From ba362ecaec748a95370796ad2314fce2f4e56f23 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Wed, 7 Oct 2026 09:42:23 -0400 Subject: [PATCH] feat(runner-policy): add ci-workflows v0.39.0 contracts Co-Authored-By: Claude Opus 5.5 --- components/runner-policy/README.md | 16 ++++ components/runner-policy/policy.json | 121 +++++++++++++++++++++++++++ 2 files changed, 137 insertions(+) diff --git a/components/runner-policy/README.md b/components/runner-policy/README.md index ee9d5028..f6c904e3 100644 --- a/components/runner-policy/README.md +++ b/components/runner-policy/README.md @@ -1123,6 +1123,22 @@ key was retired under step 4 of the lockstep below, so `policy.json` admits ci-workflows only at `cf316d1`; the older entries the tests read live verbatim in `fixtures/historical-contracts.json`, and the review notes in this section stay as the record the v0.38.2 terms were copied from. +All nine reusables are also registered at the v0.39.0 tag +`6ba73b97b058602c4dd2bb6e2cce234d11011787`. Five workflow blobs are +byte-identical to v0.38.2 (`intake-label-needs-triage`, `pr-scan-dependencies`, +`pr-audit-workflows`, `pr-automerge-dependabot`, `pr-run-checks`), and each +copies its `cf316d1` entry verbatim. `intake-triage`, `pr-review` and +`pr-review-security` bump `anthropics/claude-code-action` from v1.0.240 to +v1.0.241 (`cab360f`), and their `$/report-lane-outcome` tree changes only in +its tests; each copies its `cf316d1` entry verbatim, and because each is +secret-capable the copy is a hand review, never an auto-copy. `maintenance-sync-standards` is the one entry +that widens: it adds the `environment` input (default `standards-sync`), whose +`attest` and `sync` jobs read the App secrets from that caller-repository +environment with `deployment: false`, and renames its `workflow_call` secrets +from `app-client-id` and `app-private-key` to `STANDARDS_SYNC_APP_CLIENT_ID` and +`STANDARDS_SYNC_APP_PRIVATE_KEY`, so a caller repinning to v0.39.0 must +rename the keys it passes under `secrets:`. The caller-side values, caller +permissions and `runs-on` routing are unchanged. The Zizmor contract at `de50a08b6093d231519ee7a4c9371db76c0a7e1e` uses its reviewed `runner` input and checksum-verified native Linux binary, so enrolled consumers may route that advisory lane onto the managed fleet diff --git a/components/runner-policy/policy.json b/components/runner-policy/policy.json index a66f604f..e6014928 100644 --- a/components/runner-policy/policy.json +++ b/components/runner-policy/policy.json @@ -19,6 +19,24 @@ "issues": "write" } }, + "melodic-software/ci-workflows/.github/workflows/intake-triage.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787": { + "routing": "runner-input", + "runnerInput": "runner", + "allowedInputs": [ + "runner", + "allowed-labels", + "escalation-label", + "instructions", + "cli-version" + ], + "allowedSecrets": { + "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}" + }, + "allowedCallerPermissions": { + "contents": "read", + "issues": "write" + } + }, "melodic-software/ci-workflows/.github/workflows/pr-review.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4": { "routing": "runner-input", "runnerInput": "runner", @@ -32,6 +50,19 @@ "id-token": "write" } }, + "melodic-software/ci-workflows/.github/workflows/pr-review.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787": { + "routing": "runner-input", + "runnerInput": "runner", + "allowedInputs": ["runner", "incremental-review"], + "allowedSecrets": { + "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}" + }, + "allowedCallerPermissions": { + "contents": "read", + "pull-requests": "write", + "id-token": "write" + } + }, "melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4": { "routing": "runner-input", "runnerInput": "runner", @@ -45,6 +76,19 @@ "id-token": "write" } }, + "melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787": { + "routing": "runner-input", + "runnerInput": "runner", + "allowedInputs": ["runner", "incremental-review"], + "allowedSecrets": { + "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}" + }, + "allowedCallerPermissions": { + "contents": "read", + "pull-requests": "write", + "id-token": "write" + } + }, "melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4": { "routing": "runner-input", "runnerInput": "runner", @@ -54,6 +98,15 @@ "issues": "write" } }, + "melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787": { + "routing": "runner-input", + "runnerInput": "runner", + "allowedInputs": ["runner", "label", "label-prefix"], + "allowedSecrets": {}, + "allowedCallerPermissions": { + "issues": "write" + } + }, "melodic-software/ci-workflows/.github/workflows/pr-scan-dependencies.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4": { "routing": "runner-input", "runnerInput": "runner", @@ -63,6 +116,15 @@ "contents": "read" } }, + "melodic-software/ci-workflows/.github/workflows/pr-scan-dependencies.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787": { + "routing": "runner-input", + "runnerInput": "runner", + "allowedInputs": ["runner"], + "allowedSecrets": {}, + "minimumCallerPermissions": { + "contents": "read" + } + }, "melodic-software/ci-workflows/.github/workflows/maintenance-sync-standards.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4": { "routing": "runner-input", "runnerInput": "runner", @@ -72,6 +134,15 @@ "app-private-key": "${{ secrets.STANDARDS_SYNC_APP_PRIVATE_KEY }}" } }, + "melodic-software/ci-workflows/.github/workflows/maintenance-sync-standards.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787": { + "routing": "runner-input", + "runnerInput": "runner", + "allowedInputs": ["runner", "manifest", "standards-ref", "dry-run", "targets", "environment"], + "allowedSecrets": { + "STANDARDS_SYNC_APP_CLIENT_ID": "${{ secrets.STANDARDS_SYNC_APP_CLIENT_ID }}", + "STANDARDS_SYNC_APP_PRIVATE_KEY": "${{ secrets.STANDARDS_SYNC_APP_PRIVATE_KEY }}" + } + }, "melodic-software/ci-workflows/.github/workflows/pr-audit-workflows.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4": { "routing": "runner-input", "runnerInput": "runner", @@ -82,6 +153,16 @@ "security-events": "write" } }, + "melodic-software/ci-workflows/.github/workflows/pr-audit-workflows.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787": { + "routing": "runner-input", + "runnerInput": "runner", + "allowedInputs": ["runner", "paths", "fail-on-severity"], + "allowedSecrets": {}, + "allowedCallerPermissions": { + "contents": "read", + "security-events": "write" + } + }, "melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4": { "routing": "runner-input", "runnerInput": "runner", @@ -92,6 +173,16 @@ "pull-requests": "write" } }, + "melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787": { + "routing": "runner-input", + "runnerInput": "runner", + "allowedInputs": ["runner"], + "allowedSecrets": {}, + "allowedCallerPermissions": { + "contents": "write", + "pull-requests": "write" + } + }, "melodic-software/ci-workflows/.github/workflows/pr-run-checks.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4": { "routing": "runner-input", "runnerInput": "runner", @@ -121,6 +212,36 @@ "contents": "read", "pull-requests": "read" } + }, + "melodic-software/ci-workflows/.github/workflows/pr-run-checks.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787": { + "routing": "runner-input", + "runnerInput": "runner", + "allowedInputs": [ + "runner", + "filters", + "timeout-minutes", + "typos", + "gitleaks", + "editorconfig", + "markdown", + "shellcheck", + "actionlint", + "exec-bit", + "machine-specific-paths", + "eol-renormalize", + "comment-hygiene", + "lychee-offline", + "check-jsonschema", + "check-jsonschema-files", + "check-jsonschema-builtin-schema", + "machine-specific-paths-exclude", + "comment-hygiene-exclude" + ], + "allowedSecrets": {}, + "minimumCallerPermissions": { + "contents": "read", + "pull-requests": "read" + } } }, "approvedHostedRunnerLabels": ["ubuntu-24.04", "windows-2025"],