[kyle-sexton]

Refs: melodic-software/ci-workflows#818
Refs: melodic-software/ci-workflows#819
Refs: melodic-software/ci-workflows#782

Summary

This moves the two locally owned review lane callers to v0.55.0 (see below). The other hand-maintained melodic-software/ci-workflows composite pins move to v0.58.0 (5e18f3d6cebd6fa5e66b0941ee0f7ed6ba288d6c). The two reusable intake callers, intake-triage.yml and intake-label-needs-triage.yml, stay at v0.56.0 (1bb8953) until the standards runner policy approves v0.58.0 contracts for them.

The PR also applies what the callers need from each release in between:

• pr-verify now hands the judgment to the subscription job on run-claude-cli's new handoff output.
• Its subscription lane record goes back to the plain pr-verify lane name, with the reason in fallback-reason.
• The intake-reenter.yml "Accepted exposure" paragraph is updated for the trusted-comment filter (ci-workflows#782 / #830).
• 2e08ec6 (the test-bash leg timeout raise) is reverted: the owner's rule is to make a slow job faster or split it, and fix(planning): run the shared browser suites 6 at a time under CI #8840 did that.

Fix

Pins moved:

File	From	To
.github/workflows/pr-require-checks.yml (21 composite pins, check-managed-files among them, and the markdownlint npx cache key)	v0.39.8 594987a	v0.58.0
.github/workflows/pr-verify.yml (run-claude-cli, apply-claude-managed-settings, report-lane-outcome)	v0.54.0 7b36242	v0.58.0
.github/workflows/pr-run-activity-read.yml, pr-run-activity-write.yml (report-lane-outcome)	v0.43.0 64fd515	v0.58.0
.github/workflows/maintenance-audit-test-selection.yml (shellcheck)	v0.39.3 ab83b01	v0.58.0
.github/workflows/intake-triage.yml	v0.54.0 7b36242	v0.56.0
.github/workflows/intake-label-needs-triage.yml	v0.42.0 182aca3	v0.56.0

Changes the callers needed, v0.39.4 through v0.58.0:

• run-claude-cli defaults cli-version to latest (it was 2.1.304). pr-verify passes no cli-version, so the verifier now runs the newest Claude Code release. The action's npm-signature and GPG-manifest checks still verify it (#819). .github/scripts/pr-verify/probe/replay.mjs records RUN_CLAUDE_CLI_PIN = 5e18f3d6… and CLI_VERSION = latest. A live replay resolves latest with npm view @anthropic-ai/claude-code version, as lane.cjs does, and refuses a local CLI that differs. cliArgs and legEnv in lane.cjs are byte-identical between 7b36242 and 5e18f3d6, and apply-claude-managed-settings is unchanged.

• New handoff output on run-claude-cli (v0.57.0 #840, narrowed in v0.58.0 #841):

  • It is true only when the key leg ended in a credit stop, or in class auth with API status 401 or 402.
  • A 403 gives false, and the output is empty when the step failed before the leg ran.

  pr-verify now follows ci-workflows' intake-triage.yml at v0.58.0:

  • check-intent outputs handoff.
  • "Check the key leg", the key report's if, and the check-intent-subscription job's if key on handoff == 'true' instead of lane-class == 'credit-stop'.
  • The key-leg warning tells a refused key (replace the secret) apart from a credit stop (rotate one in).
  • A 403 hands nothing off and fails the key job.
  • known-failure-class is unchanged: a credit stop reports as rate-limit, auth as auth.

• report-lane-outcome fallback-reason (#834; v0.57.0 adds auth). The subscription job's report no longer builds the long lane: string, which worked around ci-workflows#806, fixed in v0.55.0. It passes lane: pr-verify and a fallback-reason of credit-stop, auth or no-key, using the same expression as intake-triage. docs/conventions/pr-pipeline/README.md (Funding) and a pr-pipeline changelog fragment describe the new rule.

• run-claude-cli runs one leg per invocation (#803, v0.54.0). pr-verify already uses the two-job pattern from feat(pr-pipeline): run pr-verify's model on the key first and the subscription token only on a credit stop #8577.

• report-lane-outcome emits install-failed and no-execution (#813, v0.55.0; install-failed is newer than the v0.43.0 pin). .github/actions/report-check-run/lane-record.mjs drops the lane record for any class outside its allowlist, so a pr-run-activity run that left no execution file would have lost its record. Both classes are added, with a test that fails without the change.

• aggregate-results finds its own gate job by job.check_run_id and step name (#814). ci-status now passes step-name: Aggregate lane results, as ci-workflows' own ci-status does.

• ci-status waits out GitHub API rate limits (#833). Two 60 s waits, the retries and the 90 s re-run wait add up to about four minutes, so ci-status timeout-minutes goes from 3 to 5, as feat(toolchain): add lychee-offline to cross-cutting ecosystem default #833 sets in its own workflow and README.

• check-managed-files checks each queued PR's own diff in a merge group (#823). feat(planning): add incumbent mode to devils-advocate #823 named the job comment saying a merge group "passes" as stale at this bump, so it is rewritten. The job already grants pull-requests: read, which that mode needs.

• aggregate-results accepts a carried writer only from a full run (#826). No caller change is needed: a full run here runs many jobs, which job_shape reads as full, and its 12 jobs fit the per_page=100 jobs read.

• The markdownlint default moves to 0.23.3 (#809). The npx cache key is keyed on the composite pin, so it now names 5e18f3d6.

• intake-triage (#821, #830): caller inputs, secrets and the contents: read / issues: write grant are unchanged. The trusted-comment filter reads allowed-author-ids, which this caller already fills from the trusted-actor list (human-ids, which includes 153232337), and allowed-bot-sender-ids.

• The rest are additive, optional inputs: check-contract issue-ref-pattern and rate-limit-wait-seconds, and report-lane-outcome fallback-reason, install-outcome and known-failure-class. A merge_group path was added to check-contract, aggregate-results and gitleaks.

Re-verified hand-maintained notes: aggregate-results and check-machine-paths have no diff between 1bb8953 and 5e18f3d6, so the contract-only claim holds. The pin notes in README.md and scripts/check-docs-only-gate.sh move to v0.58.0, dated 2026-10-21.

intake-reenter.yml: the "Accepted exposure" paragraph now says what the triage run passes the model:

• Comments reach the model only from allowed-author-ids / allowed-bot-sender-ids authors, and never the lane's own comment.
• The title and body still reach the model and stay untrusted data.
• The model holds no GitHub token and only Read, Grep and Glob, and a job with no model applies the output.

The sentence saying this work belonged in ci-workflows is removed, because #830 did it.

Review lane callers (locally owned), pinned to v0.55.0

.github/workflows/pr-review-hosted.yml and .github/workflows/pr-review-security-hosted.yml are locally-owned for this repository in the standards distribution/sync-manifest.yml (claude-review-hosted-caller, claude-security-review-hosted-caller), and their headers say so. Both move from v0.48.0 (96b50d4) to v0.55.0 (3a2c748fdef9cfb9ceec5a66289e21842189689f). Standards already holds approved runner contracts for both reusables at 3a2c748. The local resolve-model, kill-switch and model-args wiring stays as it is.

What the callers need from v0.48.0 to v0.55.0:

• #828, closing-issue author trust: pr-review.yml gains allowed-author-ids, which defaults to empty. When it is empty, every same-repository closing issue written by a person becomes a placeholder. The code-review caller now passes allowed-author-ids: '153232337', the human entry of .github/standards/trusted-actors/trusted-actors.json, with the comment from standards components/claude-lanes-hosted/claude-review.yml. The comment's sentence about trusted-actors.test.mjs is left out, because that test does not cover this file. pr-review-security.yml has no such input, so the security caller gets nothing new.
• No caller change is needed for the rest:
  • #818 (no persisted checkout credential) and #812 (drop the credential strip step) change only the reusables' own steps.
  • #796 (fail closed when the bubblewrap sandbox cannot start), #813 and #780 add sandbox-unavailable, install-failed and no-execution to the lane's failure-class output. These callers do not read that output.
  • #810 changes only the prompt.
  • Both reusables' on.workflow_call inputs and job permission lines are otherwise unchanged between 96b50d4 and 3a2c748, so the callers' grants and their single CLAUDE_CODE_OAUTH_TOKEN secret stay as they are.

Intake reusable callers held at v0.56.0

runner-policy.mjs rejects intake-triage.yml@5e18f3d6 and intake-label-needs-triage.yml@5e18f3d6, because the synced policy.json has no reviewed contract for either at v0.58.0. That file is standards-managed. Both callers stay at 1bb8953, which the synced policy approves. A standards PR adding v0.58.0 contracts, then a follow-up repin, brings the intake lane the same auth handoff and latest CLI default.

Sync-managed files left to the standards sync (hand-editing them fails check-managed-files):

• .github/workflows/pr-check-managed-files-hosted.yml (v0.55.0).
• .github/workflows/maintenance-check-links-online-claude-code-plugins.yml (v0.55.0).
• .github/standards/runner-policy/policy.json.

Verification

• actionlint (1.7.12, repo config) on the five changed workflows: no findings.
• node --test:
  • workflow.test.mjs: 14/14, including new assertions on the handoff gates, the plain lane plus fallback-reason, and that no if keys on lane-class == 'credit-stop'.
  • parity.test.mjs 13/13, replay.test.mjs 11/11, write-verdict.test.mjs 11/11, resolve-pr.test.mjs 26/26, resolve-config/callers.test.mjs 22/22.
• scripts/check-affected.sh --tests: 11 passed, 3 skipped (no plugin, .py or skill changes).
• node .github/standards/runner-policy/runner-policy.mjs --root .: "Runner policy passed." The synced policy.json now holds the 1bb8953 contracts, so the earlier expected red is gone.
• scripts/check-changelog-fragments.sh --check: all fragments are valid.
• Not run locally: zizmor on the new head.
• This PR edits pr-require-checks.yml, so its AI review lanes skip themselves.

Related

• Prior repin: ci: repin ci-workflows to v0.39.3 #6643.
• feat(pr-pipeline): run pr-verify's model on the key first and the subscription token only on a credit stop #8577 (pr-verify's two-job migration for feat(claude-ops): script deterministic lane-cycle mechanics (#538) #803).
• fix(planning): run the shared browser suites 6 at a time under CI #8840 (the real fix for the slow test-bash leg).
• Follow-up: repin intake-triage.yml and intake-label-needs-triage.yml to v0.58.0 once standards approves their contracts.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-21T05:14:02.625865Z	8d50108	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.