Repository navigation
ci(review): repin pr-review-cli to v0.66.1 - #10782
Merged
Merged
Conversation
v0.66.1 carries ci-workflows#906: the key-credit gate no longer spends its 3 job reads on skipped runs, so the review lanes stop running the API-key leg into a known credit stop (5 of 6 code-lane rounds on #10757, 34-75 s each). It also carries ci-workflows#904, whose status job needs actions: read and checks: read; both callers already grant them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kyle-sexton
marked this pull request as ready for review
October 28, 2026 22:38
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
|
claude-review needs no new review of No findings. The PR changes one line in each of two workflows:
|
Contributor
|
claude-security-review needs no new review of No security issues found. The diff changes one line in each of two caller workflows (
critical-findings: 0 |
kyle-sexton
added a commit
to melodic-software/standards
that referenced
this pull request
Oct 28, 2026
…contract (#902) Refs: melodic-software/claude-code-plugins#10782 ## Summary Registers the reviewed `pr-review-cli.yml@20a822d73b6e2d7e21d48e609a01b427e0e161e7` (v0.66.1) contract. The claude-code-plugins repin fails `runner-target-contract` because surface-diff auto-approval declines: `jobPermissions changed since the previously reviewed ...pr-review-cli.yml@3180217076b19bbdfccc43026c7f91c604da673d`. ## Fix - `policy.json`: the new entry copies the v0.65.14 (`3180217`) entry forward unchanged. From `3180217` to `20a822d`, the workflow changes in three non-comment lines, all from melodic-software/ci-workflows#904: the `status` job adds `actions: read` and `checks: read` (the hold step reads this workflow's earlier runs and their check-run cost notices), and that step takes a `STATUS_JOB` env built from the `lane` input. No input, secret, write scope or routing change. A hosted-only contract records no job permissions and checks no caller permissions, so the callers' existing read grants need no entry. - `README.md`: a v0.66.1 paragraph that names ci-workflows#904 and the permission change. - `runner-policy.test.mjs`: pins the new entry as equal to its v0.65.14 entry. ## Verification - `node --test components/runner-policy/runner-policy.test.mjs`: 371 pass, 0 fail. - `npm run lint:runner-policy` on this repo: `Runner policy passed.` - On the claude-code-plugins repin branch `ci/repin-pr-review-cli-v0.66.1`: - before (its synced policy): both review callers fail `runner-target-contract` with the auto-approval decline above, exit 1. - after (`--policy` pointed at this branch's `policy.json`): `Runner policy passed.`, exit 0. ## Related - melodic-software/claude-code-plugins#10782 (the repin this unblocks) - melodic-software/ci-workflows#904 (the permission change) - #893 (precedent) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
kyle-sexton
added a commit
to melodic-software/standards
that referenced
this pull request
Oct 29, 2026
…tatus job reads (#900) Refs: melodic-software/claude-code-plugins#9635 ## Summary This PR registers the reviewed `pr-review-cli.yml` contract at the [ci-workflows v0.66.1](https://github.com/melodic-software/ci-workflows/releases/tag/v0.66.1) tag (`20a822d73b6e2d7e21d48e609a01b427e0e161e7`), so callers can pin that release. Auto-approval declines it today: "jobPermissions changed since the previously reviewed ...pr-review-cli.yml@3180217". The change is [ci-workflows#904](melodic-software/ci-workflows#904): the status job adds `actions: read` and `checks: read` so the cost hold can read its earlier runs' check-run notices. The owner approved those read-only scopes for this lane (claude-code-plugins#9635, Q1(a)). ## Fix - `policy.json`: the v0.66.1 `pr-review-cli.yml` entry copies its v0.65.14 (`3180217`) entry forward unchanged. A hosted-only contract has no field for caller permissions (the schema refuses `minimumCallerPermissions` without `runnerInput`), so the reviewed change is recorded in the README and test, not in the entry. - `README.md`: one paragraph on the v0.66.1 contract and the reviewed permission change. - `runner-policy.test.mjs`: a test that the v0.66.1 entry equals the v0.65.14 entry. ## Verification - Surface diff of `pr-review-cli.yml` between `3180217` and `20a822d` (comments excluded): the status job's `actions: read` and `checks: read` lines and one `STATUS_JOB` step env value. `on.workflow_call` inputs, secrets and `runs-on` do not change. - `node --test components/runner-policy/runner-policy.test.mjs components/claude-lanes/repin-policy-lockstep.test.mjs`: 398 pass, 0 fail. - `runner-policy.mjs --root <claude-code-plugins#10782 head d4b21de>`: - with this `policy.json`: `Runner policy passed.` - with the currently synced `policy.json`: the two `pr-review-cli.yml@20a822d` runner-target-contract findings that fail #10782's `lint-repo`. - Left out: `pr-review-cli.yml@9a886d5` (v0.66.0). No caller pins it. ## Related - [claude-code-plugins#10782](melodic-software/claude-code-plugins#10782): repins the review callers to v0.66.1. Its `lint-repo` and `ci-status` fail on this missing contract and pass once it syncs. - [#895](#895): the claude-lanes re-pin to v0.66.0. It copies forward `pr-review.yml`, `pr-review-security.yml` and `maintenance-sync-standards.yml` but not `pr-review-cli.yml`. - [#885](#885): the v0.65.14 `pr-review-cli.yml` registration, which this follows. - [ci-workflows#904](melodic-software/ci-workflows#904): the permission change reviewed here. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs: #10757
Summary
The two AI review lane callers pin
pr-review-cli.ymlat v0.65.17, whose key-credit gate kept running the API-key leg into a credit stop that a recent run had already recorded. On #10757 that happened in 5 of 6 code-lane rounds and cost 34-75 s per round before the subscription leg did the review. ci-workflows#906 fixed the gate and shipped in v0.66.1.Fix
pr-review-hosted.ymlandpr-review-security-hosted.yml: repinpr-review-cli.ymlfrom81a603a(v0.65.17) to20a822d(v0.66.1).locally-ownedin standards' sync manifest, so the standards repin lane does not reach them; this is the hand repin the release workflow's header calls for.Verification
actions: readandchecks: read. Both callers already grant them (pr-review-hosted.yml:167,170,pr-review-security-hosted.yml:172,175).check-affectedpassed.git log 81a603a..20a822dholds source-control:babysit-prs: refresh_pr_branch.py's active-human-review-stop check false-fires on self-authored replies (#473-class, freshness gate) #902 (standards sync), feat(source-control): worktree-create fresh base should resolve the default branch of non-origin remotes #904 and fix(knowledge): pin install-links for youtube extraction so npm ci works from clean checkout (0.9.2) #906 only.Related
🤖 Generated with Claude Code