[kyle-sexton]

No related issue: runner-policy contract for ci-workflows v0.42.0 (ci-workflows#741)

Summary

Lets callers pin the intake lanes at ci-workflows v0.42.0, where the triage lane sets the Issue Type and clears the needs-triage floor (melodic-software/ci-workflows#741).

Fix

components/runner-policy/policy.json gains two contracts at 182aca3ad32b79fd002def94e58eb498ac49e7af (v0.42.0), each its v0.39.8 entry plus the one new input:

Reusable	New input (default)	Secrets	Caller permissions
intake-triage.yml	floor-label (needs-triage)	CLAUDE_CODE_OAUTH_TOKEN, unchanged	contents: read, issues: write, unchanged
intake-label-needs-triage.yml	human-label (needs-human)	none, unchanged	issues: write, unchanged

claude-args exists on intake-triage.yml at both tags but stays out of allowedInputs, matching the v0.39.8 entry. The README gains a rollout note, and runner-policy.test.mjs asserts each v0.42.0 entry is its v0.39.8 entry plus that input and that exactly two v0.42.0 keys exist. fixtures/historical-contracts.json is unchanged: it holds retired contracts only.

Verification

• Parsed on.workflow_call (inputs, secrets), workflow permissions and job permissions of both files at 594987a (v0.39.8) and 182aca3 (v0.42.0): only the two inputs differ. The new steps use the job's existing github.token; no uses:, secret or permission is added.
• npm run test:runner-policy: 301/301 pass.
• npm run lint:runner-policy: "Runner policy passed."
• lefthook pre-commit (typos, editorconfig, markdownlint, gitleaks, biome): pass.

Related

• feat(intake-triage): set the Issue Type and clear the triage floor ci-workflows#741
• Precedent: feat(runner-policy): add ci-workflows v0.39.8 contracts #762 (v0.39.8 contracts)
• Consumer repin: melodic-software/claude-code-plugins (draft, follows)

🤖 Generated with Claude Code

https://claude.ai/code/session_01W6SjPvY7DmXBGzboeCq8nj

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T22:04:01.271427Z	0084a25	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 1m 50s —— View job

---

Security review — no findings

• Gather context (PR diff, changed files)
• Apply skip gate
• Review changed files for security-relevant surface
• Post findings (or confirm none)

Scope: components/runner-policy/README.md, components/runner-policy/policy.json, components/runner-policy/runner-policy.test.mjs (diff: git diff origin/main...HEAD).

This PR only registers two new runner-policy contract entries for ci-workflows reusable workflows pinned at the full 40-char commit SHA 182aca3ad32b79fd002def94e58eb498ac49e7af, adds a matching README note, and extends the test suite. No application/runtime code is touched.

Checked against the v0.39.8 entries already in the file (policy.json#L22-L39, policy.json#L172-L180) against the new v0.42.0 entries (policy.json#L40-L58, policy.json#L181-L189):

• Ref pinning: both new entries use a full, immutable commit SHA — not a mutable tag/branch — so this is not a loosened pin.
• Permissions: allowedCallerPermissions is byte-identical to the v0.39.8 entries (contents: read + issues: write for intake-triage; issues: write for intake-label-needs-triage). No escalation.
• Secrets: allowedSecrets is unchanged (CLAUDE_CODE_OAUTH_TOKEN for intake-triage; none for intake-label-needs-triage). No new secret exposure.
• Inputs: the only diff is one new string input per contract (floor-label, human-label), each a label-name parameter with a default, matching the existing allowed-labels/label-prefix pattern already present. The implementation of the referenced reusable workflows lives in ci-workflows (out of this diff's scope), and this repo's test asserts the new entries are exactly "v0.39.8 + one input" with no other v0.42.0 keys present.
• Instruction-surface check: the diff is purely additive (no deletions) across README, policy.json, and the test file — no standing rule, allowlist, or check is removed or narrowed, so the instruction-exception-register lens doesn't flag anything here.

No permission widening, secret exposure, or ref-pinning weakening — GitHub Actions hardening concerns of that kind are zizmor's lane regardless. No logic/trust-boundary issue specific to this diff. 0 findings.

claude-lane-summary: lane=claude-security-review sha=0084a2545806ea43dfa975d83c78a3838969f22b run=38314261563

[claude]

Claude finished @kyle-sexton's task in 2m 43s —— View job

---

Claude's code review

• Gather context (PR diff, changed files, custom instructions)
• Invoke /review:code-review and follow its procedure
• Post inline findings
• Post summary comment

Scope checked: the three changed files — components/runner-policy/policy.json, components/runner-policy/README.md, components/runner-policy/runner-policy.test.mjs — cross-referenced against origin/main...HEAD. No docs/standards/README.md index exists in this repo, so no paved-path criteria applied.

Verified directly (not just author-claimed):

• Both new policy.json entries (intake-triage.yml@182aca3..., intake-label-needs-triage.yml@182aca3...) are exactly their v0.39.8 entries (@594987a...) plus floor-label and human-label respectively — confirmed by direct comparison, matching the PR body's table.
• Exactly two keys exist at the 182aca3... suffix.
• claude-args is absent from allowedInputs at both tags for intake-triage.yml, as claimed.
• fixtures/historical-contracts.json is untouched (not in the changed-files list).
• npm run test:runner-policy / lint:runner-policy: I could not run these myself — the sandbox denied node execution in this session. The PR body's "301/301 pass" / lint-pass claims are author-claimed and unverified by me.

Finding (posted inline on components/runner-policy/README.md L1196-1204): every other paragraph in this section that registers a policy.json contract revision ends with an explicit "signed off by hand on <date>" attestation (L1100, L1152, L1165, L1176, L1187). The new v0.42.0 paragraph this PR adds documents the registration but omits that attestation entirely — notable because intake-triage.yml is secret-capable (CLAUDE_CODE_OAUTH_TOKEN), exactly the class of entry the file's own convention calls out for hand sign-off, and the "Contract revision lockstep" section requires each new entry to "record its review note above." This looks like a documentation-completeness gap rather than a functional defect — verified independently via a second-pass verifier agent.

No other correctness, architecture, or maintainability issues found in the diff.

claude-lane-summary: lane=claude-review sha=0084a2545806ea43dfa975d83c78a3838969f22b run=38314261574

[github-actions]

claude-security-review has reviewed this pull request through 909896d; a later push is reviewed from there.

[github-actions]

claude-review has reviewed this pull request through 909896d; a later push is reviewed from there.

[claude]

Claude finished @kyle-sexton's task in 33s —— View job

---

Claude's code review

• Gather context (incremental diff since 0084a25, scoped to components/runner-policy/README.md)
• Invoke /review:code-review and follow its procedure
• Review the changed line against prior finding
• Post summary comment

Scope: incremental diff only — components/runner-policy/README.md line 1200 (.claude-lane/incremental.diff), since this lane's last review at 0084a2545806ea43dfa975d83c78a3838969f22b.

Change: the v0.42.0 registration paragraph now ends with "Signed off by hand on 2026-10-12." This is exactly the fix for this lane's prior finding (missing hand-sign-off attestation on a secret-capable contract entry). The wording matches the established convention used by the other paragraphs in this section (e.g. "...were signed off by hand on 2026-10-05.", "...were signed off by hand on 2026-10-09." at README.md#L1100, #L1152), and the date matches the commit date of 909896d.

No new findings.

claude-lane-summary: lane=claude-review sha=909896d56aff63c9c574c9fb1a4a834fd755e292 run=38314924939