[kyle-sexton]

No related issue: unblocks the ci-workflows v0.39.3 fleet repin in the GitHub Actions conventions migration.

Summary

Registers the nine ci-workflows reusables at the v0.39.3 tag ab83b01273026ab5c23c6f3b40e946d97a863fa2 in components/runner-policy/policy.json, so consumer repins from v0.38.2, v0.39.0 and v0.39.1/v0.39.2 pass runner-policy. The 6ba73b9 (v0.39.0) and cf316d1 (v0.38.2) entries stay until every consumer has repinned; a follow-up retires them.

Fix

• policy.json: nine new keys, each spliced in as text after its 6ba73b9 entry (no re-serialization; 121 insertions, 0 deletions). All nine are verbatim copies (parsed-JSON equality checked per entry).
• README.md: review note for v0.39.3.

Contracts added (all melodic-software/ci-workflows/.github/workflows/<file>@ab83b01273026ab5c23c6f3b40e946d97a863fa2):

Reusable	Secret-capable	Workflow blob	Commit-relative paths reached	Contract
intake-triage.yml	yes (CLAUDE_CODE_OAUTH_TOKEN)	identical (ccc44c4)	$/report-lane-outcome identical (cff090b)	Verbatim copy
pr-review.yml	yes (CLAUDE_CODE_OAUTH_TOKEN)	identical (f0e042a)	$/report-lane-outcome identical	Verbatim copy
pr-review-security.yml	yes (CLAUDE_CODE_OAUTH_TOKEN)	identical (121c7e2)	$/report-lane-outcome identical	Verbatim copy
maintenance-sync-standards.yml	yes (App client ID + private key)	identical (b3e81ac)	none	Verbatim copy
intake-label-needs-triage.yml	no	identical (a0a7e39)	none	Verbatim copy
pr-scan-dependencies.yml	no	identical (5ced69e)	none	Verbatim copy
pr-audit-workflows.yml	no	identical (0a1a611)	none	Verbatim copy
pr-automerge-dependabot.yml	no	identical (7f65abe)	none	Verbatim copy
pr-run-checks.yml	no	identical (3f9622e)	13 $/ actions: 8 identical; detect-changes, gitleaks, check-exec-bit, check-machine-paths, check-comment-markers changed	Verbatim copy, needs hand review

Hand review needed on pr-run-checks: its surface and workflow blob are identical, but five action trees it reaches have different object SHAs, so it is not an auto-copy under the README's tree-SHA rule. The change is the shfmt switch_case_indent re-indentation (ci-workflows#712): git diff --stat 6ba73b97 ab83b01 on those five directories shows 103 insertions and 103 deletions across superset-test.sh, check-exec-bit.sh, check-machine-specific-paths.sh, match.sh, scan.sh and scan.test.sh, and git diff -w on the same paths is empty. No action.yml changed.

The other release changes (check-managed-files Dependabot-skip hardening in ci-workflows#709, pr-require-checks.yml, pr-run-checks-go.yml golangci-lint bump in #713) are not reached by any registered reusable.

Verification

• In ci-workflows, git rev-parse of each of the nine workflow blobs at 6ba73b97 and ab83b01 matches, and a recursive walk of every $/ and ./ reference shows the object SHAs in the table.
• Per-entry check: each new key's parsed contract equals its 6ba73b9 predecessor.
• npm run test:runner-policy (297/297), npm run lint:runner-policy, npm run test:concurrency-policy (31/31), npm run lint:concurrency-policy, npm run test:pr-convention-lockstep (82/82), npm run lint:dependabot-automerge-lockstep, npx biome check components/runner-policy/policy.json, markdownlint-cli2 components/runner-policy/README.md, and the lefthook pre-commit (editorconfig, typos, markdownlint, gitleaks, biome): all pass.
• npm run lint:pr-convention-lockstep fails locally on live fleet fetches (unauthenticated HTTP 403s and caller drift in other repos); it reads no file this PR touches.

Related

• ci-workflows v0.39.3 release (ab83b01)
• feat(runner-policy): add ci-workflows v0.39.0 contracts #732 (v0.39.0 contract precedent)

🤖 Generated with Claude Code

https://claude.ai/code/session_01T7GukBojtE99rLCPY7Cw3R

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T02:03:23.928911Z	22bf15e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 2m 20s —— View job

---

Security review — /review:security-review

• Gather context (diff, PR body, policy.json schema)
• Check skip gate (policy file is security-relevant surface — reviewed, not skipped)
• Verify each new contract entry against its claimed v0.39.0 predecessor
• Check for instruction-surface deletions (none — change is purely additive)
• Report findings

Scope reviewed: components/runner-policy/policy.json (+121) and components/runner-policy/README.md (+8), per git diff against origin/main.

What this is: nine new approvedReusableWorkflowContracts entries pinning melodic-software/ci-workflows reusable workflows at ab83b01273026ab5c23c6f3b40e946d97a863fa2, each inserted alongside its existing 6ba73b97... (v0.39.0) entry.

Verification performed: read every new entry (intake-triage.yml, pr-review.yml, pr-review-security.yml, intake-label-needs-triage.yml, pr-scan-dependencies.yml, maintenance-sync-standards.yml, pr-audit-workflows.yml, pr-automerge-dependabot.yml, pr-run-checks.yml) against its 6ba73b97... predecessor in policy.json. All nine are byte-identical to their predecessor — routing, allowedInputs, allowedSecrets, and allowedCallerPermissions/minimumCallerPermissions are unchanged. None of the three secret-capable entries (intake-triage.yml, pr-review.yml, pr-review-security.yml — all granting CLAUDE_CODE_OAUTH_TOKEN; maintenance-sync-standards.yml granting the App client ID/private key) widen the secret set or the caller permissions relative to what's already approved. No existing entry was modified or removed.

No security findings.

Out of this lane's scope, per the skill's routing to zizmor's advisory lane: whether the pinned SHA ab83b01273026ab5c23c6f3b40e946d97a863fa2 actually resolves to the workflow content the entries describe (supply-chain/pin-integrity verification) is not something this review can independently confirm — it requires checking the external ci-workflows repository, which the PR body already documents in detail (blob-SHA matches, the pr-run-checks.yml shfmt re-indentation explanation). That class of check belongs to zizmor, not this logic/trust-boundary lane.

No instruction-surface deletions in this diff — both files are purely additive, so the instruction-exception-register lens doesn't apply here.
· branch

[claude]

Claude finished @kyle-sexton's task in 4m 55s —— View job

---

Code review complete

• Gather context (diff, changed files, CLAUDE.md/REVIEW.md)
• Review components/runner-policy/policy.json additions
• Review components/runner-policy/README.md additions
• Verify flagged pr-run-checks hand-review claim
• Post findings (inline + summary)

Scope: git diff 0c71b19..22bf15e1 (the PR's actual single commit) — components/runner-policy/policy.json (+121) and components/runner-policy/README.md (+8).

Verified independently:

• policy.json is valid JSON (jq empty), and has 27 top-level contract keys with no duplicate-key collisions (27 keys in the parsed object match 27 raw key occurrences in text).
• Each of the 9 new @ab83b01273026ab5c23c6f3b40e946d97a863fa2 entries is byte-for-byte identical to its @6ba73b97b058602c4dd2bb6e2cce234d11011787 (v0.39.0) predecessor — confirmed by direct read of all 9 pairs, matching the PR's own claim.
• components/runner-policy/runner-policy.test.mjs does not hardcode a contract count or enumerate specific SHAs it expects to be absent, so the 9 new entries don't risk breaking an existing snapshot/count assertion.
• Markdown style: MD013 (line length) is disabled repo-wide, so the added prose lines raise no lint concern.

Not independently verified (author-claimed only, no network access to ci-workflows from this sandbox): the underlying workflow-blob/object-SHA equality claims against the ci-workflows repo, the npm run test:*/lint:* results, and the shfmt re-indentation explanation for pr-run-checks's five changed action trees. python3/node invocations were also blocked by the sandbox's approval gate, so I could not re-run the test suite myself.

Finding posted inline on components/runner-policy/README.md (lines 1142–1149): the new v0.39.3 paragraph omits the "signed off by hand" / "hand-reviewed" attestation sentence that every prior analogous paragraph in this same file includes for secret-capable entries and for entries with changed $/ action-tree SHAs (precedents at lines 1076, 1100, 1134). The PR body itself flags pr-run-checks as needing hand review, but that never makes it into the durable README record, and the file's own established convention treats secret-capable additions as never auto-copyable — which this paragraph's phrasing doesn't reflect.

No other correctness issues found in the data additions themselves; the change is a mechanical, well-scoped registration of already-reviewed contract shapes under a new tag.

[github-actions]

claude-security-review has reviewed this pull request through a75a9ad; a later push is reviewed from there.

[github-actions]

claude-review has reviewed this pull request through a75a9ad; a later push is reviewed from there.

[claude]

Claude finished @kyle-sexton's task in 1m 35s —— View job

---

Code review complete

• Gather context (incremental diff since 22bf15e1, prior review comments)
• Review components/runner-policy/README.md changes
• Verify against prior inline finding (hand-review attestation)
• Post findings

Scope: incremental review per the lane's instructions — only the diff in components/runner-policy/README.md since 22bf15e1 (lines 1149–1151, +3/-1), which adds the sign-off sentence requested by the prior round's inline comment. components/runner-policy/policy.json is unchanged since 22bf15e1 and was reviewed then; not re-reviewed here.

Finding posted inline on components/runner-policy/README.md:1149-1151: the new sentence responds to the prior comment's request for a hand-review attestation, but not in the form every other precedent in this file uses. Precedents tie the sign-off to something checkable — a specific date (line 1100: signed off by hand on 2026-10-05) or an unqualified factual statement (lines 1077, 1134). The new sentence instead cites "the owner's standing approval of this migration's contract sign-offs" — a phrase that appears nowhere else in the repo, is circular (sign-offs attested via approval of sign-offs), names no date or reviewer, and drops the ci-workflows#712 reference the prior comment specifically asked for to explain the pr-run-checks shfmt re-indentation. That leaves a weaker audit trail than every other paragraph in this section.

No other issues found in this incremental change.
· branch

[claude]

Claude finished @kyle-sexton's task in 1m 4s —— View job

---

Incremental code review complete

• Gather context (incremental diff since 01889a5, prior review threads)
• Review the changed lines in components/runner-policy/README.md
• Verify the new attestation sentence against policy.json and the PR body's secret-capable table
• Post findings

Scope: per the incremental lane header, only components/runner-policy/README.md:1149–1151 (+3/-1), the sign-off sentence added in the latest push responding to the prior round's two review threads. policy.json is unchanged since 01889a5 and was reviewed then.

Finding posted inline on components/runner-policy/README.md:1150-1151: the new sentence fixes the previous "standing approval" circularity the prior review flagged (it now names a concrete date, matching the file's established convention), but its parenthetical list of secret-capable entries — maintenance-sync-standards, pr-review, pr-review-security — omits intake-triage. The PR body's own contract table marks intake-triage.yml secret-capable (CLAUDE_CODE_OAUTH_TOKEN), and its v0.39.3 entry in policy.json (lines 40–56) confirms allowedSecrets.CLAUDE_CODE_OAUTH_TOKEN. That leaves one of the four secret-capable v0.39.3 entries without a recorded hand-review attestation in this durable file, which is the exact gap this sentence was added to close.

Note: ci-workflows#712 (the shfmt re-indentation basis for the pr-run-checks clearance, requested in the first review round) still isn't cited in this sentence or elsewhere in the paragraph — flagging for visibility, but not re-raising as a separate finding since the second review round's comment already covered it and the author may consider the date-stamped attestation sufficient without the issue reference.
· branch

[claude]

Claude finished @kyle-sexton's task in 54s —— View job

---

Incremental code review complete

• Gather context (incremental diff since 759bd35, prior review threads)
• Review the changed lines in components/runner-policy/README.md
• Verify the intake-triage addition against policy.json and prior findings
• Post findings

Scope: per the incremental lane header, only components/runner-policy/README.md:1150-1151 (+2/-1), the latest push's fix for the second review round's finding that intake-triage was missing from the hand-sign-off attestation's secret-capable list. policy.json is unchanged since 759bd35 and was reviewed then.

Verified independently: policy.json registers intake-triage.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2 (line 40) with allowedSecrets.CLAUDE_CODE_OAUTH_TOKEN (lines 49–51), confirming it is secret-capable as the prior review comment claimed. The new sentence now names all four secret-capable v0.39.3 entries — intake-triage, maintenance-sync-standards, pr-review, pr-review-security — matching the PR body's own contract table. The sentence retains the dated, non-circular phrasing (signed off by hand on 2026-10-09) that the second review round required, so both outstanding findings on this paragraph are now resolved.

No findings on this incremental change.

(The ci-workflows#712 citation flagged for visibility in an earlier round, but not re-raised as a blocking finding, still isn't present in this paragraph — not re-raising it again here either, since it wasn't part of this round's diff and the prior comment already left it as a non-blocking note.)
· branch