Repository navigation
feat(runner-policy): register ci-workflows v0.59.1 review contracts - #838
Merged
Merged
Conversation
pr-review and pr-review-security at 8bd4d7f9 are verbatim copies of their v0.55.0 (3a2c748f) entries. The interface is unchanged; the steps that receive CLAUDE_CODE_OAUTH_TOKEN bump claude-code-action v1.0.252 to v1.0.253 (ci-workflows#838), and the result step raises the findings count to the summary's manifest flag lines (ci-workflows#848). Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kyle-sexton
marked this pull request as ready for review
October 21, 2026 21:32
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
kyle-sexton
added a commit
that referenced
this pull request
Oct 22, 2026
…contracts (#842) Refs: melodic-software/claude-code-plugins#8491 ## Summary Registers ci-workflows [v0.60.0](https://github.com/melodic-software/ci-workflows/releases/tag/v0.60.0) (`82ca5ca9be6e18a1addb7986eae15689339aedbc`) contracts for `intake-triage.yml`, `pr-review.yml` and `pr-review-security.yml`, so claude-code-plugins can repin intake triage from v0.58.0 and both review lanes from v0.59.1 to v0.60.0. The intake-triage repin carries [ci-workflows#854](melodic-software/ci-workflows#854), which [claude-code-plugins#8491](melodic-software/claude-code-plugins#8491) needs. **Review: the GitHub Security & Cost session reviews this PR.** The gate cannot auto-approve these entries, so the copies rest on the review below. The README rollout line says "sign-off pending"; replace it with "signed off by hand on <date>" at sign-off. ## Fix - `components/runner-policy/policy.json`: verbatim copies at `82ca5ca9` of the v0.58.0 (`5e18f3d6`) `intake-triage` entry and the v0.59.1 (`8bd4d7f9`) `pr-review` and `pr-review-security` entries. No input, secret mapping, caller permission or routing is added or widened. - `components/runner-policy/README.md`: the v0.60.0 rollout line, sign-off pending. - `components/runner-policy/runner-policy.test.mjs`: a test that the three v0.60.0 entries equal their previous entries and are the only keys at that SHA. ### Review basis Git blob SHAs of the workflow files and tree SHAs of the commit-relative (`$/`) actions they use, from the contents API at each ref: | Path | `5e18f3d6` (v0.58.0) | `8bd4d7f9` (v0.59.1) | `82ca5ca9` (v0.60.0) | |---|---|---|---| | `workflows/intake-triage.yml` | `8ff8eac3` | `8ff8eac3` | `0c69f08c` | | `workflows/pr-review.yml` | `47a2b1c9` | `4f3d4e44` | `4f3d4e44` | | `workflows/pr-review-security.yml` | `16e9be5b` | `30b595b9` | `30b595b9` | | `actions/check-subprocess-sandbox` | `d9d60153` | `d9d60153` | `92d69c1b` | | `actions/report-lane-outcome` | `5f583be1` | `5f583be1` | `0b6bb70a` | | `actions/run-claude-cli` | `0edc45c1` | `0edc45c1` | `6234a8b1` | | `actions/apply-claude-managed-settings` | `1301e911` | `1301e911` | `1301e911` | | `actions/check-author-trust` | `3517c76f` | `3517c76f` | `3517c76f` | 1. **intake-triage.yml** (`v0.58.0..v0.60.0`, four hunks per job pair, none in `on.workflow_call`, permissions or `runs-on`): the issue file gives each comment's `html_url` and the prompt says the model reads it ([ci-workflows#854](melodic-software/ci-workflows#854)); the report step passes `lane-id: intake-triage` to report-lane-outcome. 2. **report-lane-outcome** ([ci-workflows#853](melodic-software/ci-workflows#853)): new optional `lane-id` and `handoff` inputs; with a lane id and a credential secret name that maps to a kind, each annotation also carries a `lane-outcome {json}` record built from the same closed-pattern facts as the existing tokens. The credential appears as its secret name only, never a value. 3. **check-subprocess-sandbox** and **run-claude-cli/lane.cjs** ([ci-workflows#849](melodic-software/ci-workflows#849)): the sandbox probe's error text names Docker's seccomp profile. Message text only. The review workflow files are byte-identical to v0.59.1; their change is the commit-relative actions above, which is the diff the gate declines to auto-approve. ## Verification - `npm run test:runner-policy`: 327 pass, 0 fail, including `✔ the intake-triage and review contracts at the v0.60.0 tag copy their previous entries forward verbatim`. - `npm run lint:runner-policy`: `Runner policy passed.` - In the claude-code-plugins repin worktree, `node .github/standards/runner-policy/runner-policy.mjs --root .`: - with its vendored policy (identical to standards `main`): three `runner-target-contract` failures, auto-approval declined for `intake-triage.yml`, `pr-review.yml` and `pr-review-security.yml` at `82ca5ca9`; - with this branch's `policy.json` copied in: `Runner policy passed.` (file restored afterwards). - lefthook pre-commit (typos, editorconfig, markdownlint, gitleaks, biome): clean. ## Related - The claude-code-plugins repin PR passes its runner-policy gate once this merges and syncs. - [ci-workflows v0.60.0](https://github.com/melodic-software/ci-workflows/releases/tag/v0.60.0). - Precedent: [#838](#838) (v0.59.1 review contracts). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs: melodic-software/claude-code-plugins#8938
Summary
Registers ci-workflows v0.59.1
(
8bd4d7f963a06627dd2d551ffcd8d9db5e6b881b) contracts forpr-review.ymlandpr-review-security.yml, soclaude-code-plugins#8938
can repin both review lanes from v0.55.0 (
3a2c748) to v0.59.1.Review: the GitHub Security & Cost session reviews this PR. The gate cannot
auto-approve these entries, so the copies rest on the review below. The README
rollout line says "sign-off pending"; replace it with "signed off by hand on
" at sign-off.
Fix
components/runner-policy/policy.json: verbatim copies of the v0.55.0(
3a2c748) entries at8bd4d7f9, forpr-reviewandpr-review-security.No input, secret mapping, caller permission or routing is added or widened.
The policy entries do not record a credential-reference shape; the gate
computes
credentialReferencesfrom the workflow, so no field changes there.components/runner-policy/README.md: the v0.59.1 rollout line, sign-offpending.
components/runner-policy/runner-policy.test.mjs: a test that both v0.59.1entries equal their v0.55.0 entries and are the only two keys at that SHA.
Review basis
Git blob SHAs (
git rev-parse <sha>:.github/workflows/<file>):3a2c748(v0.55.0)8bd4d7f9(v0.59.1)pr-review.ymlc67ec82b4f3d4e44pr-review-security.yml1737f82d30b595b9git log 3a2c748f..8bd4d7f9on the two files lists two commits. The full diffof each file has three hunks and none touches
on.workflow_call, permissions orruns-on:receive
CLAUDE_CODE_OAUTH_TOKEN, moveanthropics/claude-code-actionfromf27be6b65a4652f08a2ba3cff79114829b588967(v1.0.252) to5eb090f3c3afd701a0672cd32981197ca27688f6(v1.0.253)(ci-workflows#838).
This is the
credentialReferencesdiff the gate declines to auto-approve.number of
manifest <field>: flaglines in its summary when the count is lower(ci-workflows#848).
Model-free script logic, no credential.
Verification
npm run test:runner-policy: 326 pass, 0 fail, including✔ both review contracts at the v0.59.1 tag copy their v0.55.0 entries forward verbatim.npm run lint:runner-policy:Runner policy passed.5fd71552),node .github/standards/runner-policy/runner-policy.mjs --root .:main): tworunner-target-contractfailures, "auto-approval declined: credentialReferenceschanged since the previously reviewed
melodic-software/ci-workflows@3a2c748f..." and
the same for
pr-review-security.yml;policy.jsoncopied in:Runner policy passed.(filerestored afterwards).
Related
passes its runner-policy gate once this merges and syncs.
claude-code-action bump.
findings-count fix (the v0.59.1 release commit).
🤖 Generated with Claude Code