ci: repin ci-workflows to v0.38.1 by kyle-sexton · Pull Request #712 · melodic-software/standards

kyle-sexton · 2026-10-05T02:25:24Z

No related issue: fleet repin to the current ci-workflows release in the GitHub Actions conventions migration.

Summary

Moves this repository's repo-owned ci-workflows pins from v0.36.0 (fb56986), v0.37.0 (d49c491) and v0.38.0 (95732fd) to v0.38.1 (2531d56a21e79b7b5222643fadbee95c23a4525b), so the fleet runs one release.

Fix

Pin SHA and # v0.38.1 comment only, plus any repo-owned file that asserts the pin.

Also passes dotnet-version: 10.0.400 to the dotnet-build and dotnet-format steps: v0.38.0 made an SDK version mandatory (no global.json here), and 10.0.400 is the SDK those steps installed before, from ci-workflows' own global.json. Sync-managed callers and the synced runner-policy contracts are left to the standards sync. No path moved between v0.36.0 and v0.38.0.

Verification

Every repo-owned uses: melodic-software/ci-workflows/... pin is at 2531d56; every pinned path exists at that commit.
actionlint passes on the changed workflows; the diff touches pin lines only.
The runner-policy contracts for 2531d56 merged in standards#713; this PR's runner-policy check passes once the standards sync delivers them.

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-05T02:27:35.788267Z	`3d6b949`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

claude · 2026-10-05T02:25:42Z

Claude encountered an error after 59s —— View job

Security review — `/review:security-review`

Gather context (PR diff, changed files)
Apply skip gate
Report result

Skip gate hit: no security-relevant surface.

All three changed files (pr-automerge-dependabot.yml, pr-require-checks.yml, components/managed-files-guard/README.md) change only the pinned commit SHA and the trailing # vX.Y.Z comment on existing melodic-software/ci-workflows uses: references (fb56986/d49c491 → 95732fd), plus the matching doc prose in the README. No trigger, permissions:, secret handling, input/expression, or control-flow logic changed in this diff — every hunk is a pin-line (or pin-describing-prose) swap.

The one security-shaped question this kind of change raises — whether the new SHA is legitimate for the new tag and whether pins stayed fully resolved (no floating refs introduced) — is supply-chain/pin hygiene, which this lane defers to zizmor per its brief; not re-reported here.

No logic flaws, authorization/access-control gaps, injection surfaces, or credential-handling issues found in this diff. No findings to report.

claude · 2026-10-05T02:25:43Z

Claude encountered an error after 56s —— View job

Claude Code review in progress

Gather context (PR diff, changed files)
Review diff for correctness / maintainability issues
Post findings

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3d6b9499fa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

ci-workflows v0.38.0 requires a dotnet-version or a caller global.json. 10.0.400 is the SDK these steps installed before, from ci-workflows' own global.json. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude · 2026-10-05T02:45:45Z

Claude encountered an error after 0s —— View job