Skip to content

chore(pr-verify): pin run-claude-cli to v0.53.0 - #8510

Merged
kyle-sexton merged 2 commits into
mainfrom
chore/pr-verify-run-claude-cli-v053
Oct 19, 2026
Merged

chore(pr-verify): pin run-claude-cli to v0.53.0#8510
kyle-sexton merged 2 commits into
mainfrom
chore/pr-verify-run-claude-cli-v053

Conversation

@kyle-sexton

@kyle-sexton kyle-sexton commented Oct 19, 2026

Copy link
Copy Markdown
Member

No related issue: Phase 4.5 pin bump

Summary

pr-verify's judgment step moves from run-claude-cli v0.52.0 to v0.53.0 alone, so a pr-verify regression can be told apart from the later lane move. In v0.53.0 each leg runs inside bwrap with the installed CLI tree and _work/_actions bound read-only, the step's file-command files are cut back after the last leg, and the action gains plugin-dirs and add-dirs inputs. Every lane merge needs this verdict (require-verifier-verdict: true).

Fix

  • .github/workflows/pr-verify.yml: the run-claude-cli pin only, 34c8358f2d6c2551d7d462064ea46d403df0b7ac # v0.52.0 to d0fc3b14564383022ccc0559a5f96f3698dac39b # v0.53.0. The managed-settings and report-lane-outcome pins stay at v0.52.0.

Revert: git revert of this PR's merge commit, valid until Phase 5 merges (Phase 5 pins the read runner to the same SHA).

Verification

  • Sandbox probe of pr-verify's judge step (same tools and inputs, model opus, max-turns 60) at the new pin: run 39312415617. CLI 2.1.303, leg 1 on AUTOMATIONS_CLAUDE_API_KEY, step success, verdict=pass, 0 permission denials, no bwrap or write error in the step or leg log.
  • Sandbox probe of a plugin-dirs skill under --restricted reading its own reference/x.md: run 39312415767. Plugin and skill listed, Skill and Read both succeed, 0 denials.
  • Probe PR: melodic-software/pr-pipeline-sandbox#174, closed unmerged.
  • scripts/check-affected.sh --tests: 9 passed, 5 skipped.

Related

🤖 Generated with Claude Code

@kyle-sexton
kyle-sexton marked this pull request as ready for review October 19, 2026 19:42
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-19T19:43:55.438264Z 0849a78 Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@github-actions

github-actions Bot commented Oct 19, 2026

Copy link
Copy Markdown
Contributor

claude-review reviewed 0849a7887f314b71ceeb165b502b988d64f6b15a: 0 finding(s), 0 as inline comments.

No findings. The PR changes one line in .github/workflows/pr-verify.yml: the run-claude-cli pin moves from the v0.52.0 SHA to d0fc3b14564383022ccc0559a5f96f3698dac39b # v0.53.0.

  • The new SHA and its v0.53.0 comment match the PR body.
  • The other two ci-workflows pins in the file (apply-claude-managed-settings and report-lane-outcome) stay at v0.52.0, as the body says.
  • No path-scoped rule under .claude/rules/ matches a workflow file.
  • There are no closing issues. The body says "No related issue", so there are no acceptance criteria to check.

I did not check that the SHA matches the upstream v0.53.0 tag. I also did not run the sandbox probes or scripts/check-affected.sh; those results are the author's claims and are unverified by this lane.

@github-actions

github-actions Bot commented Oct 19, 2026

Copy link
Copy Markdown
Contributor

claude-security-review reviewed 0849a7887f314b71ceeb165b502b988d64f6b15a: 0 finding(s), 0 as inline comments.

No security findings in PR #8510 at head 0849a78.

The diff changes one line in .github/workflows/pr-verify.yml. It moves the run-claude-cli action pin from the v0.52.0 SHA to a v0.53.0 SHA. It changes no triggers, permissions, secrets handling, inputs or expressions, and it adds no instruction-surface deletions.

I did not confirm that the new SHA (d0fc3b14…) is the commit the v0.53.0 tag points to. The gh api lookup of the tag needed approval and I didn't pursue it. The SHA pin itself is still in place, and pin changes are zizmor's advisory lane, not this one.

@kyle-sexton
kyle-sexton added this pull request to the merge queue Oct 19, 2026
Merged via the queue into main with commit a233796 Oct 19, 2026
56 checks passed
@kyle-sexton
kyle-sexton deleted the chore/pr-verify-run-claude-cli-v053 branch October 19, 2026 19:53
@kyle-sexton kyle-sexton mentioned this pull request Oct 20, 2026
Merged
github-merge-queue Bot pushed a commit that referenced this pull request Oct 20, 2026
@kyle-sexton @claude
feat(pr-pipeline): run pr-verify's model on the key first and the sub…
e9e9c32 
…scription token only on a credit stop (#8577)

No related issue: run-claude-cli v0.54.0 (ci-workflows 7b36242) takes
exactly one credential, so pr-verify needs the two-job pattern before
its pin can move.

## Summary

ci-workflows v0.54.0 makes the run-claude-cli action take exactly one of
`api-key` or `subscription-token`, fail closed if given both, and set
`lane-class=credit-stop` on a key credit stop instead of falling back
inside the step. pr-verify pins v0.53.0, which fell back in-step. This
moves pr-verify to two jobs and repins to v0.54.0 (`7b362428`).

## Fix

- `check-intent` runs the model on the automations API key. New outputs:
`lane-class`, `credential-present`, `key-leg-clean`.
- `check-intent-subscription` (`needs: check-intent`, `ubuntu-24.04`,
fresh checkout, every step repeated, nothing carried from the first job)
runs only when the key job hit a credit stop with a clean key leg, or no
key is set (`if:` at :364; with no status function GitHub adds
`success()`, so a failed key job skips it).
- `secrets.AUTOMATIONS_CLAUDE_CODE_OAUTH_TOKEN` is now only in the
subscription job (:490, :563). Permissions unchanged, read-only in both
jobs.
- Lane-funding conditions kept: key first (automations credits spent
first); each job echoes `credential:` in report-lane-outcome; a new
"Check the key leg" step (:300) fails the key job on any permission
denial, and `write-verdict.mjs` still catches denials in the
subscription job, so a denial never yields a verdict; exactly one
verdict per run (a credit stop always fails the key job's judge step).
Step names "Judge the pull request" and "Upload the verdict" kept.
- Job count: a skipped job uses no runner, so the steady state adds one
skipped job per run; on a credit stop the jobs run one after the other.

Known interaction: the held reconciler change (#8562) counts a started
judge step in any job, so it would hold rather than re-run a run whose
subscription job was lost. That fails safe; the fix belongs in #8562.

## Verification

- `workflow.test.mjs` rewritten per job: hand-off condition, each secret
only in its own job, the subscription job's steps equal the key job's
apart from the credential (a mutation check fails on drift). New tests
for `checkKeyLeg` in `write-verdict.mjs`. resolve-pr, reconcile, callers
and workflow-gates tests pass; actionlint, offline zizmor and
runner-policy pass.
- Needs GitHub Security & Cost's pass before merge (secrets, `needs`,
`if` changes).

## Related

- ci-workflows v0.54.0; #8510 (v0.53.0 pin); #8562.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01Xk7Lz7d2twxvA3LfRxnLkT

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@kyle-sexton