From 0084a2545806ea43dfa975d83c78a3838969f22b Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Mon, 12 Oct 2026 18:00:54 -0400 Subject: [PATCH 1/2] feat(runner-policy): add ci-workflows v0.42.0 intake contracts Register intake-triage.yml and intake-label-needs-triage.yml at the v0.42.0 tag 182aca3ad32b79fd002def94e58eb498ac49e7af. Each equals its v0.39.8 entry plus the one input ci-workflows#741 added: floor-label on intake-triage, human-label on intake-label-needs-triage. Secrets, workflow and job permissions, and runs-on routing are unchanged. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01W6SjPvY7DmXBGzboeCq8nj --- components/runner-policy/README.md | 9 ++++++ components/runner-policy/policy.json | 28 +++++++++++++++++++ .../runner-policy/runner-policy.test.mjs | 23 +++++++++++++++ 3 files changed, 60 insertions(+) diff --git a/components/runner-policy/README.md b/components/runner-policy/README.md index 2130c754..12349985 100644 --- a/components/runner-policy/README.md +++ b/components/runner-policy/README.md @@ -1193,6 +1193,15 @@ into the red class `incomplete`. The new steps use only the job's existing routing changes; the lockstep declines both lanes on `credentialReferences`. `maintenance-sync-standards.yml` is byte-identical to v0.39.8 and is declined on shape, because its `sync` job routes through `needs`. +`intake-triage` and `intake-label-needs-triage` are registered at the v0.42.0 +tag `182aca3ad32b79fd002def94e58eb498ac49e7af`, each equal to its v0.39.8 entry +plus one input: `floor-label` (default `needs-triage`) on `intake-triage`, which +now sets the issue's Issue Type and removes the floor label after a usable +triage, and `human-label` (default `needs-human`) on +`intake-label-needs-triage`, which skips the floor for an issue already routed +to a person. The new steps use only the job's existing `github.token`, so no +secret, workflow or job permission, or `runs-on` routing changes. Callers that +keep the default labels pass neither input. The Zizmor contract at `de50a08b6093d231519ee7a4c9371db76c0a7e1e` uses its reviewed `runner` input and checksum-verified native Linux binary, so enrolled consumers may route that advisory lane onto the managed fleet diff --git a/components/runner-policy/policy.json b/components/runner-policy/policy.json index 90ff3de6..e75fe27d 100644 --- a/components/runner-policy/policy.json +++ b/components/runner-policy/policy.json @@ -37,6 +37,25 @@ "issues": "write" } }, + "melodic-software/ci-workflows/.github/workflows/intake-triage.yml@182aca3ad32b79fd002def94e58eb498ac49e7af": { + "routing": "runner-input", + "runnerInput": "runner", + "allowedInputs": [ + "runner", + "allowed-labels", + "escalation-label", + "floor-label", + "instructions", + "cli-version" + ], + "allowedSecrets": { + "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}" + }, + "allowedCallerPermissions": { + "contents": "read", + "issues": "write" + } + }, "melodic-software/ci-workflows/.github/workflows/pr-review.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2": { "routing": "runner-input", "runnerInput": "runner", @@ -159,6 +178,15 @@ "issues": "write" } }, + "melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@182aca3ad32b79fd002def94e58eb498ac49e7af": { + "routing": "runner-input", + "runnerInput": "runner", + "allowedInputs": ["runner", "label", "label-prefix", "human-label"], + "allowedSecrets": {}, + "allowedCallerPermissions": { + "issues": "write" + } + }, "melodic-software/ci-workflows/.github/workflows/pr-scan-dependencies.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2": { "routing": "runner-input", "runnerInput": "runner", diff --git a/components/runner-policy/runner-policy.test.mjs b/components/runner-policy/runner-policy.test.mjs index d4cf94e7..60e87437 100644 --- a/components/runner-policy/runner-policy.test.mjs +++ b/components/runner-policy/runner-policy.test.mjs @@ -39,6 +39,7 @@ const REPINE_LANE_SHA_V0_30_1 = "35880dcbb2f174aac90159e276dc7eddf1bc20b9"; const REPINE_LANE_SHA_V0_39_8 = "594987abe8657a40bccc13d301f1f0d5cccb5348"; const REPINE_LANE_SHA_V0_40_0 = "a92020292976c2e9b50f7adc922693a45a6c1226"; const REPINE_LANE_SHA_V0_41_0 = "a621ef8112677a519b662ec5d2547475c0101f7e"; +const REPINE_LANE_SHA_V0_42_0 = "182aca3ad32b79fd002def94e58eb498ac49e7af"; const STANDARDS_SYNC_SHA = "35f2684ac953794b854bac1959df00e74eeca1d9"; const REUSABLE_PATH = "melodic-software/ci-workflows/.github/workflows/osv-scanner.yml"; const REUSABLE_REFERENCE = `${REUSABLE_PATH}@${SHA}`; @@ -9077,6 +9078,28 @@ test("every reusable contract at the v0.41.0 tag copies its previous entry forwa ); }); +// v0.42.0 adds one input to each intake lane and changes no secret, permission +// or routing field; no other reusable is registered at it. +test("the intake contracts at the v0.42.0 tag are their v0.39.8 entries plus one input", () => { + const contracts = BASE_POLICY.approvedReusableWorkflowContracts; + const added = { "intake-triage": "floor-label", "intake-label-needs-triage": "human-label" }; + for (const [reusable, input] of Object.entries(added)) { + const workflowPath = `melodic-software/ci-workflows/.github/workflows/${reusable}.yml`; + const previous = contracts[`${workflowPath}@${REPINE_LANE_SHA_V0_39_8}`]; + assert.ok(previous, `expected a v0.39.8 contract for ${reusable}`); + const current = contracts[`${workflowPath}@${REPINE_LANE_SHA_V0_42_0}`]; + assert.deepEqual( + { ...current, allowedInputs: [...current.allowedInputs].sort() }, + { ...previous, allowedInputs: [...previous.allowedInputs, input].sort() }, + `${reusable} at the v0.42.0 tag is not its v0.39.8 entry plus ${input}`, + ); + } + assert.equal( + Object.keys(contracts).filter((key) => key.endsWith(`@${REPINE_LANE_SHA_V0_42_0}`)).length, + Object.keys(added).length, + ); +}); + // Convergence as a property, never as a hardcoded SHA. The daily // claude-lanes-repin lane rewrites these components on every ci-workflows // release, and a test naming one revision would go red by construction on From 909896d56aff63c9c574c9fb1a4a834fd755e292 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Mon, 12 Oct 2026 18:08:29 -0400 Subject: [PATCH 2/2] docs(runner-policy): record the v0.42.0 intake contract sign-off Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01W6SjPvY7DmXBGzboeCq8nj --- components/runner-policy/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/runner-policy/README.md b/components/runner-policy/README.md index 12349985..e0e2ea99 100644 --- a/components/runner-policy/README.md +++ b/components/runner-policy/README.md @@ -1201,7 +1201,7 @@ triage, and `human-label` (default `needs-human`) on `intake-label-needs-triage`, which skips the floor for an issue already routed to a person. The new steps use only the job's existing `github.token`, so no secret, workflow or job permission, or `runs-on` routing changes. Callers that -keep the default labels pass neither input. +keep the default labels pass neither input. Signed off by hand on 2026-10-12. The Zizmor contract at `de50a08b6093d231519ee7a4c9371db76c0a7e1e` uses its reviewed `runner` input and checksum-verified native Linux binary, so enrolled consumers may route that advisory lane onto the managed fleet