[kyle-sexton]

No related issue: fleet repin to ci-workflows v0.39.3 in the GitHub Actions conventions migration.

Summary

Moves this repository's repo-owned ci-workflows pins from v0.39.0 (6ba73b9) to v0.39.3 (ab83b01273026ab5c23c6f3b40e946d97a863fa2), so the fleet runs one release.

Fix

Pin SHA and # v0.39.3 comment only. Sync-managed callers and the synced runner-policy contracts are left to the standards sync. Between v0.39.0 and v0.39.3 no pinned path moved, every reusable workflow blob is byte-identical, and the only action.yml that changed is check-managed-files (Dependabot-skip hardening, ci-workflows#709). The rest of the release is shell re-indentation (ci-workflows#712) and a golangci-lint bump in pr-run-checks-go (ci-workflows#713).

Verification

• Every repo-owned uses: melodic-software/ci-workflows/... pin is at ab83b01; every pinned path exists at that commit.
• actionlint passes on the changed workflows; the diff touches pin lines only; the lefthook pre-commit passed.
• The runner-policy contracts for ab83b01 are in feat(runner-policy): add ci-workflows v0.39.3 contracts standards#742. Until it merges and the standards sync delivers them, this PR's runner-policy check fails on the new reusable keys; that is expected.

Related

• feat(runner-policy): add ci-workflows v0.39.3 contracts standards#742 (v0.39.3 runner-policy contracts)
• ci-workflows v0.39.3 release

🤖 Generated with Claude Code

https://claude.ai/code/session_01T7GukBojtE99rLCPY7Cw3R

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T02:08:42.114428Z	319ddba	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 41s —— View job

---

Security Review

• Gather context (PR diff, changed files)
• Apply skip gate / assess security-relevant surface
• Review changed workflow file against security criteria
• Post final findings

Result: No security issues found.

The only change in this PR is a single-line SHA repin in
.github/workflows/pr-automerge-dependabot.yml:

-    uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
+    uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3

This moves the pin from one full 40-character commit SHA to another full 40-character commit SHA of the same trusted reusable-workflow repo (melodic-software/ci-workflows), with the # v0.39.0 → # v0.39.3 comment updated to match. No trigger, permission, secret, or with:/run: expression changes accompany it — permissions: stays contents: write / pull-requests: write, unchanged from before.

This falls squarely in this lane's skip gate: a SHA-pin version bump with no behavioral or trust-boundary change in this diff has no security-relevant surface for this lane to reason about. Supply-chain concerns around action pin strength (pinned vs. floating, pin tightened vs. loosened) are zizmor's advisory lane per this skill's criteria, not re-reported here — and in any case the pin here remains a full commit SHA both before and after, so there's no loosening to flag.

No instruction-surface deletions (CLAUDE.md/AGENTS.md/rules/skills) are touched by this PR, so the instruction-exception-register check does not apply.

[claude]

Claude finished @kyle-sexton's task in 1m 43s —— View job

---

Code review in progress

• Gather context (PR diff, CLAUDE.md/AGENTS.md, REVIEW.md)
• Review changed file(s) for correctness and alignment
• Verify a candidate finding adversarially
• Post findings (inline or summary)
• Final summary

[github-actions]

claude-security-review has reviewed this pull request through 319ddba; a later push is reviewed from there.

[github-actions]

claude-review has reviewed this pull request through 319ddba; a later push is reviewed from there.