes, no manifest changes, and no instruction-surface deletions. I read the diff and the PR context only. I had no network access, so I could not compare the upstream releases.

• Pins: every new pin uses the same 40-character SHA with a # v0.65.15 comment. None is a floating tag or branch, and I saw no changes to permissions:, triggers, with: inputs or env: blocks.
• Trusted-path workflow .github/workflows/pr-require-checks.yml: the diff only moves pins from v0.58.0. They cover lint and scan actions, check-managed-files, pr-require-checks/check-contract and pr-require-checks/aggregate-results. No if:, needs: or gate wiring changes, so no merge hold is weakened in this repository's code. What the three gate actions do in v0.65.15 comes from a different repository, so this diff cannot show it. The PR itself says the repo's runner-policy check validates the pin move and that its CI step decides it with a token.
• Test allowlist: PERMISSION_PROMPTS_NONE_LAUNCHERS in .github/actions/resolve-config/callers.test.mjs gains the new SHA, and RUN_CLAUDE_CLI_PIN in .github/scripts/pr-verify/probe/replay.mjs moves to match. These are test and probe-parity values. Whether run-claude-cli@30b2515 still passes --permission-prompts none rests on the PR's claim that the run-claude-cli and apply-claude-managed-settings tree SHAs are unchanged between ba7af78 and 30b2515. I could not check that claim, so a reviewer who can reach ci-workflows should check the compare.
• Cost: none. The change adds no paid resources and no new lane runs.

manifest fields: none touched.
critical-findings: 0