[kyle-sexton]

No related issue: urgent fix for every sync PR failing pr-check-managed-files with a 403; tracked from dotfiles#1070.

Summary

From ci-workflows v0.39.0, check-managed-files lists the pull request's commits (to skip PRs whose every commit is Dependabot's) and needs pull-requests: read, as its action.yml states. Both caller templates granted only contents: read, so every sync PR fails with GET /repos/.../pulls/N/commits - 403 Resource not accessible by integration (dotfiles run 37637251894).

Fix

• components/managed-files-guard/managed-files-guard.yml (hosted) and managed-files-guard-fleet.yml: add pull-requests: read beside contents: read in the workflow-level permissions block.
• managed-files-guard.test.sh: the whole-grant assertion now expects contents=read,pull-requests=read.
• README.md: the failure-behavior and verification sections name both permissions.

The diff touches only permission lines in the two YAML files, so it merges cleanly with #735 (pin bump on the same files).

Verification

• bash components/managed-files-guard/managed-files-guard.test.sh: 167 PASS, 0 FAIL (includes per-target materialization and actionlint on the synced output).
• actionlint on both caller files: clean.
• markdownlint-cli2 on the README and the pre-commit hooks (typos, editorconfig, gitleaks, shellcheck): clean.
• No other check-managed-files caller in this repo: a repo-wide grep finds only these two templates plus manifest/docs references.

Related

• melodic-software/dotfiles#1070: the failing sync PR.
• feat(check-managed-files): verify standards-sync PR content against standards main ci-workflows#708: added the commits listing and the same pull-requests: read grant to its own pr-require-checks.yml caller.
• chore(claude-lanes): re-pin callers to ci-workflows v0.39.1 #735: concurrent pin bump on the same two files.

🤖 Generated with Claude Code

https://claude.ai/code/session_01T7GukBojtE99rLCPY7Cw3R

[claude]

Claude finished @kyle-sexton's task in 53s —— View job

---

Security review complete

• Gather context (PR diff, changed files)
• Review diff for security-relevant issues (logic, auth, injection, secrets, instruction-surface deletions)
• Post findings

No security findings.

This diff is purely additive: it grants pull-requests: read (read-only, minimal, matching what check-managed-files's action.yml requires to list PR commits) to the two caller templates (managed-files-guard.yml L74-76, managed-files-guard-fleet.yml L90-92), tightens the corresponding test assertion in managed-files-guard.test.sh to require exactly contents=read,pull-requests=read, and updates README.md prose to match.

• Permission-widening changes to a workflow's permissions: block are this lane's explicit deferral to zizmor's advisory lane, not re-reported here. The grant added is read-only and scoped to the single capability the action documents needing.
• No instruction-surface deletion: nothing here removes, narrows, or softens a standing rule — the test assertion gets stricter (now requires both permissions present, where before it only required contents=read).
• No logic, auth, injection, or secret-handling surface in the changed files: two YAML permission blocks, one bash string-comparison assertion, and markdown prose.

[claude]

Claude finished @kyle-sexton's task in 1m 57s —— View job

---

Claude code review

• Gather context (PR diff, changed files)
• Review changed files against criteria
• Post findings (inline + summary)

No blocking findings. This is a small, well-scoped fix:

• The pull-requests: read grant is added consistently to both caller templates (managed-files-guard.yml and managed-files-guard-fleet.yml), and a repo-wide grep confirms these are the only two check-managed-files callers in this repo — matches the PR's claim.
• managed-files-guard.test.sh's whole-grant assertion (contents=read,pull-requests=read) matches the to_entries/insertion-order of the updated YAML's permissions: block in both files, so the contract test stays accurate rather than just passing by coincidence.
• The README updates (failure-behavior and verification sections) describe the new permission and its rationale (listing commits to skip Dependabot-only PRs) consistently in both places, and line wrapping stays within the file's existing convention.
• No job-level permissions block was introduced, consistent with the existing "workflow grant is the whole grant" assertion at managed-files-guard.test.sh#L125-L126.

Not independently verified (author-claimed only): the test run (167 PASS/0 FAIL), actionlint, and markdownlint-cli2 results stated in the PR's Verification section — I was not able to execute shell commands in this environment (bash/tool invocations required approval that wasn't available), so I reviewed the diff and assertion logic statically rather than running the suite myself.

Scope is tight (permission grants + matching test/docs updates only), and I found no correctness, security, or maintainability issues to flag.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-08T22:57:28.214913Z	d515da6	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review has reviewed this pull request through d515da6; a later push is reviewed from there.

[github-actions]

claude-review has reviewed this pull request through d515da6; a later push is reviewed from there.