[kyle-sexton]

No related issue: routine repin to ci-workflows v0.65.17 (artifact retention and shellcheck flake fix)

Summary

This moves the melodic-software/ci-workflows pins from v0.65.15 (30b251532b2e9f7e0c4215e1dee5be0d3c688743) to v0.65.17 (81a603a6e2b0319428c981bf28f3fe923032afb2). The release carries ci-workflows#900 (tool release-asset caches saved from the default branch only) and ci-workflows#901 (shellcheck/shfmt test counter lock). The pins were written by the standards repin tool (components/claude-lanes/repin-callers.sh apply ... --root, standards de51bae), not by hand.

Counts:

• Moved: 55 pin lines in 9 workflow files, all from v0.65.15.
• Kept by the tool's changed-paths check: 0.
• Skipped by the tool as sync-managed: 2 (maintenance-check-links-online-claude-code-plugins.yml on v0.59.0, pr-check-managed-files-hosted.yml on v0.65.14).
• Reverted after apply: 2 pins in 1 file (below).

Fix

• Reverted: .github/workflows/intake-triage.yml. intake-triage.yml stays on v0.65.15 and intake-label-needs-triage.yml stays on v0.58.0 (5e18f3d). Runner-policy has no reviewed runner-input contract for either at 81a603a, and auto-approval declined: both carry a reviewed allowedCallerPermissions grant, and the surface diff cannot prove their steps unchanged. policy.json is synced, so the contracts belong in standards.
• run-claude-cli hardcodes. The tree SHA of .github/actions/run-claude-cli is 009acf74 at both 30b2515 and 81a603a, and the same holds for apply-claude-managed-settings (1301e911) and report-lane-outcome (ba4afef9). The compare 30b2515...81a603a touches no file under those directories, and lane.cjs:404-405 at 81a603a still passes --permission-prompts none. The tool moved these pins under its fail-closed rule. This PR therefore:
  • bumps RUN_CLAUDE_CLI_PIN in .github/scripts/pr-verify/probe/replay.mjs, with no behavior change;
  • adds 81a603a to PERMISSION_PROMPTS_NONE_LAUNCHERS in .github/actions/resolve-config/callers.test.mjs, and updates the pinned-SHA comments there.
• scripts/check-affected.sh comment. The machine-paths scan comment names the ci-workflows release it mirrors and asks for a recheck when the pin moves. The compare touches nothing under check-machine-paths, so only the named release moves to v0.65.17.
• The release range also holds ci-workflows#897, which renames the fallback secret of pr-review.yml and pr-review-security.yml. This repository calls pr-review-cli.yml, whose blob (2671b368) is identical at both SHAs, so nothing here changes.

Verification

• node --test .github/actions/resolve-config/callers.test.mjs .github/scripts/pr-verify/probe/*.test.mjs: 224 pass, 0 fail.
• bash scripts/ci-review-lanes.test.sh: PASS=98 FAIL=0.
• bash scripts/check-affected.sh --tests: 10 passed, 4 skipped, 1 failed. The failed check is the shell-suite leg: 52 of 54 selected shell suites passed, and the other two (scripts/ci-test-node-stop-commands.test.sh, scripts/run-hygiene-gate.test.sh) stopped on needs python3 with PyYAML, which this host's python3 lacks. Rerun with a venv from .github/requirements-ci.txt (PyYAML 6.0.3), both pass.
• node .github/standards/runner-policy/runner-policy.mjs --root . (authenticated):
  • After apply, the only findings were the two intake-triage.yml pins.
  • After the revert: Runner policy passed.

Related

• ci: catch up ci-workflows pins with the changed-paths repin tool #10262: the previous repin, to v0.65.15, which this follows.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T17:30:30.565254Z	4eba7f2	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review needs no new review of 3245a759fdb10e63f08e73a860711f423008009a: no file of this pull request changed since the review of 4eba7f2.

No security findings.

critical-findings: 0

I read the whole diff (12 files) and the PR context.

What changed. The melodic-software/ci-workflows pins move from v0.65.15 (30b2515…) to v0.65.17 (81a603a6e2b0319428c981bf28f3fe923032afb2). Every moved pin uses the same full 40-character SHA with a matching # v0.65.17 comment. The only other edits are:

• the RUN_CLAUDE_CLI_PIN constant in .github/scripts/pr-verify/probe/replay.mjs;
• one entry added to the PERMISSION_PROMPTS_NONE_LAUNCHERS allowlist in .github/actions/resolve-config/callers.test.mjs, plus comment updates;
• a comment in scripts/check-affected.sh.

Trusted-path files.

• .github/workflows/pr-require-checks.yml changes only the pin on uses: lines. No permissions:, if:, env:, with: or run: content changes. The ci-status hold steps (check-contract, aggregate-results) get only the new pin.
• .github/actions/resolve-config/callers.test.mjs is a test file under resolve-config. Its allowlist addition is the check that fails a pin bump until someone has read that launcher's lane.cjs. The PR says lane.cjs:404-405 still passes --permission-prompts none at the new SHA. I could not check that here, because the new SHA's contents are not in this checkout. The change does not weaken the check: it adds one reviewed SHA, as the check's own comment asks, and the test file is not code the token broker loads.

What I could not check. I cannot read the upstream ci-workflows code at 81a603a. The PR says the 30b2515...81a603a compare touches nothing under run-claude-cli, apply-claude-managed-settings, report-lane-outcome or check-machine-paths, and that the release holds only #900 (cache saves from the default branch) and #901 (shellcheck test counter lock). I take that as the author's statement, not as something I verified. Whether check-contract and aggregate-results changed upstream is also unverified from this diff. A reviewer who wants to confirm no hold or gate behavior moved can check that compare directly.

Manifests. The diff touches no plugin.json or marketplace.json, so there are no manifest <field> lines.

Instruction surfaces. No instruction, rules, skill or hook content is deleted or softened.

Spend. Nothing here can start a real charge, so there is no cost hold. The tool-cache change (#900) only affects which branch saves caches.

[github-actions]

claude-review needs no new review of 3245a759fdb10e63f08e73a860711f423008009a: no file of this pull request changed since the review of 4eba7f2.

No findings. This is a mechanical repin of melodic-software/ci-workflows from v0.65.15 (30b2515) to v0.65.17 (81a603a). I read the full diff and the PR context, and I did not run any tests.

• Pins: Every changed uses: line moves the SHA and the # v0.65.17 comment together. I found no mixed old/new pairs in the diff.
• Remaining old SHA: A repo-wide grep still finds 30b2515… in .github/workflows/intake-triage.yml and in the intake-triage.yml@30b2515… key of .github/standards/runner-policy/policy.json. That matches the PR's stated deliberate revert, which keeps intake-triage.yml on v0.65.15. The two other hits are the historical entry in the PERMISSION_PROMPTS_NONE_LAUNCHERS allowlist in callers.test.mjs, which should stay.
• Launcher allowlist: 81a603a… is added to PERMISSION_PROMPTS_NONE_LAUNCHERS in .github/actions/resolve-config/callers.test.mjs, a trusted path. The PR's reasoning is that the run-claude-cli tree SHA is identical at both pins. I couldn't confirm that, because I had no access to the upstream repo. I checked only that the diff is consistent with it. The old SHA stays in the set, so rollback and the still-pinned intake-triage.yml are covered.
• replay.mjs: RUN_CLAUDE_CLI_PIN in .github/scripts/pr-verify/probe/replay.mjs moves to the new SHA. The PR's claim of no behavior change rests on the upstream compare touching no files under the launcher directories. That claim is author-stated and unverified here.
• pr-require-checks.yml: This trusted-path file changes only action pin SHAs and version comments. I found no changes to inputs, conditions, or permissions.
• scripts/check-affected.sh: The comment names the new release and SHA. I found no code change.
• Closing issue: None. The PR is a routine repin with no acceptance criteria.
• Manifests: No plugin manifests changed.
• Spend: Nothing here changes billing or spend.
• Author-claimed, unverified: The test results in the PR's Verification section. The PR itself says two shell suites could not run because PyYAML was missing.

[github-actions]

Post-merge mutation testing

• Range: 59faf4b..0218059
• Merged pull request: #10501
• Outcome: restore-failed

Killed 1, survived 0, timeout 0, no coverage 0, invalid 0, not run 0.
Covered-code score 100%; mutation score 100%.

File	Killed	Survived	Timeout	No coverage	Invalid	Not run
.github/scripts/pr-verify/probe/replay.mjs	1	0	0	0	0	0

The run's summary has the full report.