diff --git a/.github/workflows/pr-review-security.yml b/.github/workflows/pr-review-security.yml index 0e2dd840..98cfa12d 100644 --- a/.github/workflows/pr-review-security.yml +++ b/.github/workflows/pr-review-security.yml @@ -39,7 +39,7 @@ jobs: pull-requests: write # post the security review + tracking comment id-token: write # OIDC, mints the Claude GitHub App token (required # even with an OAuth/API-key credential) - uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@4cfd14e8b6f8b740f5f0af27f80139a0d40a596d # v0.42.1 + uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@a623e29085a3be885718cf9c0c0eca85bb53dd97 # v0.42.2 with: # DEVIATION from the component, which names the managed fleet label: # this repository is PUBLIC, and runner-policy admits a managed label diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml index ee60ac5c..e7c9d2d3 100644 --- a/.github/workflows/pr-review.yml +++ b/.github/workflows/pr-review.yml @@ -49,7 +49,7 @@ jobs: pull-requests: write # post review + track_progress tracking comment id-token: write # OIDC — mints the Claude GitHub App token (required # even with an OAuth/API-key credential) - uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@4cfd14e8b6f8b740f5f0af27f80139a0d40a596d # v0.42.1 + uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@a623e29085a3be885718cf9c0c0eca85bb53dd97 # v0.42.2 with: # DEVIATION from the component, which names the managed fleet label: # this repository is PUBLIC, and runner-policy admits a fleet label only diff --git a/components/claude-lanes-hosted/claude-review.yml b/components/claude-lanes-hosted/claude-review.yml index a7c07ab0..2b862870 100644 --- a/components/claude-lanes-hosted/claude-review.yml +++ b/components/claude-lanes-hosted/claude-review.yml @@ -81,7 +81,7 @@ jobs: # reviewed-head marker comment id-token: write # OIDC, mints the Claude GitHub App token (required # even with an OAuth/API-key credential) - uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@4cfd14e8b6f8b740f5f0af27f80139a0d40a596d # v0.42.1 + uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@a623e29085a3be885718cf9c0c0eca85bb53dd97 # v0.42.2 with: runner: ubuntu-24.04 # Bot senders this lane reviews, by numeric user id: the diff --git a/components/claude-lanes-hosted/claude-security-review.yml b/components/claude-lanes-hosted/claude-security-review.yml index 1f293f92..e25a11b3 100644 --- a/components/claude-lanes-hosted/claude-security-review.yml +++ b/components/claude-lanes-hosted/claude-security-review.yml @@ -74,7 +74,7 @@ jobs: # the lane's reviewed-head marker comment id-token: write # OIDC, mints the Claude GitHub App token (required # even with an OAuth/API-key credential) - uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@4cfd14e8b6f8b740f5f0af27f80139a0d40a596d # v0.42.1 + uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@a623e29085a3be885718cf9c0c0eca85bb53dd97 # v0.42.2 with: runner: ubuntu-24.04 # Bot senders this lane reviews, by numeric user id: the diff --git a/components/claude-lanes/claude-review.yml b/components/claude-lanes/claude-review.yml index 34151ba5..07d13526 100644 --- a/components/claude-lanes/claude-review.yml +++ b/components/claude-lanes/claude-review.yml @@ -76,7 +76,7 @@ jobs: # reviewed-head marker comment id-token: write # OIDC, mints the Claude GitHub App token (required # even with an OAuth/API-key credential) - uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@4cfd14e8b6f8b740f5f0af27f80139a0d40a596d # v0.42.1 + uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@a623e29085a3be885718cf9c0c0eca85bb53dd97 # v0.42.2 with: runner: melodic-review-ubuntu-24.04-x64 # Bot senders this lane reviews, by numeric user id: the diff --git a/components/claude-lanes/claude-security-review.yml b/components/claude-lanes/claude-security-review.yml index ac452d29..7c6cfbe9 100644 --- a/components/claude-lanes/claude-security-review.yml +++ b/components/claude-lanes/claude-security-review.yml @@ -70,7 +70,7 @@ jobs: # the lane's reviewed-head marker comment id-token: write # OIDC, mints the Claude GitHub App token (required # even with an OAuth/API-key credential) - uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@4cfd14e8b6f8b740f5f0af27f80139a0d40a596d # v0.42.1 + uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@a623e29085a3be885718cf9c0c0eca85bb53dd97 # v0.42.2 with: runner: melodic-review-ubuntu-24.04-x64 # Bot senders this lane reviews, by numeric user id: the diff --git a/components/runner-policy/README.md b/components/runner-policy/README.md index ac88a7ff..89c245b8 100644 --- a/components/runner-policy/README.md +++ b/components/runner-policy/README.md @@ -1211,6 +1211,14 @@ footer fails the lane as class `incomplete`. No input, secret, workflow or job permission, or `runs-on` routing changes. `maintenance-sync-standards.yml` is byte-identical to v0.41.0 and is declined on shape; the lockstep withholds the two review lanes because any decline suppresses every write. +`pr-review` and `pr-review-security` are registered at the v0.42.2 tag +`a623e29085a3be885718cf9c0c0eca85bb53dd97`, each a verbatim copy of its v0.42.1 +entry, signed off by hand on 2026-10-16. Each lane bumps +`anthropics/claude-code-action` from v1.0.245 to v1.0.250 (`a26b07d`) on the +step that receives `CLAUDE_CODE_OAUTH_TOKEN`, and that step gains the env var +`CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1"` (ci-workflows#752) so review runs +stop ending incomplete. No input, secret, workflow or job permission, or +`runs-on` routing changes. The Zizmor contract at `de50a08b6093d231519ee7a4c9371db76c0a7e1e` uses its reviewed `runner` input and checksum-verified native Linux binary, so enrolled consumers may route that advisory lane onto the managed fleet diff --git a/components/runner-policy/policy.json b/components/runner-policy/policy.json index 32c83469..278eedb6 100644 --- a/components/runner-policy/policy.json +++ b/components/runner-policy/policy.json @@ -121,6 +121,19 @@ "id-token": "write" } }, + "melodic-software/ci-workflows/.github/workflows/pr-review.yml@a623e29085a3be885718cf9c0c0eca85bb53dd97": { + "routing": "runner-input", + "runnerInput": "runner", + "allowedInputs": ["runner", "incremental-review", "allowed-bot-sender-ids"], + "allowedSecrets": { + "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}" + }, + "allowedCallerPermissions": { + "contents": "read", + "pull-requests": "write", + "id-token": "write" + } + }, "melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2": { "routing": "runner-input", "runnerInput": "runner", @@ -186,6 +199,19 @@ "id-token": "write" } }, + "melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@a623e29085a3be885718cf9c0c0eca85bb53dd97": { + "routing": "runner-input", + "runnerInput": "runner", + "allowedInputs": ["runner", "incremental-review", "allowed-bot-sender-ids"], + "allowedSecrets": { + "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}" + }, + "allowedCallerPermissions": { + "contents": "read", + "pull-requests": "write", + "id-token": "write" + } + }, "melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2": { "routing": "runner-input", "runnerInput": "runner", diff --git a/components/runner-policy/runner-policy.test.mjs b/components/runner-policy/runner-policy.test.mjs index df4edf6f..b623ce73 100644 --- a/components/runner-policy/runner-policy.test.mjs +++ b/components/runner-policy/runner-policy.test.mjs @@ -41,6 +41,7 @@ const REPINE_LANE_SHA_V0_40_0 = "a92020292976c2e9b50f7adc922693a45a6c1226"; const REPINE_LANE_SHA_V0_41_0 = "a621ef8112677a519b662ec5d2547475c0101f7e"; const REPINE_LANE_SHA_V0_42_0 = "182aca3ad32b79fd002def94e58eb498ac49e7af"; const REPINE_LANE_SHA_V0_42_1 = "4cfd14e8b6f8b740f5f0af27f80139a0d40a596d"; +const REPINE_LANE_SHA_V0_42_2 = "a623e29085a3be885718cf9c0c0eca85bb53dd97"; const STANDARDS_SYNC_SHA = "35f2684ac953794b854bac1959df00e74eeca1d9"; const REUSABLE_PATH = "melodic-software/ci-workflows/.github/workflows/osv-scanner.yml"; const REUSABLE_REFERENCE = `${REUSABLE_PATH}@${SHA}`; @@ -9123,6 +9124,27 @@ test("every reusable contract at the v0.42.1 tag copies its v0.41.0 entry forwar ); }); +// v0.42.2 bumps the claude-code-action pin and sets one env var on the review +// lanes' action step, with no input, secret, permission or routing change. +test("every reusable contract at the v0.42.2 tag copies its v0.42.1 entry forward verbatim", () => { + const contracts = BASE_POLICY.approvedReusableWorkflowContracts; + const reusables = ["pr-review", "pr-review-security"]; + for (const reusable of reusables) { + const workflowPath = `melodic-software/ci-workflows/.github/workflows/${reusable}.yml`; + const previous = contracts[`${workflowPath}@${REPINE_LANE_SHA_V0_42_1}`]; + assert.ok(previous, `expected a v0.42.1 contract for ${reusable}`); + assert.deepEqual( + contracts[`${workflowPath}@${REPINE_LANE_SHA_V0_42_2}`], + previous, + `${reusable} at the v0.42.2 tag is not a verbatim copy of its v0.42.1 entry`, + ); + } + assert.equal( + Object.keys(contracts).filter((key) => key.endsWith(`@${REPINE_LANE_SHA_V0_42_2}`)).length, + reusables.length, + ); +}); + // Convergence as a property, never as a hardcoded SHA. The daily // claude-lanes-repin lane rewrites these components on every ci-workflows // release, and a test naming one revision would go red by construction on