From d186036c5f11890870a890c9426d18aa30257b6f Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Sun, 18 Oct 2026 01:24:08 -0400 Subject: [PATCH 1/2] feat(runner-policy): register ci-workflows v0.49.0 intake contract intake-triage at ff8cd36 copies its v0.45.0 entry and adds issue-number, allowed-author-ids and allowed-bot-sender-ids. skipped-label stays unregistered because no caller passes it. Co-Authored-By: Claude Opus 5.5 --- components/runner-policy/README.md | 12 ++++++++++ components/runner-policy/policy.json | 23 +++++++++++++++++++ .../runner-policy/runner-policy.test.mjs | 23 +++++++++++++++++++ 3 files changed, 58 insertions(+) diff --git a/components/runner-policy/README.md b/components/runner-policy/README.md index 537b0697..a2cbe441 100644 --- a/components/runner-policy/README.md +++ b/components/runner-policy/README.md @@ -1263,6 +1263,18 @@ or COLLABORATOR of that issue's own repository; issue titles and bodies are not filtered by author. The lockstep declines it on `credentialReferences`; the other two are byte-identical. No input, secret, workflow or job permission, or `runs-on` routing changes. +`intake-triage` is registered at the v0.49.0 tag +`ff8cd36321423de961381e608e4a31563e74adb3` (ci-workflows#773, #774), sign-off +pending. It copies its v0.45.0 entry and adds `issue-number`, +`allowed-author-ids` and `allowed-bot-sender-ids`. The OWNER or MEMBER gate +becomes a numeric-id allowlist: an `opened` issue runs only when its author +opened it and the author's id is in `allowed-author-ids` (a bot's sender id in +`allowed-bot-sender-ids`). A `workflow_dispatch` run triages `issue-number`, +validated against `^[1-9][0-9]{0,9}$` and read from the API, only for an actor +whose id is in one of the two lists. A new `skipped` job takes +`issues: write`, inside the caller grant, to apply the new `skipped-label` +input, which stays unregistered because no caller passes it. No secret or +`runs-on` routing changes. The Zizmor contract at `de50a08b6093d231519ee7a4c9371db76c0a7e1e` uses its reviewed `runner` input and checksum-verified native Linux binary, so enrolled consumers may route that advisory lane onto the managed fleet diff --git a/components/runner-policy/policy.json b/components/runner-policy/policy.json index a478cecb..d2fe3bba 100644 --- a/components/runner-policy/policy.json +++ b/components/runner-policy/policy.json @@ -76,6 +76,29 @@ "issues": "write" } }, + "melodic-software/ci-workflows/.github/workflows/intake-triage.yml@ff8cd36321423de961381e608e4a31563e74adb3": { + "routing": "runner-input", + "runnerInput": "runner", + "allowedInputs": [ + "runner", + "allowed-labels", + "escalation-label", + "floor-label", + "instructions", + "cli-version", + "claude-args", + "issue-number", + "allowed-author-ids", + "allowed-bot-sender-ids" + ], + "allowedSecrets": { + "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}" + }, + "allowedCallerPermissions": { + "contents": "read", + "issues": "write" + } + }, "melodic-software/ci-workflows/.github/workflows/pr-review.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2": { "routing": "runner-input", "runnerInput": "runner", diff --git a/components/runner-policy/runner-policy.test.mjs b/components/runner-policy/runner-policy.test.mjs index 854c595f..2c89ec6a 100644 --- a/components/runner-policy/runner-policy.test.mjs +++ b/components/runner-policy/runner-policy.test.mjs @@ -46,6 +46,7 @@ const REPINE_LANE_SHA_V0_44_0 = "58a60eac76cf36ed8ef4f59460acb4a8d34d3ff7"; const REPINE_LANE_SHA_V0_44_1 = "bc02e0504d83df70a2c95fcf3651d0f1eac3e252"; const REPINE_LANE_SHA_V0_45_0 = "3c8a4b2aeff5871cf72d35a686692bc6f0d44815"; const REPINE_LANE_SHA_V0_48_0 = "96b50d451c4483c476f2f963674e0a3ba9d50fe3"; +const REPINE_LANE_SHA_V0_49_0 = "ff8cd36321423de961381e608e4a31563e74adb3"; const STANDARDS_SYNC_SHA = "35f2684ac953794b854bac1959df00e74eeca1d9"; const REUSABLE_PATH = "melodic-software/ci-workflows/.github/workflows/osv-scanner.yml"; const REUSABLE_REFERENCE = `${REUSABLE_PATH}@${SHA}`; @@ -9356,6 +9357,28 @@ test("every reusable contract at the v0.48.0 tag copies its v0.45.0 entry forwar ); }); +// v0.49.0 gates intake by author id and admits a workflow_dispatch for a +// listed actor; intake-triage is its v0.45.0 entry plus exactly those inputs. +test("intake-triage at the v0.49.0 tag copies its v0.45.0 entry and adds only the author-gate inputs", () => { + const contracts = BASE_POLICY.approvedReusableWorkflowContracts; + const workflowPath = "melodic-software/ci-workflows/.github/workflows/intake-triage.yml"; + const previous = contracts[`${workflowPath}@${REPINE_LANE_SHA_V0_45_0}`]; + assert.ok(previous, "expected a v0.45.0 contract for intake-triage"); + assert.deepEqual(contracts[`${workflowPath}@${REPINE_LANE_SHA_V0_49_0}`], { + ...previous, + allowedInputs: [ + ...previous.allowedInputs, + "issue-number", + "allowed-author-ids", + "allowed-bot-sender-ids", + ], + }); + assert.equal( + Object.keys(contracts).filter((key) => key.endsWith(`@${REPINE_LANE_SHA_V0_49_0}`)).length, + 1, + ); +}); + // Convergence as a property, never as a hardcoded SHA. The daily // claude-lanes-repin lane rewrites these components on every ci-workflows // release, and a test naming one revision would go red by construction on From 42cfb09988cfefa7a26b68201dd9aa293e4209dc Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Sun, 18 Oct 2026 01:42:25 -0400 Subject: [PATCH 2/2] docs(runner-policy): record the v0.49.0 intake sign-off Co-Authored-By: Claude Opus 5.5 --- components/runner-policy/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/components/runner-policy/README.md b/components/runner-policy/README.md index a2cbe441..62f47c77 100644 --- a/components/runner-policy/README.md +++ b/components/runner-policy/README.md @@ -1264,8 +1264,8 @@ filtered by author. The lockstep declines it on `credentialReferences`; the other two are byte-identical. No input, secret, workflow or job permission, or `runs-on` routing changes. `intake-triage` is registered at the v0.49.0 tag -`ff8cd36321423de961381e608e4a31563e74adb3` (ci-workflows#773, #774), sign-off -pending. It copies its v0.45.0 entry and adds `issue-number`, +`ff8cd36321423de961381e608e4a31563e74adb3` (ci-workflows#773, #774), signed off +by hand on 2026-10-18. It copies its v0.45.0 entry and adds `issue-number`, `allowed-author-ids` and `allowed-bot-sender-ids`. The OWNER or MEMBER gate becomes a numeric-id allowlist: an `opened` issue runs only when its author opened it and the author's id is in `allowed-author-ids` (a bot's sender id in