feat(runner-policy): add ci-workflows v0.38.1 contracts by kyle-sexton · Pull Request #713 · melodic-software/standards

kyle-sexton · 2026-10-05T02:32:08Z

Summary

Registers the nine ci-workflows reusables at the v0.38.1 tag 2531d56a21e79b7b5222643fadbee95c23a4525b in components/runner-policy/policy.json. Without them the automated repin #711 fails check-policies (the sync job's routing reads needs, so its new SHA cannot be auto-approved). #711 carries the merge-queue wait from ci-workflows#695 into this repo's sync, which fixes #703.

Fix

policy.json: nine new keys, each body a verbatim copy of its 95732fd (v0.38.0) entry, text-spliced (121 insertions, 0 deletions; a JSON comparison confirms each copy equals its source).
README.md: review note for v0.38.1.

v0.38.1 adds only ci-workflows#695 on top of v0.38.0: eight workflow blobs are byte-identical. maintenance-sync-standards.yml adds one actions/github-script step that uses the target-scoped App token it already mints, and raises the sync job timeout from 15 to 45 minutes. No input, secret, caller permission or runs-on routing moved. The 95732fd and fb56986 entries stay until every consumer repins.

Verification

git diff 95732fd..2531d56 in ci-workflows: only feat(github-actions-conventions): mark run-activity in use #695's three files.
npm run test:runner-policy 297/297, npm run lint:runner-policy pass, markdownlint and biome clean.
With chore(claude-lanes): re-pin callers to ci-workflows v0.38.1 #711's patch applied on top locally, runner-policy.mjs --root . passes and the 297 tests pass.

Register the nine ci-workflows reusables at the v0.38.1 tag 2531d56, each a verbatim copy of its v0.38.0 (95732fd) entry, so the repin that carries the merge-queue wait for standards-sync (ci-workflows#695, #703) passes runner-policy. v0.38.1 adds only #695: eight workflow blobs are identical, and maintenance-sync-standards adds one step and a longer job timeout with no input, secret, caller permission or runs-on routing change. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

chatgpt-codex-connector · 2026-10-05T02:32:27Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-05T02:34:13.493724Z	`b432218`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

claude · 2026-10-05T02:32:34Z

Claude encountered an error after 0s —— View job

I'll analyze this and get back to you.

claude · 2026-10-05T02:32:37Z

Claude encountered an error after 0s —— View job

I'll analyze this and get back to you.

claude · 2026-10-05T02:33:46Z

Claude encountered an error after 0s —— View job

I'll analyze this and get back to you.

claude · 2026-10-05T02:33:47Z

Claude encountered an error after 0s —— View job

I'll analyze this and get back to you.

No related issue: fleet repin to the current ci-workflows release in the GitHub Actions conventions migration. ## Summary Moves this repository's repo-owned ci-workflows pins from v0.36.0 (`fb56986`), v0.37.0 (`d49c491`) and v0.38.0 (`95732fd`) to v0.38.1 (`2531d56a21e79b7b5222643fadbee95c23a4525b`), so the fleet runs one release. ## Fix Pin SHA and `# v0.38.1` comment only, plus any repo-owned file that asserts the pin. Also passes `dotnet-version: 10.0.400` to the `dotnet-build` and `dotnet-format` steps: v0.38.0 made an SDK version mandatory (no global.json here), and 10.0.400 is the SDK those steps installed before, from ci-workflows' own global.json. Sync-managed callers and the synced runner-policy contracts are left to the standards sync. No path moved between v0.36.0 and v0.38.0. ## Verification - Every repo-owned `uses: melodic-software/ci-workflows/...` pin is at `2531d56`; every pinned path exists at that commit. - actionlint passes on the changed workflows; the diff touches pin lines only. - The runner-policy contracts for `2531d56` merged in standards#713; this PR's runner-policy check passes once the standards sync delivers them. ## Related - #709 and #713 (v0.38.0 and v0.38.1 runner-policy contracts) - ci-workflows v0.38.1 release 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

No related issue: prerequisite contracts that unblock the automated claude-lanes repin in #715. ## Summary Registers the nine ci-workflows reusables at the v0.38.2 tag `cf316d12b4a14fbdb96a339b7ad00ce935a8cad4` in `components/runner-policy/policy.json`. Without these entries, the automated repin #715 fails `check-policies`. The sync job's routing reads `needs`, and `pr-review`/`pr-review-security` carry reviewed `allowedCallerPermissions` grants, so their new SHA cannot be auto-approved. ## Fix - `policy.json`: nine new keys. Each body is a verbatim copy of its `2531d56` (v0.38.1) entry, text-spliced (121 insertions, 0 deletions). A JSON comparison confirms each copy equals its source. - `README.md`: review note for v0.38.2. v0.38.2 adds ci-workflows#696 and #697 on top of v0.38.1. Together they touch only `pr-require-checks.yml`, its `aggregate-results` action, a test and the README. All nine registered workflow blobs are byte-identical between `2531d56` and `cf316d1` (confirmed with `git rev-parse <sha>:<path>`). No input, secret, caller permission or `runs-on` routing moved. The `2531d56` entries stay until every consumer repins. ## Verification - `git diff --stat 2531d56 cf316d1` in ci-workflows: only the six files above. Blob comparison of the nine reusables: all identical. - `npm run test:runner-policy`: 297/297 pass. `npm run lint:runner-policy`: pass. - With #715's patch applied on top locally, `npm run test:runner-policy` passes 297/297 (previously 4 failures in CI), and `CI_REPOSITORY_VISIBILITY=public npm run lint:runner-policy` passes. - Pre-commit hooks pass: markdownlint, biome, typos, gitleaks, editorconfig. ## Related - #715 (repin this unblocks) - #713 (same change for v0.38.1) 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01S6P1ZfQhbydBZNKz2LUfnf --- _Generated by [Claude Code](https://claude.ai/code/session_01S6P1ZfQhbydBZNKz2LUfnf)_ Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

No related issue: unblocks the ci-workflows v0.39.0 fleet repin in the GitHub Actions conventions migration. ## Summary Registers the nine ci-workflows reusables at the v0.39.0 tag `6ba73b97b058602c4dd2bb6e2cce234d11011787` in `components/runner-policy/policy.json`, so consumer repins from v0.38.2 pass runner-policy. The `cf316d1` (v0.38.2) entries stay until every consumer has repinned; a follow-up retires them. ## Fix - `policy.json`: nine new keys, each spliced in as text after its `cf316d1` entry (no re-serialization; 121 insertions, 0 deletions). Eight are verbatim copies; `maintenance-sync-standards` widens. - `README.md`: review note for v0.39.0. Contracts added (all `melodic-software/ci-workflows/.github/workflows/<file>@6ba73b97b058602c4dd2bb6e2cce234d11011787`): | Reusable | Secret-capable | Surface change since v0.38.2 | Contract | | --- | --- | --- | --- | | `maintenance-sync-standards.yml` | yes (App client ID + private key) | New `environment` input (default `standards-sync`); `attest` and `sync` jobs now run in that caller-repository environment with `deployment: false`, so an environment secret overrides a passed one. `workflow_call` secrets renamed `app-client-id`/`app-private-key` to `STANDARDS_SYNC_APP_CLIENT_ID`/`STANDARDS_SYNC_APP_PRIVATE_KEY`. | Widened: `allowedInputs` adds `environment`; `allowedSecrets` keys renamed to `STANDARDS_SYNC_APP_CLIENT_ID`/`STANDARDS_SYNC_APP_PRIVATE_KEY` (caller-side values unchanged). Consumers must rename the keys under `secrets:` when they repin. | | `intake-triage.yml` | yes (`CLAUDE_CODE_OAUTH_TOKEN`) | `anthropics/claude-code-action` v1.0.240 to v1.0.241 (`cab360f`); `$/report-lane-outcome` tree changes only in its tests. | Verbatim copy | | `pr-review.yml` | yes (`CLAUDE_CODE_OAUTH_TOKEN`) | Same claude-code-action bump and test-only `$/report-lane-outcome` change. | Verbatim copy | | `pr-review-security.yml` | yes (`CLAUDE_CODE_OAUTH_TOKEN`) | Same claude-code-action bump and test-only `$/report-lane-outcome` change. | Verbatim copy | | `intake-label-needs-triage.yml` | no | None: blob byte-identical (`a0a7e39`). | Verbatim copy | | `pr-scan-dependencies.yml` | no | None: blob byte-identical (`5ced69e`). | Verbatim copy | | `pr-audit-workflows.yml` | no | None: blob byte-identical (`0a1a611`). | Verbatim copy | | `pr-automerge-dependabot.yml` | no | None: blob byte-identical (`7f65abe`). | Verbatim copy | | `pr-run-checks.yml` | no | None: blob byte-identical (`3f9622e`). | Verbatim copy | The four secret-capable entries never auto-copy and need the owner's hand sign-off. The other release changes (`pr-require-checks.yml`, `check-managed-files`, new `check-workflow-naming`) are not consumed by any pinned reusable. ## Verification - `git diff cf316d12..6ba73b97 -- .github/workflows` in ci-workflows matches the table: four reusables changed, five byte-identical; caller permissions and `runs-on` routing unchanged for all nine. `git diff` of `.github/actions/report-lane-outcome` shows only `classify.test.cjs` and `outcome-step.test.cjs`. - `npm run test:runner-policy` (297/297), `npm run lint:runner-policy`, `npx biome check components/runner-policy/policy.json`, `markdownlint-cli2 components/runner-policy/README.md`, and the lefthook pre-commit (typos, editorconfig, gitleaks): all pass. ## Related - ci-workflows v0.39.0 release (`6ba73b9`) - standards#709, #713, #716 (v0.38.x contract precedent) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

No related issue: unblocks the ci-workflows v0.39.3 fleet repin in the GitHub Actions conventions migration. ## Summary Registers the nine ci-workflows reusables at the v0.39.3 tag `ab83b01273026ab5c23c6f3b40e946d97a863fa2` in `components/runner-policy/policy.json`, so consumer repins from v0.38.2, v0.39.0 and v0.39.1/v0.39.2 pass runner-policy. The `6ba73b9` (v0.39.0) and `cf316d1` (v0.38.2) entries stay until every consumer has repinned; a follow-up retires them. ## Fix - `policy.json`: nine new keys, each spliced in as text after its `6ba73b9` entry (no re-serialization; 121 insertions, 0 deletions). All nine are verbatim copies (parsed-JSON equality checked per entry). - `README.md`: review note for v0.39.3. Contracts added (all `melodic-software/ci-workflows/.github/workflows/<file>@ab83b01273026ab5c23c6f3b40e946d97a863fa2`): | Reusable | Secret-capable | Workflow blob | Commit-relative paths reached | Contract | | --- | --- | --- | --- | --- | | `intake-triage.yml` | yes (`CLAUDE_CODE_OAUTH_TOKEN`) | identical (`ccc44c4`) | `$/report-lane-outcome` identical (`cff090b`) | Verbatim copy | | `pr-review.yml` | yes (`CLAUDE_CODE_OAUTH_TOKEN`) | identical (`f0e042a`) | `$/report-lane-outcome` identical | Verbatim copy | | `pr-review-security.yml` | yes (`CLAUDE_CODE_OAUTH_TOKEN`) | identical (`121c7e2`) | `$/report-lane-outcome` identical | Verbatim copy | | `maintenance-sync-standards.yml` | yes (App client ID + private key) | identical (`b3e81ac`) | none | Verbatim copy | | `intake-label-needs-triage.yml` | no | identical (`a0a7e39`) | none | Verbatim copy | | `pr-scan-dependencies.yml` | no | identical (`5ced69e`) | none | Verbatim copy | | `pr-audit-workflows.yml` | no | identical (`0a1a611`) | none | Verbatim copy | | `pr-automerge-dependabot.yml` | no | identical (`7f65abe`) | none | Verbatim copy | | `pr-run-checks.yml` | no | identical (`3f9622e`) | 13 `$/` actions: 8 identical; `detect-changes`, `gitleaks`, `check-exec-bit`, `check-machine-paths`, `check-comment-markers` changed | Verbatim copy, **needs hand review** | **Hand review needed on `pr-run-checks`:** its surface and workflow blob are identical, but five action trees it reaches have different object SHAs, so it is not an auto-copy under the README's tree-SHA rule. The change is the shfmt `switch_case_indent` re-indentation (ci-workflows#712): `git diff --stat 6ba73b97 ab83b01` on those five directories shows 103 insertions and 103 deletions across `superset-test.sh`, `check-exec-bit.sh`, `check-machine-specific-paths.sh`, `match.sh`, `scan.sh` and `scan.test.sh`, and `git diff -w` on the same paths is empty. No `action.yml` changed. The other release changes (`check-managed-files` Dependabot-skip hardening in ci-workflows#709, `pr-require-checks.yml`, `pr-run-checks-go.yml` golangci-lint bump in #713) are not reached by any registered reusable. ## Verification - In ci-workflows, `git rev-parse` of each of the nine workflow blobs at `6ba73b97` and `ab83b01` matches, and a recursive walk of every `$/` and `./` reference shows the object SHAs in the table. - Per-entry check: each new key's parsed contract equals its `6ba73b9` predecessor. - `npm run test:runner-policy` (297/297), `npm run lint:runner-policy`, `npm run test:concurrency-policy` (31/31), `npm run lint:concurrency-policy`, `npm run test:pr-convention-lockstep` (82/82), `npm run lint:dependabot-automerge-lockstep`, `npx biome check components/runner-policy/policy.json`, `markdownlint-cli2 components/runner-policy/README.md`, and the lefthook pre-commit (editorconfig, typos, markdownlint, gitleaks, biome): all pass. - `npm run lint:pr-convention-lockstep` fails locally on live fleet fetches (unauthenticated HTTP 403s and caller drift in other repos); it reads no file this PR touches. ## Related - ci-workflows v0.39.3 release (`ab83b01`) - #732 (v0.39.0 contract precedent) 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01T7GukBojtE99rLCPY7Cw3R --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

kyle-sexton marked this pull request as ready for review October 5, 2026 02:32

kyle-sexton merged commit eac66d3 into main Oct 5, 2026
22 of 26 checks passed

kyle-sexton deleted the feat/runner-policy-v0.38.1-contracts branch October 5, 2026 02:34

This was referenced Oct 5, 2026

ci: repin ci-workflows to v0.38.1 #712

Merged

fix(sync): standards-sync fails when the target's previous sync PR is in a merge queue #703

Closed

kyle-sexton mentioned this pull request Oct 6, 2026

feat(runner-policy): add ci-workflows v0.38.2 contracts #716

Merged

kyle-sexton mentioned this pull request Oct 7, 2026

feat(runner-policy): add ci-workflows v0.39.0 contracts #732

Merged

kyle-sexton mentioned this pull request Oct 9, 2026

feat(runner-policy): add ci-workflows v0.39.3 contracts #742

Merged

Navigation Menu

Repository navigation

feat(runner-policy): add ci-workflows v0.38.1 contracts - #713

feat(runner-policy): add ci-workflows v0.38.1 contracts#713
kyle-sexton merged 1 commit into
mainfrom
feat/runner-policy-v0.38.1-contracts

kyle-sexton commented Oct 5, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 5, 2026 •

edited

Loading

Uh oh!

claude Bot commented Oct 5, 2026 •

edited

Loading

Uh oh!

claude Bot commented Oct 5, 2026 •

edited

Loading

Uh oh!

claude Bot commented Oct 5, 2026 •

edited

Loading

Uh oh!

claude Bot commented Oct 5, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

kyle-sexton commented Oct 5, 2026

Summary

Fix

Verification

Related

Uh oh!

chatgpt-codex-connector Bot commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

claude Bot commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

chatgpt-codex-connector Bot commented Oct 5, 2026 •

edited

Loading

claude Bot commented Oct 5, 2026 •

edited

Loading

claude Bot commented Oct 5, 2026 •

edited

Loading

claude Bot commented Oct 5, 2026 •

edited

Loading

claude Bot commented Oct 5, 2026 •

edited

Loading