[kyle-sexton]

No related issue: fleet repin to ci-workflows v0.39.3 in the GitHub Actions conventions migration.

Summary

Moves this repository's repo-owned ci-workflows pins from v0.39.0 (6ba73b9) to v0.39.3 (ab83b01273026ab5c23c6f3b40e946d97a863fa2), so the fleet runs one release.

Fix

Pin SHA and # v0.39.3 comment only. Sync-managed callers and the synced runner-policy contracts are left to the standards sync. Between v0.39.0 and v0.39.3 no pinned path moved, every reusable workflow blob is byte-identical, and the only action.yml that changed is check-managed-files (Dependabot-skip hardening, ci-workflows#709). The rest of the release is shell re-indentation (ci-workflows#712) and a golangci-lint bump in pr-run-checks-go (ci-workflows#713).

Verification

• Every repo-owned uses: melodic-software/ci-workflows/... pin is at ab83b01; every pinned path exists at that commit.
• actionlint passes on the changed workflows; the diff touches pin lines only; the lefthook pre-commit passed.
• The runner-policy contracts for ab83b01 are in feat(runner-policy): add ci-workflows v0.39.3 contracts standards#742. Until it merges and the standards sync delivers them, this PR's runner-policy check fails on the new reusable keys; that is expected.

Related

• feat(runner-policy): add ci-workflows v0.39.3 contracts standards#742 (v0.39.3 runner-policy contracts)
• ci-workflows v0.39.3 release

🤖 Generated with Claude Code

https://claude.ai/code/session_01T7GukBojtE99rLCPY7Cw3R

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T02:09:00.736435Z	e965225	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 34s —— View job

---

Security review: no issues found

• Gather context (PR diff, changed files)
• Apply skip gate / assess security-relevant surface
• Review diff for security issues
• Post findings / conclusion

Scope: origin/main...HEAD touches two files, both pure ci-workflows pin bumps from v0.39.0 (6ba73b9) to v0.39.3 (ab83b01):

• .github/workflows/pr-automerge-dependabot.yml
• .github/workflows/pr-require-checks.yml (two call sites)

Assessment: Each uses: line remains pinned to a full commit SHA with a version comment — no pin is loosened to a branch/tag or unpinned, so there's no new supply-chain exposure, and pin-strength changes are this lane's defer-to-zizmor category regardless. No workflow permissions:, triggers, secrets handling, or run:/expression blocks changed. No AGENTS.md/rules/skill/hook instruction content was touched, so the instruction-surface-deletion check doesn't apply. There is no other security-relevant logic, authz, or data-handling surface in this diff.

Conclusion: No security issues found in this PR. Skip gate applies — change has no security-relevant surface beyond a same-shape SHA pin bump.

[claude]

Claude finished @kyle-sexton's task in 1m 3s —— View job

---

Claude's PR Review

• Gather context (PR diff, CLAUDE.md/AGENTS.md, docs preflight)
• Review changed workflow files for correctness
• Verify SHA pin and comment consistency
• Post findings

No blocking findings.

What I checked

• git diff origin/main...HEAD shows exactly the two repo-owned pin updates described: pr-automerge-dependabot.yml and pr-require-checks.yml (both check-contract and aggregate-results steps), each moved from 6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 to ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3. SHA and version comment are consistent on every changed line.
• Grepped the whole repo for the old SHA/v0.39.0 to confirm no repo-owned pin was missed: the only remaining hits are pr-check-managed-files-hosted.yml, pr-review-hosted.yml, and pr-review-security-hosted.yml. All three carry an explicit SYNC-MANAGED FILE: DO NOT EDIT IN THE CONSUMING REPOSITORY header pointing at melodic-software/standards components — so leaving them for the standards sync (as the PR description states) is correct, not an oversight.
• The two files actually touched carry no such sync-managed banner, confirming they're the repo-owned callers this PR is meant to move.
• Diff is pin-line-only (SHA + version comment); no behavioral/with: changes, matching the "byte-identical reusable workflow" claim in the description.

Not independently verified

• That ab83b01273026ab5c23c6f3b40e946d97a863fa2 is in fact the v0.39.3 tag commit in melodic-software/ci-workflows, and that the referenced paths exist at that SHA — I have no network access to the upstream repo, so this is author-claimed per the PR's "Verification" section, not something I confirmed myself.
• The author's claims about actionlint and lefthook passing locally — not re-run here.
• The expected runner-policy failure pending melodic-software/standards#742 — consistent with the stated scope, not independently re-triggered.

[github-actions]

claude-security-review has reviewed this pull request through e965225; a later push is reviewed from there.

[github-actions]

claude-review has reviewed this pull request through e965225; a later push is reviewed from there.