[kyle-sexton]

No related issue: fleet repin to ci-workflows v0.39.0 in the GitHub Actions conventions migration.

Summary

Moves this repository's repo-owned ci-workflows pins from v0.38.2 (cf316d1) to v0.39.0 (6ba73b97b058602c4dd2bb6e2cce234d11011787), so the fleet runs one release.

Fix

Pin SHA and # v0.39.0 comment only, plus any repo-owned file that asserts the pin. Sync-managed callers and the synced runner-policy contracts are left to the standards sync. No pinned path moved between v0.38.2 and v0.39.0, and no caller-facing input changed for the reusables pinned here.

Verification

• Every repo-owned uses: melodic-software/ci-workflows/... pin is at 6ba73b9; every pinned path exists at that commit.
• actionlint passes on the changed workflows; the diff touches pin lines only.
• The runner-policy contracts for 6ba73b9 merged in feat(runner-policy): add ci-workflows v0.39.0 contracts standards#732; this PR's runner-policy check passes once the standards sync delivers them.

Related

• feat(runner-policy): add ci-workflows v0.39.0 contracts standards#732 (v0.39.0 runner-policy contracts)
• ci-workflows v0.39.0 release

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-07T14:09:34.551109Z	d2c0db9	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 1m 5s —— View job

---

Security review — /review:security-review

• Gather context (PR diff, changed files)
• Apply skip gate
• Report result

Result: skip — no security-relevant surface.

The diff touches only two files, each a pin-line bump for an external reusable workflow/action in melodic-software/ci-workflows, from v0.38.2 to v0.39.0:

• .github/workflows/pr-automerge-dependabot.yml#L26
• .github/workflows/pr-require-checks.yml#L115 and #L123

Each change is a full 40-character commit SHA replacing another full 40-character commit SHA (cf316d1… → 6ba73b9…), with the matching # vX.Y.Z comment updated to match. No permissions:, triggers, inputs, secrets, or any workflow logic changed — only the pinned ref and its comment. Pin tightening/loosening and dependency-pin supply-chain risk are explicitly zizmor's advisory lane per this skill's criteria, and these pins remain fully SHA-pinned (not loosened to a tag or branch), so there's nothing in this diff that needs this lane's logic/trust-boundary reasoning.

No CLAUDE.md/AGENTS.md/rules-file/hook changes are present, so the instruction-surface-deletion check doesn't apply either.

No security findings to report.

[claude]

Claude finished @kyle-sexton's task in 1m 24s —— View job

---

Claude's CI code review

Skip gate applied: this change is trivial/automated with no meaningful review surface. Both edits are a mechanical SHA + version-comment bump (cf316d1 → 6ba73b9, # v0.38.2 → # v0.39.0) on two repo-owned callers:

• .github/workflows/pr-automerge-dependabot.yml#L26
• .github/workflows/pr-require-checks.yml#L115 and #L123

Checks performed:

• Both new pins use the same 40-char hex SHA (6ba73b97b058602c4dd2bb6e2cce234d11011787) with a matching # v0.39.0 comment — internally consistent, no mismatched pin/comment pairs.
• Confirmed the three files the PR body says are intentionally left behind (pr-check-managed-files-hosted.yml, pr-review-security-hosted.yml, pr-review-hosted.yml) are each marked SYNC-MANAGED FILE: DO NOT EDIT IN THE CONSUMING REPOSITORY in their headers, so excluding them from this repo-owned repin is correct, not an oversight.
• No pinned path, input, or caller-facing behavior changed — the diff touches only the uses: ref and its trailing comment.

Not independently verified (no network/gh api/actionlint access in this sandbox) — taken as author-claimed per the PR's Verification section:

• That 6ba73b9 actually resolves to the ci-workflows v0.39.0 tag.
• That the pinned action paths exist at that commit.
• actionlint passing and the runner-policy check passing once standards#732 syncs.

No findings to post inline. This is a clean, narrowly-scoped version bump.

[github-actions]

claude-security-review has reviewed this pull request through d2c0db9; a later push is reviewed from there.

[github-actions]

claude-review has reviewed this pull request through d2c0db9; a later push is reviewed from there.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d2c0db927b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add the required live-source record

For this v0.39.0 dependency repin, the supplied PR text names ci-workflows v0.39.0 and standards#732 only as shorthand; it provides neither linked consulted URLs nor a verification date. This leaves the mandatory preflight unverifiable, so add the exact upstream URLs and date checked before merging.

AGENTS.md reference: AGENTS.md:L144-L145

Useful? React with 👍 / 👎.