[kyle-sexton]

No related issue: unblocks the ci-workflows v0.39.0 fleet repin in the GitHub Actions conventions migration.

Summary

Registers the nine ci-workflows reusables at the v0.39.0 tag 6ba73b97b058602c4dd2bb6e2cce234d11011787 in components/runner-policy/policy.json, so consumer repins from v0.38.2 pass runner-policy. The cf316d1 (v0.38.2) entries stay until every consumer has repinned; a follow-up retires them.

Fix

• policy.json: nine new keys, each spliced in as text after its cf316d1 entry (no re-serialization; 121 insertions, 0 deletions). Eight are verbatim copies; maintenance-sync-standards widens.
• README.md: review note for v0.39.0.

Contracts added (all melodic-software/ci-workflows/.github/workflows/<file>@6ba73b97b058602c4dd2bb6e2cce234d11011787):

Reusable	Secret-capable	Surface change since v0.38.2	Contract
maintenance-sync-standards.yml	yes (App client ID + private key)	New environment input (default standards-sync); attest and sync jobs now run in that caller-repository environment with deployment: false, so an environment secret overrides a passed one. workflow_call secrets renamed app-client-id/app-private-key to STANDARDS_SYNC_APP_CLIENT_ID/STANDARDS_SYNC_APP_PRIVATE_KEY.	Widened: allowedInputs adds environment; allowedSecrets keys renamed to STANDARDS_SYNC_APP_CLIENT_ID/STANDARDS_SYNC_APP_PRIVATE_KEY (caller-side values unchanged). Consumers must rename the keys under secrets: when they repin.
intake-triage.yml	yes (CLAUDE_CODE_OAUTH_TOKEN)	anthropics/claude-code-action v1.0.240 to v1.0.241 (cab360f); $/report-lane-outcome tree changes only in its tests.	Verbatim copy
pr-review.yml	yes (CLAUDE_CODE_OAUTH_TOKEN)	Same claude-code-action bump and test-only $/report-lane-outcome change.	Verbatim copy
pr-review-security.yml	yes (CLAUDE_CODE_OAUTH_TOKEN)	Same claude-code-action bump and test-only $/report-lane-outcome change.	Verbatim copy
intake-label-needs-triage.yml	no	None: blob byte-identical (a0a7e39).	Verbatim copy
pr-scan-dependencies.yml	no	None: blob byte-identical (5ced69e).	Verbatim copy
pr-audit-workflows.yml	no	None: blob byte-identical (0a1a611).	Verbatim copy
pr-automerge-dependabot.yml	no	None: blob byte-identical (7f65abe).	Verbatim copy
pr-run-checks.yml	no	None: blob byte-identical (3f9622e).	Verbatim copy

The four secret-capable entries never auto-copy and need the owner's hand sign-off. The other release changes (pr-require-checks.yml, check-managed-files, new check-workflow-naming) are not consumed by any pinned reusable.

Verification

• git diff cf316d12..6ba73b97 -- .github/workflows in ci-workflows matches the table: four reusables changed, five byte-identical; caller permissions and runs-on routing unchanged for all nine. git diff of .github/actions/report-lane-outcome shows only classify.test.cjs and outcome-step.test.cjs.
• npm run test:runner-policy (297/297), npm run lint:runner-policy, npx biome check components/runner-policy/policy.json, markdownlint-cli2 components/runner-policy/README.md, and the lefthook pre-commit (typos, editorconfig, gitleaks): all pass.

Related

• ci-workflows v0.39.0 release (6ba73b9)
• standards#709, feat(runner-policy): add ci-workflows v0.38.1 contracts #713, feat(runner-policy): add ci-workflows v0.38.2 contracts #716 (v0.38.x contract precedent)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-07T13:45:38.472141Z	ba362ec	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 3m 34s —— View job

---

Code review: feat(runner-policy): add ci-workflows v0.39.0 contracts

• Gather context (diff, policy.json schema, CLAUDE.md/REVIEW.md)
• Review policy.json additions for correctness
• Review README.md changes
• Verify claims against repo state (diff, byte-identical hashes, schema)
• Post findings

No blocking findings.

What I checked

• Schema conformance: all 9 new policy.json entries validate against components/runner-policy/policy.schema.json's runnerInputContract shape (required routing/runnerInput/allowedInputs/allowedSecrets, correct reusableWorkflowReference pattern for the key, valid githubPermissionMap/githubMinimumPermissionMap values).
• "Eight verbatim copies" claim: compared each new @6ba73b97b05... entry byte-for-byte against its @cf316d12b4a... sibling in policy.json — intake-triage, pr-review, pr-review-security, intake-label-needs-triage, pr-scan-dependencies, pr-audit-workflows, pr-automerge-dependabot, and pr-run-checks are all structurally identical except the pinned SHA in the key. Confirmed.
• maintenance-sync-standards widening: the new entry does add "environment" to allowedInputs and renames the allowedSecrets keys (app-client-id/app-private-key → STANDARDS_SYNC_APP_CLIENT_ID/STANDARDS_SYNC_APP_PRIVATE_KEY) while the secret expression values stay the same. Matches the PR body's table and the README prose.
• Diff stats: git diff origin/main...HEAD --numstat confirms exactly 121/0 for policy.json and 16/0 for README.md, matching the claimed insertion counts.
• Lockstep process (README.md § Contract revision lockstep): this PR does step 2 (append contract + review note) only. Confirmed the standards repo's own workflows (pr-review.yml, pr-review-security.yml, maintenance-sync-standards.yml, pr-require-checks.yml, pr-automerge-dependabot.yml) are themselves still pinned at @cf316d12... (v0.38.2), so this PR correctly leaves the repin (step 3) and retirement of the old entries (step 4) for later, as the body says.
• Secret-capable entries require hand review, never auto-copy: the four secret-capable contracts (intake-triage, pr-review, pr-review-security, maintenance-sync-standards) are exactly the ones the README's auto-approval logic (lines ~318–329) says can never auto-approve — consistent with the PR's claim that these were hand-reviewed rather than tool-generated.

Not independently verified

I don't have access to the melodic-software/ci-workflows repository from this sandbox, so the following are author-claimed, not verified by me:

• That 6ba73b97b058602c4dd2bb6e2cce234d11011787 is in fact the merged main commit for the ci-workflows v0.39.0 tag.
• The git diff cf316d12..6ba73b97 summary (which five workflows are byte-identical, which four changed and how).
• The npm run test:runner-policy (297/297), lint, Biome, markdownlint, and lefthook results reported in the Verification section — I did not have node_modules installed in this sandbox to re-run them.
  · Branch

[claude]

Claude finished @kyle-sexton's task in 1m 56s —— View job

---

Security review complete

• Gather context (PR diff, changed files)
• Apply skip-gate check
• Review components/runner-policy/policy.json changes
• Review components/runner-policy/README.md changes
• Check instruction-surface deletions (AGENTS.md / rules files)
• Post findings

No security issues found.

This PR is a pure-addition registration change: nine new approvedReusableWorkflowContracts entries in components/runner-policy/policy.json pinning melodic-software/ci-workflows reusable workflows to the v0.39.0 full-SHA tag 6ba73b97b058602c4dd2bb6e2cce234d11011787, plus a corresponding review note in components/runner-policy/README.md. No deletions, no existing entries modified, no workflow files (.github/workflows/**) touched.

Checked:

• Permissions/secrets diff vs. v0.38.2 (cf316d1) entries — policy.json: eight of the nine new entries are byte-for-byte identical in allowedInputs, allowedSecrets, and allowedCallerPermissions/minimumCallerPermissions to their cf316d1 counterparts — no privilege widening. maintenance-sync-standards.yml@6ba73b97 (L137-L145) is the one entry that widens: it adds the environment input and renames the allowedSecrets keys from app-client-id/app-private-key to STANDARDS_SYNC_APP_CLIENT_ID/STANDARDS_SYNC_APP_PRIVATE_KEY. The secret values (${{ secrets.STANDARDS_SYNC_APP_CLIENT_ID }} / ${{ secrets.STANDARDS_SYNC_APP_PRIVATE_KEY }}) are unchanged, so no new secret exposure — only the upstream workflow_call input name changed, correctly mirrored here.
• Environment-secret-override nuance — the README addition (L1123-L1140) itself documents that an environment secret can override a passed one for the attest/sync jobs. That's an upstream ci-workflows v0.39.0 behavior being transparently recorded, not a change introduced by this diff — there's no executable logic here for it to act on, and no concrete exploit path within this file pair.
• SHA/repo integrity — all nine new keys target the same melodic-software/ci-workflows repo with a full 40-character commit SHA pin (not a mutable tag), consistent with the existing cf316d1 pattern and the org's established SHA-pinning convention. No typosquatted repo names or shortened/ambiguous refs.
• Instruction-surface check — no rules files, AGENTS.md, hooks, or skill/agent bodies are touched or softened by this diff; not applicable here.

GitHub Actions supply-chain/pin-hardening concerns (e.g., independently verifying the SHA's content against the upstream release) are zizmor's advisory lane per this skill's scope and are not re-reported here.

[github-actions]

claude-security-review has reviewed this pull request through ba362ec; a later push is reviewed from there.

[github-actions]

claude-review has reviewed this pull request through ba362ec; a later push is reviewed from there.