Repository navigation
feat(runner-policy): add ci-workflows v0.39.8 contracts - #762
Conversation
Register the nine ci-workflows reusables at the v0.39.8 tag 594987abe8657a40bccc13d301f1f0d5cccb5348. No workflow_call input, secret, permission or runs-on routing changed since v0.39.3, so each contract equals its v0.39.3 entry. The v0.39.3 entries stay until every consumer repins. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TRhsMPSTMFo99ik7gkdgQt
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TRhsMPSTMFo99ik7gkdgQt
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Claude Code is working… I'll analyze this and get back to you. |
|
Claude finished @kyle-sexton's task in 2m 1s —— View job Security review — no issues found
Scope: What this PR does: adds nine Analysis:
Verification limitation: I could not independently fetch No CRITICAL / IMPORTANT / SUGGESTION findings. GitHub Actions trigger/permission-widening/supply-chain concerns are zizmor's advisory lane and are not re-reported here. |
|
Claude finished @kyle-sexton's task in 2m 46s —— View job Code review complete
No high-signal findings. This is a mechanical copy-forward registering the nine
Not independently verified (sandbox has no outbound network/ |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f675cbf1de
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
claude-security-review has reviewed this pull request through f357f5b; a later push is reviewed from there. |
|
PR body contract — issue linkage This PR body does not yet satisfy the issue-linkage contract:
Edit the body and this comment updates itself on the next run. |
|
claude-review has reviewed this pull request through f357f5b; a later push is reviewed from there. |
The lockstep's comparison found four surfaces unchanged, but its declines suppress every write, so all nine entries were added by hand. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TRhsMPSTMFo99ik7gkdgQt
|
Claude finished @kyle-sexton's task in 2m 40s —— View job Code review complete
Scope: per the lane header, only No findings — the fix is correct. I verified it against
Only a cosmetic note, not a finding: L1165 runs noticeably longer than this paragraph's other lines before wrapping, but the surrounding prose already has similarly ragged line lengths (e.g. L1134, L1152), so this isn't a regression and markdownlint has no line-length rule enabled here — not worth a change. |
…t ci-workflows v0.40.0 (#773) No related issue: Phase 17 of the pr-unblock lane plan; ci-workflows v0.40.0 Hold: a human merges this. ## Summary ci-workflows v0.40.0 (`a92020292976c2e9b50f7adc922693a45a6c1226`) adds an optional `allowed-bot-sender-ids` input to `pr-review.yml` and `pr-review-security.yml`. A bot whose event sender id is listed passes the reusable's bot skip, and only that sender's login reaches the action's `allowed_bots`. This registers that input in runner policy and has the four review caller components pass the automation-lanes App's id, so a commit the App pushes to a pull request is reviewed. ## Fix - `components/runner-policy/policy.json`: `pr-review.yml` and `pr-review-security.yml` at the v0.40.0 tag, each equal to its v0.39.8 entry plus `allowed-bot-sender-ids` in `allowedInputs`. Only these two reusables are registered at v0.40.0. - `components/claude-lanes/claude-{review,security-review}.yml` and `components/claude-lanes-hosted/claude-{review,security-review}.yml`: re-pinned from v0.39.3 to v0.40.0, passing `allowed-bot-sender-ids: ${{ vars.AUTOMATION_LANES_APP_SENDER_ID }}`; header comments updated. - `components/runner-policy/README.md`: rollout note for v0.40.0. - `components/runner-policy/runner-policy.test.mjs`: `REPINE_LANE_SHA_V0_40_0` and a test that each v0.40.0 entry is its v0.39.8 entry plus the input, and that exactly two v0.40.0 keys exist. Upstream diff v0.39.8 to v0.40.0 for both reusables: the new input, the job `if:` (bot actor admitted only when the input is non-empty, well-formed, and contains the sender id), and `allowed_bots`. No secret, workflow or job permission, `runs-on`, or reached composite action changed. The claude-lanes lockstep declines both on `inputs`, so the entries are registered by hand. Moving from v0.39.3 also takes the v0.39.8 changes reviewed in #762. ### Consumers without the variable The manifest syncs these components to 11 targets. Hosted callers: agent-plugins, ci-runner, claude-code-account-rotation, claude-code-plugins, codex-plugins, cursor-plugins. Fleet callers: claude-code-proxy, dotfiles, github-iac, medley, provisioning. Only `claude-code-plugins` sets the repository variable `AUTOMATION_LANES_APP_SENDER_ID`, and no org-level variable exists (checked with `gh api .../actions/variables/AUTOMATION_LANES_APP_SENDER_ID` on each). GitHub returns an empty string for an unset configuration variable ([contexts reference, `vars`](https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#vars-context)), and the reusable's `if:` requires a non-empty list, so in the other 10 targets the review lanes still skip every bot. ## Verification - `npm run test:runner-policy`: 299/299 pass. With `allowed-bot-sender-ids` removed from one v0.40.0 contract, 5 tests fail: the new test and the four target-audit tests for the lane callers. - `npm run lint:runner-policy`: passed. - `claude-lanes.test.sh` (materialize into every target plus actionlint), `repin-callers.test.sh`, `repin-policy-lockstep.test.mjs` (23/23), and the pin-comment scan: pass. - Lefthook pre-commit (editorconfig, typos, markdownlint, gitleaks, biome): pass. ## Related - Upstream release: https://github.com/melodic-software/ci-workflows/releases/tag/v0.40.0 - Contract precedent: #762 (v0.39.8). #748 (the automated v0.39.8 re-pin) touches the same four caller pins and will conflict with this one. - After merge, the standards sync carries the callers and `policy.json` to the targets. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
No related issue: runner-policy contract for ci-workflows v0.42.0 (ci-workflows#741) ## Summary Lets callers pin the intake lanes at ci-workflows v0.42.0, where the triage lane sets the Issue Type and clears the `needs-triage` floor (melodic-software/ci-workflows#741). ## Fix `components/runner-policy/policy.json` gains two contracts at `182aca3ad32b79fd002def94e58eb498ac49e7af` (v0.42.0), each its v0.39.8 entry plus the one new input: | Reusable | New input (default) | Secrets | Caller permissions | | --- | --- | --- | --- | | `intake-triage.yml` | `floor-label` (`needs-triage`) | `CLAUDE_CODE_OAUTH_TOKEN`, unchanged | `contents: read`, `issues: write`, unchanged | | `intake-label-needs-triage.yml` | `human-label` (`needs-human`) | none, unchanged | `issues: write`, unchanged | `claude-args` exists on `intake-triage.yml` at both tags but stays out of `allowedInputs`, matching the v0.39.8 entry. The README gains a rollout note, and `runner-policy.test.mjs` asserts each v0.42.0 entry is its v0.39.8 entry plus that input and that exactly two v0.42.0 keys exist. `fixtures/historical-contracts.json` is unchanged: it holds retired contracts only. ## Verification - Parsed `on.workflow_call` (inputs, secrets), workflow `permissions` and job `permissions` of both files at `594987a` (v0.39.8) and `182aca3` (v0.42.0): only the two inputs differ. The new steps use the job's existing `github.token`; no `uses:`, secret or permission is added. - `npm run test:runner-policy`: 301/301 pass. - `npm run lint:runner-policy`: "Runner policy passed." - lefthook pre-commit (typos, editorconfig, markdownlint, gitleaks, biome): pass. ## Related - melodic-software/ci-workflows#741 - Precedent: #762 (v0.39.8 contracts) - Consumer repin: melodic-software/claude-code-plugins (draft, follows) 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01W6SjPvY7DmXBGzboeCq8nj --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Related
Refs: melodic-software/ci-workflows#726
Refs: #748
Precedents: #742 (v0.39.3 contracts), #746 (retirement).
Fix
Registers the nine ci-workflows reusables at the v0.39.8 tag
594987abe8657a40bccc13d301f1f0d5cccb5348incomponents/runner-policy/policy.json. This unblocks the claude-lanes repin in #748, whose policy lockstep declined, and the ci-runner repin, whose pin tests need one SHA across every ci-workflows reference. The v0.39.3 (ab83b01) entries stay until every consumer has repinned.policy.json: nine new keys, each spliced in as text after itsab83b01entry (121 insertions, 0 deletions). Noworkflow_callinput, secret, workflow or job permission, orruns-onrouting changed between v0.39.3 and v0.39.8, so each contract equals its v0.39.3 entry.README.md: rollout note for v0.39.8.runner-policy.test.mjs:REPINE_LANE_SHA_V0_39_8and a copy-forward assertion that each v0.39.8 entry equals its v0.39.3 entry and that exactly nine v0.39.8 keys exist.intake-label-needs-triage.ymlpr-scan-dependencies.ymlpr-audit-workflows.ymlpr-automerge-dependabot.ymlintake-triage.ymlclaude-code-actionv1.0.241 to v1.0.245 (6fed3ca)credentialReferencespr-review.ymlcredentialReferencespr-review-security.ymlcredentialReferencesmaintenance-sync-standards.ymlsetup-nodev7.0.0 to v7.1.0 (949feb2)syncjob routes throughneedspr-run-checks.yml$/markdownlinttakes thesetup-nodebump"unchanged" means the comparison found the surface unchanged. Because any decline suppresses every lockstep write, all nine entries were registered by hand, and the five declined ones were reviewed against the v0.39.8 file content.
$/report-lane-outcome, which the claude lanes reach, changes only its rate-limit error message.Verification
laneSecuritySurfacesMatchfromrepin-policy-lockstep.mjs, run without writes for all nine paths fromab83b01to594987a, gave the results in the table.workflow_callsurface (inputs, secrets, workflow and job permissions,runs-on) was parsed and compared with v0.39.3: unchanged for all nine.npm run test:runner-policy(298/298),npm run lint:runner-policy, biome, markdownlint and the lefthook pre-commit all pass.🤖 Generated with Claude Code
https://claude.ai/code/session_01TRhsMPSTMFo99ik7gkdgQt