Skip to content

feat(runner-policy): add ci-workflows v0.39.0 contracts #732

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kyle-sexton merged 1 commit into from
Oct 7, 2026
Merged

feat(runner-policy): add ci-workflows v0.39.0 contracts #732

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions components/runner-policy/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1123,6 +1123,22 @@ key was retired under step 4 of the lockstep below, so `policy.json` admits
ci-workflows only at `cf316d1`; the older entries the tests read live verbatim
in `fixtures/historical-contracts.json`, and the review notes in this section
stay as the record the v0.38.2 terms were copied from.
All nine reusables are also registered at the v0.39.0 tag
`6ba73b97b058602c4dd2bb6e2cce234d11011787`. Five workflow blobs are
byte-identical to v0.38.2 (`intake-label-needs-triage`, `pr-scan-dependencies`,
`pr-audit-workflows`, `pr-automerge-dependabot`, `pr-run-checks`), and each
copies its `cf316d1` entry verbatim. `intake-triage`, `pr-review` and
`pr-review-security` bump `anthropics/claude-code-action` from v1.0.240 to
v1.0.241 (`cab360f`), and their `$/report-lane-outcome` tree changes only in
its tests; each copies its `cf316d1` entry verbatim, and because each is
secret-capable the copy is a hand review, never an auto-copy. `maintenance-sync-standards` is the one entry
that widens: it adds the `environment` input (default `standards-sync`), whose
`attest` and `sync` jobs read the App secrets from that caller-repository
environment with `deployment: false`, and renames its `workflow_call` secrets
from `app-client-id` and `app-private-key` to `STANDARDS_SYNC_APP_CLIENT_ID` and
`STANDARDS_SYNC_APP_PRIVATE_KEY`, so a caller repinning to v0.39.0 must
rename the keys it passes under `secrets:`. The caller-side values, caller
permissions and `runs-on` routing are unchanged.
The Zizmor contract at `de50a08b6093d231519ee7a4c9371db76c0a7e1e`
uses its reviewed `runner` input and checksum-verified native Linux binary, so
enrolled consumers may route that advisory lane onto the managed fleet
Expand Down
121 changes: 121 additions & 0 deletions components/runner-policy/policy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,24 @@
"issues": "write"
}
},
"melodic-software/ci-workflows/.github/workflows/intake-triage.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787": {
"routing": "runner-input",
"runnerInput": "runner",
"allowedInputs": [
"runner",
"allowed-labels",
"escalation-label",
"instructions",
"cli-version"
],
"allowedSecrets": {
"CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}"
},
"allowedCallerPermissions": {
"contents": "read",
"issues": "write"
}
},
"melodic-software/ci-workflows/.github/workflows/pr-review.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4": {
"routing": "runner-input",
"runnerInput": "runner",
Expand All @@ -32,6 +50,19 @@
"id-token": "write"
}
},
"melodic-software/ci-workflows/.github/workflows/pr-review.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787": {
"routing": "runner-input",
"runnerInput": "runner",
"allowedInputs": ["runner", "incremental-review"],
"allowedSecrets": {
"CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}"
},
"allowedCallerPermissions": {
"contents": "read",
"pull-requests": "write",
"id-token": "write"
}
},
"melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4": {
"routing": "runner-input",
"runnerInput": "runner",
Expand All @@ -45,6 +76,19 @@
"id-token": "write"
}
},
"melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787": {
"routing": "runner-input",
"runnerInput": "runner",
"allowedInputs": ["runner", "incremental-review"],
"allowedSecrets": {
"CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}"
},
"allowedCallerPermissions": {
"contents": "read",
"pull-requests": "write",
"id-token": "write"
}
},
"melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4": {
"routing": "runner-input",
"runnerInput": "runner",
Expand All @@ -54,6 +98,15 @@
"issues": "write"
}
},
"melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787": {
"routing": "runner-input",
"runnerInput": "runner",
"allowedInputs": ["runner", "label", "label-prefix"],
"allowedSecrets": {},
"allowedCallerPermissions": {
"issues": "write"
}
},
"melodic-software/ci-workflows/.github/workflows/pr-scan-dependencies.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4": {
"routing": "runner-input",
"runnerInput": "runner",
Expand All @@ -63,6 +116,15 @@
"contents": "read"
}
},
"melodic-software/ci-workflows/.github/workflows/pr-scan-dependencies.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787": {
"routing": "runner-input",
"runnerInput": "runner",
"allowedInputs": ["runner"],
"allowedSecrets": {},
"minimumCallerPermissions": {
"contents": "read"
}
},
"melodic-software/ci-workflows/.github/workflows/maintenance-sync-standards.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4": {
"routing": "runner-input",
"runnerInput": "runner",
Expand All @@ -72,6 +134,15 @@
"app-private-key": "${{ secrets.STANDARDS_SYNC_APP_PRIVATE_KEY }}"
}
},
"melodic-software/ci-workflows/.github/workflows/maintenance-sync-standards.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787": {
"routing": "runner-input",
"runnerInput": "runner",
"allowedInputs": ["runner", "manifest", "standards-ref", "dry-run", "targets", "environment"],
"allowedSecrets": {
"STANDARDS_SYNC_APP_CLIENT_ID": "${{ secrets.STANDARDS_SYNC_APP_CLIENT_ID }}",
"STANDARDS_SYNC_APP_PRIVATE_KEY": "${{ secrets.STANDARDS_SYNC_APP_PRIVATE_KEY }}"
}
},
"melodic-software/ci-workflows/.github/workflows/pr-audit-workflows.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4": {
"routing": "runner-input",
"runnerInput": "runner",
Expand All @@ -82,6 +153,16 @@
"security-events": "write"
}
},
"melodic-software/ci-workflows/.github/workflows/pr-audit-workflows.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787": {
"routing": "runner-input",
"runnerInput": "runner",
"allowedInputs": ["runner", "paths", "fail-on-severity"],
"allowedSecrets": {},
"allowedCallerPermissions": {
"contents": "read",
"security-events": "write"
}
},
"melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4": {
"routing": "runner-input",
"runnerInput": "runner",
Expand All @@ -92,6 +173,16 @@
"pull-requests": "write"
}
},
"melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787": {
"routing": "runner-input",
"runnerInput": "runner",
"allowedInputs": ["runner"],
"allowedSecrets": {},
"allowedCallerPermissions": {
"contents": "write",
"pull-requests": "write"
}
},
"melodic-software/ci-workflows/.github/workflows/pr-run-checks.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4": {
"routing": "runner-input",
"runnerInput": "runner",
Expand Down Expand Up @@ -121,6 +212,36 @@
"contents": "read",
"pull-requests": "read"
}
},
"melodic-software/ci-workflows/.github/workflows/pr-run-checks.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787": {
"routing": "runner-input",
"runnerInput": "runner",
"allowedInputs": [
"runner",
"filters",
"timeout-minutes",
"typos",
"gitleaks",
"editorconfig",
"markdown",
"shellcheck",
"actionlint",
"exec-bit",
"machine-specific-paths",
"eol-renormalize",
"comment-hygiene",
"lychee-offline",
"check-jsonschema",
"check-jsonschema-files",
"check-jsonschema-builtin-schema",
"machine-specific-paths-exclude",
"comment-hygiene-exclude"
],
"allowedSecrets": {},
"minimumCallerPermissions": {
"contents": "read",
"pull-requests": "read"
}
}
},
"approvedHostedRunnerLabels": ["ubuntu-24.04", "windows-2025"],
Expand Down
Loading