Repository navigation
chore(claude-lanes): re-pin callers to ci-workflows v0.39.1 - #735
Closed
melodic-claude-lanes-repin[bot] wants to merge 1 commit into
Closed
melodic-claude-lanes-repin[bot] wants to merge 1 commit into
melodic-claude-lanes-repin[bot] wants to merge 1 commit into
Conversation
Co-Authored-By: claude-lanes-repin <noreply@github.com>
kyle-sexton
added a commit
that referenced
this pull request
Oct 8, 2026
…iles callers (#738) No related issue: urgent fix for every sync PR failing pr-check-managed-files with a 403; tracked from dotfiles#1070. ## Summary From ci-workflows v0.39.0, `check-managed-files` lists the pull request's commits (to skip PRs whose every commit is Dependabot's) and needs `pull-requests: read`, as its `action.yml` states. Both caller templates granted only `contents: read`, so every sync PR fails with `GET /repos/.../pulls/N/commits - 403 Resource not accessible by integration` (dotfiles run 37637251894). ## Fix - `components/managed-files-guard/managed-files-guard.yml` (hosted) and `managed-files-guard-fleet.yml`: add `pull-requests: read` beside `contents: read` in the workflow-level `permissions` block. - `managed-files-guard.test.sh`: the whole-grant assertion now expects `contents=read,pull-requests=read`. - `README.md`: the failure-behavior and verification sections name both permissions. The diff touches only permission lines in the two YAML files, so it merges cleanly with #735 (pin bump on the same files). ## Verification - `bash components/managed-files-guard/managed-files-guard.test.sh`: 167 PASS, 0 FAIL (includes per-target materialization and actionlint on the synced output). - `actionlint` on both caller files: clean. - `markdownlint-cli2` on the README and the pre-commit hooks (typos, editorconfig, gitleaks, shellcheck): clean. - No other `check-managed-files` caller in this repo: a repo-wide grep finds only these two templates plus manifest/docs references. ## Related - melodic-software/dotfiles#1070: the failing sync PR. - melodic-software/ci-workflows#708: added the commits listing and the same `pull-requests: read` grant to its own `pr-require-checks.yml` caller. - #735: concurrent pin bump on the same two files. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01T7GukBojtE99rLCPY7Cw3R Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
kyle-sexton
added a commit
that referenced
this pull request
Oct 9, 2026
No related issue: fleet repin to ci-workflows v0.39.3 in the GitHub Actions conventions migration. ## Summary Moves this repository's repo-owned ci-workflows pins in `.github/workflows/` from v0.39.0 (`6ba73b9`) to v0.39.3 (`ab83b01273026ab5c23c6f3b40e946d97a863fa2`). ## Fix - Pin SHA and `# v0.39.3` comment on 29 lines across five workflows (`maintenance-sync-standards`, `pr-automerge-dependabot`, `pr-require-checks`, `pr-review`, `pr-review-security`). No input or secret names change: every reusable workflow blob is byte-identical between v0.39.0 and v0.39.3. - Component sources under `components/` are untouched; managed callers move through `maintenance-repin-ci-workflows` (#735 is its open PR, currently at v0.39.1, and also touches the three sync-family callers here). ## Verification - actionlint passes on the changed workflows; every pinned path exists at `ab83b01`; the lefthook pre-commit passed. - Runner-policy contracts for `ab83b01` are in #742; this PR's runner-policy check passes once #742 merges. ## Related - #742 (v0.39.3 runner-policy contracts) - #733 (v0.39.0 repin precedent) - ci-workflows v0.39.3 release 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01T7GukBojtE99rLCPY7Cw3R Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Member
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No related issue: automated re-pin to the newest ci-workflows release
Summary
Re-pins every
melodic-software/ci-workflowsreference undercomponents/claude-lanes/andcomponents/claude-lanes-hosted/,the
managed-files-guardcaller components, and this repository's own sync-family callers fromv0.39.0to
v0.39.1(
c586acc8ea288d728cc7d92f641161eec462fa05), the newest ci-workflowsrelease. Opened by
.github/workflows/maintenance-repin-ci-workflows.yml.Fix
Same major version as the pin it replaces (
v0.39.0tov0.39.1).Warning
Runner-policy lockstep requires a human. melodic-software/ci-workflows/.github/workflows/maintenance-sync-standards.yml old revision job sync references needs in a routing-relevant field, which cannot be safely diffed for auto-approval (from 6ba73b9). Before merging, register one
approvedReusableWorkflowContractsentry for each declined workflow named above, add the rollout record incomponents/runner-policy/README.md, and addREPINE_LANE_SHA_V0_39_1plus a verbatim copy-forward assertion incomponents/runner-policy/runner-policy.test.mjs(same shape as the v0.25.0 registration, PR #589). These surfaces were unchanged and were not copy-forwarded, because any decline suppresses every write: melodic-software/ci-workflows/.github/workflows/pr-review.yml, melodic-software/ci-workflows/.github/workflows/pr-review-security.yml. Register oneapprovedReusableWorkflowContractsentry for each of those withheld paths too. This pull request is never auto-merged.Merging this cascades:
maintenance-sync-standards.ymlre-materializes the callersinto every target
distribution/sync-manifest.ymlmarks a lanecaller (fleet or hosted) or a
managed-files-guardcallermanaged for, as a reviewed pull
request per target. This pull request is never auto-merged.
Verification
pin-comment-conventioncoverscomponents/claude-lanes/*.ymland validates the rewritten pin comments' form.
claude-lanescomponent tests materialize and lint the callers.runner-policylints and tests pass when lockstep applied(
policy-lockstep=manual).acceptance signal.
Related
melodic-software/ci-workflowsreview-lanes plan.https://github.com/melodic-software/ci-workflows/releases/tag/v0.39.1