[kyle-sexton]

No related issue: fleet repin to ci-workflows v0.39.3 in the GitHub Actions conventions migration.

Summary

Moves this repository's repo-owned ci-workflows pins from v0.39.0 (6ba73b9) and v0.39.1 (c586acc, the required check-managed-files job) to v0.39.3 (ab83b01273026ab5c23c6f3b40e946d97a863fa2), so the fleet runs one release.

Fix

Pin SHA and # v0.39.3 comment on 25 lines across five workflows, plus the two repo-owned files that record the pin: the README "As of" line for the machine-specific-paths local pre-flight, and the hand-verified pin note in check-docs-only-gate.sh. Sync-managed callers and the synced runner-policy contracts are left to the standards sync. Between v0.39.0 and v0.39.3 no pinned path moved and every reusable workflow blob is byte-identical; check-managed-files is identical between v0.39.1 and v0.39.3.

Verification

• Every repo-owned uses: melodic-software/ci-workflows/... pin is at ab83b01; every pinned path exists at that commit.
• aggregate-results: action.yml is unchanged and run.sh differs only by re-indentation (git diff -w 6ba73b97 ab83b01 is empty), so the hand-verified contract-only predicate note in check-docs-only-gate.sh still holds at the new pin. check-machine-specific-paths.sh likewise differs only by re-indentation, so the README's standalone-run claim holds.
• actionlint passes on the changed workflows; the lefthook pre-commit passed.
• The runner-policy contracts for ab83b01 are in feat(runner-policy): add ci-workflows v0.39.3 contracts standards#742. Until it merges and the standards sync delivers them, this PR's runner-policy check fails on the new reusable keys; that is expected.

Related

• feat(runner-policy): add ci-workflows v0.39.3 contracts standards#742 (v0.39.3 runner-policy contracts)
• ci-workflows v0.39.3 release

🤖 Generated with Claude Code

https://claude.ai/code/session_01T7GukBojtE99rLCPY7Cw3R

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T02:07:40.083003Z	9e1b68a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 1m 37s —— View job

---

Code review complete

• Gather context (PR diff, CLAUDE.md/AGENTS.md, REVIEW.md)
• Review changed workflow pins and version comments
• Review README.md and check-docs-only-gate.sh updates
• Verify SHAs/claims where possible
• Post findings (none found)

Summary

This is a mechanical pin repin with no logic changes, and I found no correctness issues:

• All 25 uses:/cache-key references across the five changed workflows consistently move from the old pins (6ba73b97b0586... v0.39.0, c586acc8ea288... v0.39.1) to ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3. I confirmed no stale pin remains in any of the five files — the only leftover hits on the old comment text are unrelated prose (e.g. pr-require-checks.yml L92-97).
• README.md's "As of" note and scripts/check-docs-only-gate.sh's hand-verified pin comment were both updated to the new SHA/version, consistent with the skill-bodies-state-current-rules pointer convention (pin, as-of date, recheck trigger all present).
• The files left untouched — .github/workflows/pr-check-managed-files-hosted.yml, pr-review-hosted.yml, pr-review-security-hosted.yml, and .github/standards/runner-policy/policy.json — are all marked SYNC-MANAGED FILE: DO NOT EDIT IN THE CONSUMING REPOSITORY (or are the synced runner-policy contract), matching the PR body's claim that these are left to the standards sync.

One caveat, not a finding: the PR body's claim that the aggregate-results/check-machine-specific-paths.sh scripts are byte-identical (modulo re-indentation) between the old and new pin is author-asserted; I have no way to diff the external ci-workflows repo from this sandbox, so I did not independently verify it.

No inline comments were posted — nothing met the high-signal bar for this lane.

[claude]

Claude finished @kyle-sexton's task in 49s —— View job

---

Security review complete

• Gather context (PR diff, changed files)
• Run skip-gate check
• Review changed files for security-relevant surface
• Check instruction-surface deletions against protected classes
• Report findings or clear result

Result: no security issues found.

This PR only repins uses: references from melodic-software/ci-workflows at 6ba73b97... (v0.39.0) / c586acc8... (v0.39.1) to ab83b012... (v0.39.3), updates the matching npx-markdownlint-cli2 cache key, and syncs two repo-owned pin-record comments (README.md and scripts/check-docs-only-gate.sh) to the new SHA. All pins remain full-length commit SHAs with a version comment — none are loosened to a tag or branch, so there's no supply-chain regression here (and pin-hygiene/unpinned-action risk is zizmor's advisory lane regardless, per this skill's scope).

No logic, permissions, trigger, or secret-handling changes:

• .github/workflows/pr-automerge-dependabot.yml and the other four single-line-diff workflows only bump the pinned SHA/comment on an existing uses: line; permissions: blocks are untouched.
• .github/workflows/pr-require-checks.yml's 21 hunks are all the same mechanical SHA/comment swap, repeated across existing continue-on-error: true advisory steps; no new steps, no permissions: or trigger changes.
• README.md and scripts/check-docs-only-gate.sh changes are comment-only, recording the new pin for future verification — not a deletion or softening of any standing instruction, so the instruction-surface-deletion lens doesn't apply here.

No CRITICAL / IMPORTANT / SUGGESTION findings to report.

[github-actions]

claude-security-review has reviewed this pull request through 4f4d929; a later push is reviewed from there.

[github-actions]

claude-review has reviewed this pull request through 4f4d929; a later push is reviewed from there.