From 96512905b0ed3cf14d26042819df90d8ade49076 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Fri, 23 Oct 2026 01:02:29 -0400
Subject: [PATCH] feat(runner-policy): register the ci-workflows v0.63.1
 pr-review-cli contract

v0.63.1 (83b739f6) changes only pr-review-cli's publish step
(ci-workflows#865), so its contract copies the v0.63.0 entry forward
verbatim.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 components/runner-policy/README.md            |  4 ++++
 components/runner-policy/policy.json          | 19 +++++++++++++++++++
 .../runner-policy/runner-policy.test.mjs      | 10 ++++++++++
 3 files changed, 33 insertions(+)

diff --git a/components/runner-policy/README.md b/components/runner-policy/README.md
index 26081eb7..fde039b3 100644
--- a/components/runner-policy/README.md
+++ b/components/runner-policy/README.md
@@ -1412,6 +1412,10 @@ tried first, and
 `CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.REVIEWS_CLAUDE_CODE_OAUTH_TOKEN }}`, used
 only after the key hands off. Its first caller is claude-code-plugins' security
 review lane.
+At the v0.63.1 tag `83b739f625b501ad40c65dee7168d836883195e1`, the `pr-review-cli` contract is copied
+forward verbatim: the release titles the completion notice and counts
+demoted CRITICAL findings in the summary (ci-workflows#865), with no input,
+secret, permission or routing change.
 The Zizmor contract at `de50a08b6093d231519ee7a4c9371db76c0a7e1e`
 uses its reviewed `runner` input and checksum-verified native Linux binary, so
 enrolled consumers may route that advisory lane onto the managed fleet
diff --git a/components/runner-policy/policy.json b/components/runner-policy/policy.json
index 941f9a99..8b28a12b 100644
--- a/components/runner-policy/policy.json
+++ b/components/runner-policy/policy.json
@@ -772,6 +772,25 @@
         "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.REVIEWS_CLAUDE_CODE_OAUTH_TOKEN }}"
       }
     },
+    "melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@83b739f625b501ad40c65dee7168d836883195e1": {
+      "routing": "hosted-only",
+      "fixedRunsOn": ["ubuntu-24.04"],
+      "allowedInputs": [
+        "lane",
+        "publish",
+        "role",
+        "model-args",
+        "allowed-bot-sender-ids",
+        "allowed-author-ids",
+        "docs-only-paths",
+        "incremental-review",
+        "cli-version"
+      ],
+      "allowedSecrets": {
+        "CLAUDE_API_KEY": "${{ secrets.REVIEWS_CLAUDE_API_KEY }}",
+        "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.REVIEWS_CLAUDE_CODE_OAUTH_TOKEN }}"
+      }
+    },
     "melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2": {
       "routing": "runner-input",
       "runnerInput": "runner",
diff --git a/components/runner-policy/runner-policy.test.mjs b/components/runner-policy/runner-policy.test.mjs
index 4b2a8ae8..b3109937 100644
--- a/components/runner-policy/runner-policy.test.mjs
+++ b/components/runner-policy/runner-policy.test.mjs
@@ -9877,6 +9877,16 @@ test("the pr-review-cli contract at the v0.63.0 tag is hosted-only and admits th
   assert.equal(Object.keys(contracts).filter((key) => key.endsWith(`@${sha}`)).length, 1);
 });
 
+// v0.63.1 changes only pr-review-cli's publish step (ci-workflows#865), so its
+// contract copies the v0.63.0 entry forward verbatim.
+test("the pr-review-cli contract at the v0.63.1 tag copies its v0.63.0 entry forward verbatim", () => {
+  const contracts = BASE_POLICY.approvedReusableWorkflowContracts;
+  const key = (sha) => `melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@${sha}`;
+  const sha = "83b739f625b501ad40c65dee7168d836883195e1";
+  assert.deepEqual(contracts[key(sha)], contracts[key("8778094736e414233110f3e0d6d9948628ba77b5")]);
+  assert.equal(Object.keys(contracts).filter((k) => k.endsWith(`@${sha}`)).length, 1);
+});
+
 // Convergence as a property, never as a hardcoded SHA. The daily
 // claude-lanes-repin lane rewrites these components on every ci-workflows
 // release, and a test naming one revision would go red by construction on