From 81f0c564d273d7ff072570f728a4597be4377a7e Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sat, 24 Oct 2026 15:02:01 -0400
Subject: [PATCH] chore(ci): re-pin the review callers to ci-workflows v0.65.8

v0.65.8 adds the reusable's check-key-credit job, which reads this
workflow's own runs and skips the key job while the reviews key's last
credit stop is inside six hours. Each caller job grants actions: read for
it; without the grant the run fails at startup. The lane test pins
v0.65.8 and fails when a caller stops granting actions: read.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/pr-review-hosted.yml          |  4 +++-
 .github/workflows/pr-review-security-hosted.yml |  4 +++-
 scripts/ci-review-lanes.test.sh                 | 13 ++++++++++---
 3 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/pr-review-hosted.yml b/.github/workflows/pr-review-hosted.yml
index 8908c7d9b7..eb34eae2d0 100644
--- a/.github/workflows/pr-review-hosted.yml
+++ b/.github/workflows/pr-review-hosted.yml
@@ -163,10 +163,12 @@ jobs:
     # The model jobs narrow this to contents: read and pull-requests: read;
     # only the reusable's status job (the claude-review-status check) writes.
     permissions:
+      actions: read          # the reusable's check-key-credit job reads this
+                             # workflow's runs for the key's recent credit stop
       contents: read
       pull-requests: write   # the review, its inline comments and the lane's
                              # reviewed-head marker comment
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@4c531cea137f5cbb38d4c132dbfa6e38f76fba7d # v0.65.7
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@4f79cc9244498ae856504cf74aeeb05dcc9c6b43 # v0.65.8
     with:
       lane: code
       publish: comments
diff --git a/.github/workflows/pr-review-security-hosted.yml b/.github/workflows/pr-review-security-hosted.yml
index 14a886c290..7c184c2422 100644
--- a/.github/workflows/pr-review-security-hosted.yml
+++ b/.github/workflows/pr-review-security-hosted.yml
@@ -168,10 +168,12 @@ jobs:
     # The model jobs narrow this to contents: read and pull-requests: read;
     # only the reusable's status job (the security-review check) writes.
     permissions:
+      actions: read          # the reusable's check-key-credit job reads this
+                             # workflow's runs for the key's recent credit stop
       contents: read
       pull-requests: write   # the review, its inline comments and the lane's
                              # reviewed-head marker comment
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@4c531cea137f5cbb38d4c132dbfa6e38f76fba7d # v0.65.7
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@4f79cc9244498ae856504cf74aeeb05dcc9c6b43 # v0.65.8
     with:
       lane: security
       publish: comments
diff --git a/scripts/ci-review-lanes.test.sh b/scripts/ci-review-lanes.test.sh
index 8a3ed2c614..38307258e9 100755
--- a/scripts/ci-review-lanes.test.sh
+++ b/scripts/ci-review-lanes.test.sh
@@ -76,10 +76,17 @@ for pair in 'pr-review-hosted.yml pr-review:' 'pr-review-security-hosted.yml pr-
   caller="$ROOT/.github/workflows/$file"
   if grep -qxF "  $job" "$caller" && grep -qxF '      publish: comments' "$caller" &&
     grep -qxF '      hold-label: needs-human' "$caller" &&
-    grep -qE '^    uses: melodic-software/ci-workflows/\.github/workflows/pr-review-cli\.yml@4c531cea137f5cbb38d4c132dbfa6e38f76fba7d # v0\.65\.7$' "$caller"; then
-    ok "$file calls pr-review-cli v0.65.7 as job ${job%:} with publish: comments and hold-label: needs-human"
+    grep -qE '^    uses: melodic-software/ci-workflows/\.github/workflows/pr-review-cli\.yml@4f79cc9244498ae856504cf74aeeb05dcc9c6b43 # v0\.65\.8$' "$caller"; then
+    ok "$file calls pr-review-cli v0.65.8 as job ${job%:} with publish: comments and hold-label: needs-human"
   else
-    fail "$file lost its job id, publish: comments, hold-label or v0.65.7 pin"
+    fail "$file lost its job id, publish: comments, hold-label or v0.65.8 pin"
+  fi
+  # pr-review-cli's check-key-credit job requests actions: read; a caller that
+  # does not grant it fails at startup.
+  if awk -v job="  $job" '$0 == job { on = 1; next } on && /^  [^ ]/ { exit } on && /^      actions: read( |$)/ { found = 1 } END { exit !found }' "$caller"; then
+    ok "$file grants actions: read to job ${job%:}"
+  else
+    fail "$file does not grant actions: read to job ${job%:}"
   fi
   paths="$(awk '/^      hold-paths: \|$/ { on = 1; next } on && /^        / { sub(/^ +/, ""); print; next } on { exit }' "$caller")"
   if [[ "$paths" == $'.github/standards/trusted-actors/**\n.github/actions/check-trusted-trigger/**\n**/CODEOWNERS\n**/.gitmodules' ]]; then