[kyle-sexton]

Refs: melodic-software/claude-code-plugins#7110

Summary

Registers ci-workflows
v0.59.1
(8bd4d7f963a06627dd2d551ffcd8d9db5e6b881b) contracts for pr-review.yml and
pr-review-security.yml, so
claude-code-plugins#7110
can repin its hosted review lanes (pr-review-hosted.yml,
pr-review-security-hosted.yml) from v0.55.0 (3a2c748) to v0.59.1.

The gate declines auto-approval because the credential surface changed: the
anthropics/claude-code-action pin moves from v1.0.252 (f27be6b) to
v1.0.253 (5eb090f) on both review steps in each workflow, and those steps
receive CLAUDE_CODE_OAUTH_TOKEN
(ci-workflows#838).
No workflow_call input or secret differs between v0.55.0 and v0.59.1.

Owner review needed. Neither workflow is byte-identical to the SHA its
copied entry reviewed; the README rollout line says "sign-off pending".

Fix

• components/runner-policy/policy.json: verbatim copies of the v0.55.0
  (3a2c748) entries at 8bd4d7f9, for pr-review and
  pr-review-security. No input, secret mapping, caller permission or routing
  is added or widened.
• components/runner-policy/README.md: the v0.59.1 rollout line, sign-off
  pending.
• components/runner-policy/runner-policy.test.mjs: a test that both v0.59.1
  entries equal their v0.55.0 entries and are the only two keys at that SHA.

Review basis

Git blob SHAs (git rev-parse <sha>:.github/workflows/<file>):

File	3a2c748 (v0.55.0)	8bd4d7f9 (v0.59.1)
pr-review.yml	c67ec82b	4f3d4e44
pr-review-security.yml	1737f82d	30b595b9

git diff 3a2c748 8bd4d7f on each file shows exactly two changes, identical
in both files:

1. claude-code-action v1.0.252 -> v1.0.253 on the primary review step and
   the fallback review step (pr-review.yml L827 and L993;
   pr-review-security.yml L638 and L795),
   ci-workflows#838.
2. The findings-count check raises the reported count to the number of
   manifest <field>: flag lines in the summary
   (ci-workflows#848).

Verification

• npm run test:runner-policy: 326 pass, 0 fail, including ✔ both review contracts at the v0.59.1 tag copy their v0.55.0 entries forward verbatim.
• npm run lint:runner-policy: Runner policy passed.
• End to end, in a claude-code-plugins worktree with both hosted review
  callers repinned to 8bd4d7f9, node .github/standards/runner-policy/runner-policy.mjs --root .:

  • with the vendored policy (before):

    .github/workflows/pr-review-hosted.yml#pr-review: runner-target-contract: the reusable workflow path@SHA has no reviewed runner-input contract (auto-approval declined: credentialReferences changed since the previously reviewed melodic-software/ci-workflows/.github/workflows/pr-review.yml@3a2c748fdef9cfb9ceec5a66289e21842189689f)
    .github/workflows/pr-review-security-hosted.yml#pr-review-security: runner-target-contract: the reusable workflow path@SHA has no reviewed runner-input contract (auto-approval declined: credentialReferences changed since the previously reviewed melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@3a2c748fdef9cfb9ceec5a66289e21842189689f)
    

  • with this branch's policy.json copied in as the sync would (after):
    Runner policy passed.

• lefthook pre-commit (typos, editorconfig, markdownlint, gitleaks, biome):
  clean.

Related

• Precedent: #832
  (v0.58.0 intake contracts copied forward).
• ci-workflows#841,
  ci-workflows#838,
  ci-workflows#848.

🤖 Generated with Claude Code

[kyle-sexton]

Superseded by #838 (the same two runner-policy entries at ci-workflows 8bd4d7f, already passed by Security & Cost and signed off). Closing so the two don't race; claude-code-plugins#8938 does the repin.