From 52dd64f33cb6b95f07d14df6f3dce08b4d9a2457 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Thu, 22 Oct 2026 10:06:17 -0400 Subject: [PATCH] ci: pin ci-workflows v0.61.0 for the lanes and pass lane-id Move the intake-triage and review callers, and the direct run-claude-cli, apply-claude-managed-settings and report-lane-outcome uses in pr-verify and pr-run-activity-read/write, to ci-workflows v0.61.0. Pass lane-id at every direct report-lane-outcome step so each lane writes the lane-outcome record. Re-read the pin-tracking test constants at the new SHA. Refs: #8491 Co-Authored-By: Claude Opus 5.5 --- .github/actions/resolve-config/callers.test.mjs | 8 ++++---- .github/scripts/pr-verify/probe/replay.mjs | 2 +- .github/workflows/intake-triage.yml | 2 +- .github/workflows/pr-review-hosted.yml | 2 +- .github/workflows/pr-review-security-hosted.yml | 2 +- .github/workflows/pr-run-activity-read.yml | 12 +++++++----- .github/workflows/pr-run-activity-write.yml | 3 ++- .github/workflows/pr-verify.yml | 14 ++++++++------ 8 files changed, 25 insertions(+), 20 deletions(-) diff --git a/.github/actions/resolve-config/callers.test.mjs b/.github/actions/resolve-config/callers.test.mjs index 490e857ef6..98dce64500 100644 --- a/.github/actions/resolve-config/callers.test.mjs +++ b/.github/actions/resolve-config/callers.test.mjs @@ -904,7 +904,7 @@ test("pr-run-activity-read.yml: the run job can only read, and each launcher ste const { jobs } = workflow("pr-run-activity-read.yml"); assert.deepEqual(jobs.run.permissions, { contents: "read", "pull-requests": "read" }, "read-only, no id-token"); const step = (id) => jobs.run.steps.find((s) => s.id === id); - const launcher = "melodic-software/ci-workflows/.github/actions/run-claude-cli@7b362428c76085a160e28656cd2c75c3147a69ff"; + const launcher = "melodic-software/ci-workflows/.github/actions/run-claude-cli@164c2809f6150429b6f24d4a2777bb377af953d9"; for (const [id, input, secret] of [ ["act-key", "api-key", "claude-api-key"], ["act-token", "subscription-token", "claude-code-oauth-token"], @@ -959,9 +959,9 @@ test("no run-claude-cli plugin-dirs or add-dirs value names runner.temp, RUNNER_ // Launcher SHAs checked to pass `--permission-prompts none` unconditionally, // under which the default mode denies every call no rule allows, as dontAsk // does; check-permission-mode.sh accepts default for dontAsk on that basis. -// 7b362428: lane.cjs:311-312, in cliArgs. A pin bump fails here until its +// 7b362428: lane.cjs:311-312; 164c2809: lane.cjs:355-358; in cliArgs. A pin bump fails here until its // lane.cjs is read and its SHA added. -const PERMISSION_PROMPTS_NONE_LAUNCHERS = new Set(["7b362428c76085a160e28656cd2c75c3147a69ff"]); +const PERMISSION_PROMPTS_NONE_LAUNCHERS = new Set(["7b362428c76085a160e28656cd2c75c3147a69ff", "164c2809f6150429b6f24d4a2777bb377af953d9"]); test("pr-run-activity-read.yml: every run-claude-cli pin is a launcher checked to pass --permission-prompts none", () => { const pins = []; @@ -2480,7 +2480,7 @@ test("scan job: every gate, skip and launcher class value the runner sets passes const schema = JSON.parse(read("../../../docs/conventions/pr-pipeline/pr-pipeline.schema.json")); const gateReasons = Object.keys(JSON.parse(read("../report-check-run/gate-skip-reasons.json"))); // run-claude-cli's failure classes, the keys of SUMMARY_NOTES in lane.cjs at - // the pinned 7b362428. cant-fail-ok: an external contract's value list. + // the pinned 164c2809. cant-fail-ok: an external contract's value list. const laneClasses = ["credit-stop", "rate-limit", "auth", "overloaded", "max-turns", "timeout", "other"]; const cases = [ ...schema.$defs["skip-reason"].enum.map((value) => ["skip-reason", value]), diff --git a/.github/scripts/pr-verify/probe/replay.mjs b/.github/scripts/pr-verify/probe/replay.mjs index d69ae30a93..29790c6b74 100644 --- a/.github/scripts/pr-verify/probe/replay.mjs +++ b/.github/scripts/pr-verify/probe/replay.mjs @@ -60,7 +60,7 @@ const REPOSITORY = "melodic-software/claude-code-plugins"; // apply-claude-managed-settings to. cliArgs, LEG_ENV, CLI_VERSION and // MANAGED_SETTINGS were read from that SHA; the parity test fails when the // pin moves, so they are read again. -export const RUN_CLAUDE_CLI_PIN = "5e18f3d6cebd6fa5e66b0941ee0f7ed6ba288d6c"; +export const RUN_CLAUDE_CLI_PIN = "164c2809f6150429b6f24d4a2777bb377af953d9"; export const CLI_VERSION = "latest"; export const MANAGED_SETTINGS = Object.freeze({ apiKeyHelper: "", diff --git a/.github/workflows/intake-triage.yml b/.github/workflows/intake-triage.yml index 8229b60bb3..61c13c1900 100644 --- a/.github/workflows/intake-triage.yml +++ b/.github/workflows/intake-triage.yml @@ -178,7 +178,7 @@ jobs: concurrency: group: intake-triage-${{ github.event.issue.number || inputs.issue-number || github.run_id }} cancel-in-progress: false - uses: melodic-software/ci-workflows/.github/workflows/intake-triage.yml@5e18f3d6cebd6fa5e66b0941ee0f7ed6ba288d6c # v0.58.0 + uses: melodic-software/ci-workflows/.github/workflows/intake-triage.yml@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 with: runner: ubuntu-24.04 role: automations diff --git a/.github/workflows/pr-review-hosted.yml b/.github/workflows/pr-review-hosted.yml index d6c47a767a..dc7a3040f7 100644 --- a/.github/workflows/pr-review-hosted.yml +++ b/.github/workflows/pr-review-hosted.yml @@ -181,7 +181,7 @@ jobs: # reviewed-head marker comment id-token: write # OIDC, mints the Claude GitHub App token (required # even with an OAuth/API-key credential) - uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@8bd4d7f963a06627dd2d551ffcd8d9db5e6b881b # v0.59.1 + uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 with: runner: ubuntu-24.04 # Empty unless resolve-model succeeded, so a failed job's partial output diff --git a/.github/workflows/pr-review-security-hosted.yml b/.github/workflows/pr-review-security-hosted.yml index 18c3641c2c..d3d85f0d56 100644 --- a/.github/workflows/pr-review-security-hosted.yml +++ b/.github/workflows/pr-review-security-hosted.yml @@ -175,7 +175,7 @@ jobs: # the lane's reviewed-head marker comment id-token: write # OIDC, mints the Claude GitHub App token (required # even with an OAuth/API-key credential) - uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@8bd4d7f963a06627dd2d551ffcd8d9db5e6b881b # v0.59.1 + uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 with: runner: ubuntu-24.04 # Empty unless resolve-model succeeded, so a failed job's partial output diff --git a/.github/workflows/pr-run-activity-read.yml b/.github/workflows/pr-run-activity-read.yml index dc275ecb7e..c508e16e8c 100644 --- a/.github/workflows/pr-run-activity-read.yml +++ b/.github/workflows/pr-run-activity-read.yml @@ -749,7 +749,7 @@ jobs: # need sudo, so they are written before the runner is isolated. - name: Apply the Claude managed settings if: steps.launch.outcome == 'success' && steps.go.outputs.run == 'true' - uses: melodic-software/ci-workflows/.github/actions/apply-claude-managed-settings@7b362428c76085a160e28656cd2c75c3147a69ff # v0.54.0 + uses: melodic-software/ci-workflows/.github/actions/apply-claude-managed-settings@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 # Nothing after this step needs sudo or docker. - name: Isolate the runner @@ -927,7 +927,7 @@ jobs: if: steps.key-present.outputs.present == 'true' continue-on-error: true timeout-minutes: 50 - uses: melodic-software/ci-workflows/.github/actions/run-claude-cli@7b362428c76085a160e28656cd2c75c3147a69ff # v0.54.0 + uses: melodic-software/ci-workflows/.github/actions/run-claude-cli@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 env: # No work may outlive the result message the launcher reads. CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1" @@ -974,7 +974,7 @@ jobs: if: steps.token-present.outputs.present == 'true' continue-on-error: true timeout-minutes: 50 - uses: melodic-software/ci-workflows/.github/actions/run-claude-cli@7b362428c76085a160e28656cd2c75c3147a69ff # v0.54.0 + uses: melodic-software/ci-workflows/.github/actions/run-claude-cli@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 env: CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1" LD_LIBRARY_PATH: "" @@ -1287,13 +1287,14 @@ jobs: if: >- always() && inputs.issue-number != '' && (steps.act-skill.outcome == 'success' || steps.act-skill.outcome == 'failure') - uses: melodic-software/ci-workflows/.github/actions/report-lane-outcome@5e18f3d6cebd6fa5e66b0941ee0f7ed6ba288d6c # v0.58.0 + uses: melodic-software/ci-workflows/.github/actions/report-lane-outcome@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 with: outcome: ${{ steps.act-result.outputs.outcome || steps.act-skill.outcome }} execution-file: >- ${{ steps.act-skill.outputs.execution_file || format('{0}/claude-execution-output.json', runner.temp) }} lane: ${{ inputs.lane }} + lane-id: ${{ inputs.lane }} credential: ${{ steps.credential.outputs.name }} max-turns: ${{ steps.config.outputs.max-turns }} @@ -1305,7 +1306,7 @@ jobs: always() && steps.key-present.outputs.present != 'false' && steps.act-key.outputs.lane-class != 'credit-stop' && (steps.act-key.outcome == 'success' || steps.act-key.outcome == 'failure' || steps.act-token.outcome == 'success' || steps.act-token.outcome == 'failure') - uses: melodic-software/ci-workflows/.github/actions/report-lane-outcome@7b362428c76085a160e28656cd2c75c3147a69ff # v0.54.0 + uses: melodic-software/ci-workflows/.github/actions/report-lane-outcome@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 with: outcome: ${{ steps.act-key.outcome != 'skipped' && steps.act-key.outcome || steps.act-token.outcome }} execution-file: ${{ steps.act-key.outputs.execution-file || steps.act-token.outputs.execution-file }} @@ -1315,6 +1316,7 @@ jobs: || inputs.fallback == 'no-key' && format('{0}/{1} (key {2} is empty)', inputs.lane, inputs.activity, steps.launch.outputs.key-name) || format('{0}/{1}', inputs.lane, inputs.activity) }} + lane-id: ${{ inputs.lane }} step-started-at: ${{ steps.key-present.outputs.started-at || steps.token-present.outputs.started-at }} step-timeout-minutes: 50 credential: ${{ steps.act-key.outputs.credential || steps.act-token.outputs.credential }} diff --git a/.github/workflows/pr-run-activity-write.yml b/.github/workflows/pr-run-activity-write.yml index a62121ec7e..6140772254 100644 --- a/.github/workflows/pr-run-activity-write.yml +++ b/.github/workflows/pr-run-activity-write.yml @@ -1467,13 +1467,14 @@ jobs: - name: Record the lane outcome id: lane-record if: always() && (steps.act-skill.outcome == 'success' || steps.act-skill.outcome == 'failure') - uses: melodic-software/ci-workflows/.github/actions/report-lane-outcome@5e18f3d6cebd6fa5e66b0941ee0f7ed6ba288d6c # v0.58.0 + uses: melodic-software/ci-workflows/.github/actions/report-lane-outcome@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 with: outcome: ${{ steps.act-result.outputs.outcome || steps.act-skill.outcome }} execution-file: >- ${{ steps.act-skill.outputs.execution_file || format('{0}/claude-execution-output.json', runner.temp) }} lane: ${{ inputs.lane }} + lane-id: ${{ inputs.lane }} credential: ${{ steps.credential.outputs.name }} max-turns: ${{ steps.config.outputs.max-turns }} diff --git a/.github/workflows/pr-verify.yml b/.github/workflows/pr-verify.yml index c01f9e599a..08acc05d86 100644 --- a/.github/workflows/pr-verify.yml +++ b/.github/workflows/pr-verify.yml @@ -204,7 +204,7 @@ jobs: # need sudo, so they are written before the runner is isolated. - name: Apply the Claude managed settings if: steps.agree.outcome == 'success' - uses: melodic-software/ci-workflows/.github/actions/apply-claude-managed-settings@5e18f3d6cebd6fa5e66b0941ee0f7ed6ba288d6c # v0.58.0 + uses: melodic-software/ci-workflows/.github/actions/apply-claude-managed-settings@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 - name: Isolate the runner if: steps.agree.outcome == 'success' @@ -254,7 +254,7 @@ jobs: if: steps.credential.outputs.present == 'true' continue-on-error: true timeout-minutes: 22 - uses: melodic-software/ci-workflows/.github/actions/run-claude-cli@5e18f3d6cebd6fa5e66b0941ee0f7ed6ba288d6c # v0.58.0 + uses: melodic-software/ci-workflows/.github/actions/run-claude-cli@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 env: # No work may outlive the result message the launcher reads. CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1" @@ -313,11 +313,12 @@ jobs: # it, and auth as auth. - name: Report the judgment's outcome if: (steps.judge.outcome == 'success' || steps.judge.outcome == 'failure') && (steps.judge.outputs.handoff != 'true' || steps.key-leg.outcome == 'failure') - uses: melodic-software/ci-workflows/.github/actions/report-lane-outcome@5e18f3d6cebd6fa5e66b0941ee0f7ed6ba288d6c # v0.58.0 + uses: melodic-software/ci-workflows/.github/actions/report-lane-outcome@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 with: outcome: ${{ steps.judge.outcome }} execution-file: ${{ steps.judge.outputs.execution-file }} lane: pr-verify + lane-id: pr-verify step-started-at: ${{ steps.prompt.outputs.started-at }} step-timeout-minutes: 22 credential: ${{ steps.judge.outputs.credential }} @@ -525,7 +526,7 @@ jobs: # need sudo, so they are written before the runner is isolated. - name: Apply the Claude managed settings if: steps.agree.outcome == 'success' - uses: melodic-software/ci-workflows/.github/actions/apply-claude-managed-settings@5e18f3d6cebd6fa5e66b0941ee0f7ed6ba288d6c # v0.58.0 + uses: melodic-software/ci-workflows/.github/actions/apply-claude-managed-settings@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 - name: Isolate the runner if: steps.agree.outcome == 'success' @@ -573,7 +574,7 @@ jobs: if: steps.credential.outputs.present == 'true' continue-on-error: true timeout-minutes: 22 - uses: melodic-software/ci-workflows/.github/actions/run-claude-cli@5e18f3d6cebd6fa5e66b0941ee0f7ed6ba288d6c # v0.58.0 + uses: melodic-software/ci-workflows/.github/actions/run-claude-cli@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 env: # No work may outlive the result message the launcher reads. CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1" @@ -608,11 +609,12 @@ jobs: - name: Report the judgment's outcome if: steps.judge.outcome == 'success' || steps.judge.outcome == 'failure' - uses: melodic-software/ci-workflows/.github/actions/report-lane-outcome@5e18f3d6cebd6fa5e66b0941ee0f7ed6ba288d6c # v0.58.0 + uses: melodic-software/ci-workflows/.github/actions/report-lane-outcome@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 with: outcome: ${{ steps.judge.outcome }} execution-file: ${{ steps.judge.outputs.execution-file }} lane: pr-verify + lane-id: pr-verify step-started-at: ${{ steps.prompt.outputs.started-at }} step-timeout-minutes: 22 credential: ${{ steps.judge.outputs.credential }}