Skip to content

chore(ci): pin ci-workflows v0.61.0 for the lanes and pass lane-id - #9074

Merged
kyle-sexton merged 2 commits into
mainfrom
ci/pin-ci-workflows-v0.61.0
Oct 22, 2026
Merged

kyle-sexton merged 2 commits into
mainfrom
ci/pin-ci-workflows-v0.61.0

Conversation

@kyle-sexton

@kyle-sexton kyle-sexton commented Oct 22, 2026 •

Copy link
Copy Markdown
Member

Refs: #8491
Refs: melodic-software/claude-code-account-rotation#288

Summary

Repins every lane-related ci-workflows use to v0.61.0 (164c2809f6150429b6f24d4a2777bb377af953d9) and passes lane-id at each direct report-lane-outcome step, so every lane emits the lane-outcome record (docs/lane-outcome.md). v0.61.0 contains ci-workflows#854, which #8491 needs.

The v0.61.0 runner-policy contracts come from standards#843, synced here by #9076.

Fix

Reusable callers:

Direct action uses:

  • .github/workflows/pr-verify.yml: apply-claude-managed-settings, run-claude-cli and report-lane-outcome in both judge jobs, v0.58.0 to v0.61.0; both reports pass lane-id: pr-verify.
  • .github/workflows/pr-run-activity-read.yml: apply-claude-managed-settings and both run-claude-cli legs, v0.54.0 to v0.61.0; issue-mode report-lane-outcome v0.58.0 and PR-mode report-lane-outcome v0.54.0 to v0.61.0; both pass lane-id: ${{ inputs.lane }} (pr-unblock or work-resolve-issue, never the formatted display name).
  • .github/workflows/pr-run-activity-write.yml: report-lane-outcome v0.58.0 to v0.61.0 with lane-id: ${{ inputs.lane }}.

Pin-tracking tests: .github/scripts/pr-verify/probe/replay.mjs and .github/actions/resolve-config/callers.test.mjs move to the v0.61.0 SHA.

The review callers keep the default credential-name (CLAUDE_CODE_OAUTH_TOKEN, the one secret they map) and set no fallback-credential-name.

What the jump brings

v0.58.0 → v0.61.0 (pr-verify, read issue-mode and write reports). The intake-triage and review callers come from v0.60.0 (#9066), so for them only #856 and #857 are new:

  • report-lane-outcome takes lane-id and handoff and writes the lane-outcome record (ci-workflows#853, #856); #857 fails any ci-workflows lane that does not emit it.
  • intake-triage gives the model each trusted comment's link (#854) and each leg writes its own record, the key leg's handoff included (#856); its on.workflow_call, permissions and runs-on are unchanged.
  • run-claude-cli: only the bubblewrap probe error text changes (#849); action.yml is unchanged. apply-claude-managed-settings is unchanged.

v0.60.0 → v0.61.0 (review callers):

  • pr-review.yml and pr-review-security.yml add the optional credential-name and fallback-credential-name inputs and report the first attempt's usage-limit handoff as its own record (#856). No change to secrets, permissions or runs-on.

v0.54.0 → v0.61.0 (pr-run-activity-read launcher and PR-mode report), adding to the above:

  • run-claude-cli verifies the CLI's npm signatures and signed manifest (#819), resolves latest by default and hands off a key refused with 401 or 402 (lane-class: auth, handoff: true) (#840), and stops on a 403 (#841).
  • report-lane-outcome classifies no-execution (#813) and takes fallback-reason (#834).
  • Caller effect: this file and pr-unblock.yml hand off only on credit-stop, so a 401/402 key stays a terminal failure as it was at v0.54.0; no if: changes meaning. A 403 whose text reads as a credit stop is now auth and no longer hands off.

Verification

  • actionlint on the six workflow files: no findings.
  • node .github/standards/runner-policy/runner-policy.mjs --root . after merging main (with chore: sync standards components #9076): Runner policy passed.
  • Each report step's credential maps to a record kind: AUTOMATIONS_CLAUDE_API_KEY, AUTOMATIONS_CLAUDE_CODE_OAUTH_TOKEN or ISSUE_LANE_CLAUDE_CODE_OAUTH_TOKEN.
  • Pin-tracking tests re-read at v0.61.0: replay.mjs's RUN_CLAUDE_CLI_PIN and the callers.test.mjs launcher SHA move to 164c280. That SHA joins PERMISSION_PROMPTS_NONE_LAUNCHERS, since lane.cjs:355-358 still passes --permission-prompts none. From v0.58.0, lane.cjs changes only an error string, and run-claude-cli/action.yml and apply-claude-managed-settings do not change.
  • node --test over the workflow-related suites (resolve-config, report-check-run, pr-verify, pr-unblock, pr-merge, intake-reenter and others): 1487 tests, 1487 pass, 0 fail. The 11 workflow shell tests (scripts/*read*, scripts/write-runner-*, collect-patch-lane, and others) all exit 0.

Related

🤖 Generated with Claude Code

Move the intake-triage and review callers, and the direct
run-claude-cli, apply-claude-managed-settings and report-lane-outcome
uses in pr-verify and pr-run-activity-read/write, to ci-workflows
v0.61.0. Pass lane-id at every direct report-lane-outcome step so each
lane writes the lane-outcome record. Re-read the pin-tracking test
constants at the new SHA.

Refs: #8491

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-22T14:08:01.421321Z 52dd64f PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@melodic-automation-lanes melodic-automation-lanes Bot added the needs-human Human-in-the-loop required; autonomous sessions must not resolve items carrying this. label Oct 22, 2026
@melodic-automation-lanes

Copy link
Copy Markdown
Contributor

The pr-unblock lane stopped on this pull request and needs a person: a conflicted path is protected, so the lane does not resolve it.

  • Reason: protected-path-conflict
  • Resume key: 52dd64f33cb6b95f07d14df6f3dce08b4d9a2457 (the head the lane stopped on)

To resume, deal with the reason above, remove the needs-human label (and do-not-merge, if set), then dispatch the pr-unblock workflow with pr-number=9074 and activity=resolve-conflicts:

gh workflow run pr-unblock.yml -R melodic-software/claude-code-plugins -f pr-number=9074 -f activity=resolve-conflicts

…0.61.0

# Conflicts:
#	.github/workflows/intake-triage.yml
#	.github/workflows/pr-review-hosted.yml
#	.github/workflows/pr-review-security-hosted.yml
@melodic-automation-lanes

Copy link
Copy Markdown
Contributor

The pr-unblock lane escalated this pull request as protected-path-conflict, and that no longer holds at 1daac1a861366c6455a7a5dc35ca2d59cd4b8a90: GitHub reports no conflict with main. pr-merge removed needs-human, so the lanes run on it again. To keep a person on it, add needs-human back: a label a person adds is never removed.

@melodic-automation-lanes melodic-automation-lanes Bot removed the needs-human Human-in-the-loop required; autonomous sessions must not resolve items carrying this. label Oct 22, 2026
@kyle-sexton
kyle-sexton added this pull request to the merge queue Oct 22, 2026
Merged via the queue into main with commit 497059f Oct 22, 2026
77 of 81 checks passed
@kyle-sexton
kyle-sexton deleted the ci/pin-ci-workflows-v0.61.0 branch October 22, 2026 18:10
kyle-sexton added a commit to melodic-software/claude-code-account-rotation that referenced this pull request Oct 22, 2026
… run (#309)

Refs: #288

## Summary

Adds the first real lane-outcome annotation to `LaneOutcomeTests`. It is
from claude-code-plugins check run
[119996073843](https://github.com/melodic-software/claude-code-plugins/actions/runs/39827904468/job/119996073843),
the review lane on
[claude-code-plugins#9074](melodic-software/claude-code-plugins#9074),
which runs ci-workflows
[v0.61.0](https://github.com/melodic-software/ci-workflows/releases/tag/v0.61.0).
The message was read back through `GET
/repos/{owner}/{repo}/check-runs/{id}/annotations` and pasted verbatim.

## Fix

- `LaneOutcomeTests.ARealReviewLaneAnnotationIsReadFromItsJsonRecord`.
The real message's legacy tokens and its JSON record carry the same
class and credential. The test rewrites the legacy `class=` token, then
asserts that the parser still returns the record's `skipped-validation`.
This proves the JSON path read it.

What the real annotation settles (release 2.4.0 plan, Phase 8 open
questions):

- A record written by `report-lane-outcome` reaches the check-run
annotations API intact, with the marker mid-line and free text after the
JSON.
- This message has no newline between the sentence and the marker, and
the parser reads it.

## Verification

- `dotnet test --project tests/ClaudeCodeAccountRotation.Core.Tests -c
Release --filter-class "*LaneOutcomeTests"`: 34 succeeded, 0 failed.
- `dotnet format --verify-no-changes` on the file: clean.
`eng/check-no-machine-paths.sh`: clean.

## Related

-
[ci-workflows#856](melodic-software/ci-workflows#856),
[#857](melodic-software/ci-workflows#857),
[claude-code-plugins#9074](melodic-software/claude-code-plugins#9074)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
kyle-sexton added a commit that referenced this pull request Oct 22, 2026
…0.62.0

Keeps the v0.62.0 pins over main's v0.61.0 pins (#9074) on the three callers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant