[kyle-sexton]

No related issue: finishes the ci-workflows v0.39.3 repin wave, whose earlier PR in this repository missed these lines.

Summary

Repins the remaining ci-workflows v0.38.2 (cf316d12) composite-action pins in pr-require-checks.yml to v0.39.3 (ab83b01).

Fix

The wave PR moved the v0.39.0 pin but left these v0.38.2 lines. They are composite actions, so no runner-policy contract is involved. With these merged, no repository pins v0.38.2, and its contracts can be retired in standards.

Verification

• Each action path exists at ab83b01 (gh api repos/melodic-software/ci-workflows/contents/.github/actions/<path>/action.yml?ref=ab83b01).
• actionlint on the workflow: no new findings; the only report is a pre-existing SC2016 note on an unchanged step.
• The diff changes only uses: pin lines.

Related

• ci-workflows v0.39.3 repin wave; contracts in feat(runner-policy): add ci-workflows v0.39.3 contracts standards#742.

🤖 Generated with Claude Code

https://claude.ai/code/session_01T7GukBojtE99rLCPY7Cw3R

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T04:06:55.008714Z	b7f625b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 54s —— View job

---

Security review complete

• Gather context (diff, changed files)
• Apply skip-gate check
• Review for security-relevant findings
• Post results

Scope reviewed: .github/workflows/pr-require-checks.yml — the only file changed in this PR (+3/-3).

Change: repins three melodic-software/ci-workflows composite-action uses: lines from the full 40-character commit SHA cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 (v0.38.2) to ab83b01273026ab5c23c6f3b40e946d97a863fa2 (v0.39.3) — for typos (line 246), pr-require-checks/check-contract (line 276), and pr-require-checks/aggregate-results (line 284). No other lines, with: inputs, permissions:, or trigger config changed.

Finding: none. This is a pin-bump-only diff — it moves from one full-length immutable commit SHA to another, it does not loosen a pin to a tag/branch or widen permissions:, add a trigger, or touch run:/expression-injection surfaces. Per this skill's scope, action-pin supply-chain risk is zizmor's advisory lane, not this lane's — and in any case this diff tightens the pins to a newer verified commit rather than loosening them, so there is nothing to defer either. No logic, authorization, injection, or secret-handling surface is present in this change. The instruction-surface-deletion lens also does not apply: no standing instruction (CLAUDE.md/AGENTS.md/rules file) is touched.

No security issues found. No inline comments posted.

[claude]

Claude finished @kyle-sexton's task in 1m 17s —— View job

---

Code review complete

• Gather context (PR diff, changed files, CLAUDE.md/AGENTS.md)
• Review changed lines in .github/workflows/pr-require-checks.yml
• Check pin correctness (SHA validity, consistency, action paths)
• Post findings

No findings. This is a clean, mechanical repin:

• The 3 changed lines (typos, pr-require-checks/check-contract, pr-require-checks/aggregate-results) move from the v0.38.2 SHA (cf316d12…) to the v0.39.3 SHA (ab83b012…), with the version comment updated to match each time.
• Confirmed repo-wide (grep over tracked *.yml/*.yaml/*.json) that no cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 / v0.38.2 references remain anywhere in this repository after this change — matches the PR's claim.
• Confirmed all four ci-workflows composite-action pins across both workflow files (pr-require-checks.yml and pr-check-managed-files-hosted.yml) now point at the same ab83b012… SHA / v0.39.3 tag, so the pin is consistent repo-wide.
• Diff touches only uses: pin lines and their trailing version comments — no with:/logic changes, matching the PR's own description.
• The destination SHA value itself (that ab83b012… actually resolves to the v0.39.3 tag in melodic-software/ci-workflows) is author-claimed via gh api in the PR body; I did not have network/gh access in this session to independently re-verify that lookup, so I'm flagging it as unverified rather than restating it as confirmed. The SHA format itself (40-char hex) is well-formed.

No code-review-lane issues to raise. Nothing to post inline.

[github-actions]

claude-security-review has reviewed this pull request through b7f625b; a later push is reviewed from there.

[github-actions]

claude-review has reviewed this pull request through b7f625b; a later push is reviewed from there.