Repository navigation
ci: repin ci-workflows to v0.39.0 - #733
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kyle-sexton
enabled auto-merge (squash)
October 7, 2026 13:45
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
kyle-sexton
added a commit
that referenced
this pull request
Oct 9, 2026
No related issue: fleet repin to ci-workflows v0.39.3 in the GitHub Actions conventions migration. ## Summary Moves this repository's repo-owned ci-workflows pins in `.github/workflows/` from v0.39.0 (`6ba73b9`) to v0.39.3 (`ab83b01273026ab5c23c6f3b40e946d97a863fa2`). ## Fix - Pin SHA and `# v0.39.3` comment on 29 lines across five workflows (`maintenance-sync-standards`, `pr-automerge-dependabot`, `pr-require-checks`, `pr-review`, `pr-review-security`). No input or secret names change: every reusable workflow blob is byte-identical between v0.39.0 and v0.39.3. - Component sources under `components/` are untouched; managed callers move through `maintenance-repin-ci-workflows` (#735 is its open PR, currently at v0.39.1, and also touches the three sync-family callers here). ## Verification - actionlint passes on the changed workflows; every pinned path exists at `ab83b01`; the lefthook pre-commit passed. - Runner-policy contracts for `ab83b01` are in #742; this PR's runner-policy check passes once #742 merges. ## Related - #742 (v0.39.3 runner-policy contracts) - #733 (v0.39.0 repin precedent) - ci-workflows v0.39.3 release 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01T7GukBojtE99rLCPY7Cw3R Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
kyle-sexton
added a commit
that referenced
this pull request
Oct 11, 2026
…ape (#774) No related issue: repair standards main after ci-workflows#733 ## Summary `check-pr-convention-copies` has been red on main since melodic-software/ci-workflows#733 (merged 2026-10-11 17:13Z) changed the pr-contract composite's `run.sh`, for example run 38159506436. The gate's behavior with the default pattern is unchanged; the drift checker was reading the old source shape. ## Fix #733 changed four things the checker anchored on: | Checker expectation | run.sh after #733 | |---|---| | `match(chunk, /(close\|...)[ \t]*:?[ \t]*([a-z0-9_.-]+\/[a-z0-9_.-]+)?#[0-9]+/)) break` | `match(chunk, closing_regex)) break`, with `closing_regex = "(close\|...)" separator ref` and `ref` from `ENVIRON["ISSUE_REF_PATTERN"]` (default `DEFAULT_ISSUE_REF_PATTERN='([a-z0-9_.-]+/[a-z0-9_.-]+)?#[0-9]+'`) | | `rest ~ /^(refs\|relates[ \t]+to):...#[0-9]+[ \t]*$/)` | `rest ~ non_closing_regex)` with `non_closing_regex = "^(refs\|relates[ \t]+to):[ \t]*" ref "[ \t]*$"` | | `linkage_errors+=('Missing a native closing keyword` | `linkage_errors+=("Missing a ${keyword_kind} closing keyword` | | analyzer runs with no env | analyzer reads `ISSUE_REF_PATTERN`; unset, `ref` became `()` and 347 sample bodies (`xcloses #12`, `Closes #12x`, ...) read as closing | Changes, all in `components/pr-convention-policy/`: - The extractors accept both shapes. Consumers pinned before #733 still run the inline literal, so the pin audit must keep reading it. The new shape is rebuilt from the keyword alternation, the default separator and `DEFAULT_ISSUE_REF_PATTERN`. - The behavioral run passes run.sh's default as `ISSUE_REF_PATTERN`/`DEFAULT_ISSUE_REF_PATTERN`. A run.sh that reads the variable without declaring, falling back to and exporting the default is drift. - New check: action.yml's `issue-ref-pattern` default must equal run.sh's default (or be empty). Any other value flips the analyzer to its custom-pattern separator for every caller that leaves the input unset. - Fixtures: `check-contract-run.sh.txt` is now ci-workflows 8b3cc4bf28. It is verbatim apart from one `spellchecker:ignore-next-line` awk comment, needed because this repository's typos lane flags `ture` in an upstream comment. The previous fixture is kept as `check-contract-run-literal-ref.sh.txt` for the older-pin shape. ## Verification - `npm run test:pr-convention-lockstep`: 90 pass, 0 fail. Before the fix, the new fixture produced 37 failures. - `npm run lint:pr-convention-copies` against live ci-workflows main: `every copy matches policy.json`. - Real drift still fails, with new tests for: a missing or unexported default, a default without the `#N` grammar (both the enforcement-pattern probe and the behavior check catch it), a default separator losing the optional colon (the behavior check catches it), and a mismatched action.yml default. The existing mutation tests still pass against the new fixture. - Biome, typos, gitleaks and editorconfig pre-commit hooks pass. ## Related - melodic-software/ci-workflows#733 (the change being tracked) - #773 (blocked by the red main) 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No related issue: fleet repin to ci-workflows v0.39.0 in the GitHub Actions conventions migration (standards-sync automation, phase C).
Summary
Moves this repository's repo-owned ci-workflows pins from v0.38.2 (
cf316d1) to v0.39.0 (6ba73b97b058602c4dd2bb6e2cce234d11011787), and renames the secrets this repository passes tomaintenance-sync-standardsto the names v0.39.0 declares.Fix
# v0.39.0comment on 31 lines across five workflows.maintenance-sync-standards.yml:app-client-id/app-private-keybecomeSTANDARDS_SYNC_APP_CLIENT_ID/STANDARDS_SYNC_APP_PRIVATE_KEY(values unchanged). Environment secret names allow only[A-Za-z0-9_], so the hyphenated names could never be supplied from an environment. Noenvironmentinput is passed: the defaultstandards-syncis intended, and its main-only branch policy is declared in github-iac separately. Until then the job auto-creates the environment and still reads the repo-level secrets.components/are untouched; managed callers move throughmaintenance-repin-ci-workflows.Verification
.github/workflows/*.yml; every pinned path exists at6ba73b9.6ba73b9, including the renamed secret keys, are in feat(runner-policy): add ci-workflows v0.39.0 contracts #732; this PR's runner-policy check passes once feat(runner-policy): add ci-workflows v0.39.0 contracts #732 merges.Related
🤖 Generated with Claude Code