[kyle-sexton]

Refs: melodic-software/ci-workflows#880

Summary

Registers the pr-review-cli.yml reusable-workflow contract at ci-workflows v0.65.7 (4c531cea137f5cbb38d4c132dbfa6e38f76fba7d). Callers pinned to that release then pass runner-policy.

Fix

Copies the v0.65.6 entry (@914264587c35692c15e05c965103426eec18d1f0) forward in components/runner-policy/policy.json and adds the matching copy-forward test in runner-policy.test.mjs, as #874 did. Earlier pins stay as history. gh api compare v0.65.6...v0.65.7 lists seven files. In pr-review-cli.yml, only the compose prompt, the hold step's env and comments change. The hold-paths input stays, so inputs, secrets and permissions are unchanged. The change itself is ci-workflows#880: hold-paths becomes extra security scrutiny instead of a hold, and a cost hold needs a real charge.

Verification

• node components/runner-policy/runner-policy.mjs --root <worktree>: Runner policy passed.
• node --test components/runner-policy/runner-policy.test.mjs: 349 tests, 349 pass, 0 fail.

Related

• melodic-software/ci-workflows#880 (the fix released as v0.65.7)
• feat(runner-policy): register the ci-workflows v0.65.6 pr-review-cli contract #874 (the v0.65.6 contract)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T16:28:56.656340Z	3048a20	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed 3048a20154bd085cf8663845980389fc159991f4: 0 finding(s), 0 as inline comments.

No findings.

What the PR does: it registers the pr-review-cli.yml contract at ci-workflows v0.65.7 (4c531cea…) in components/runner-policy/policy.json. It also adds a matching copy-forward test in runner-policy.test.mjs.

What I checked:

• I read the new policy entry (policy.json:1056-1076) next to the v0.65.6 entry (policy.json:1035-1055). Routing, fixedRunsOn, the 11 allowedInputs and both allowedSecrets are identical. That matches the test's deepEqual.
• The new test has the same shape as the neighbouring v0.65.6 test. It also asserts that exactly one contract key ends in the new SHA.
• The REVIEW.md hold classes don't apply. The change touches no trusted-actors path, CODEOWNERS or .gitmodules, and adds no model spend or infrastructure. The new entry only approves an existing workflow's pin.

Not verified:

• I could not run node --test components/runner-policy/runner-policy.test.mjs or the runner-policy.mjs check. The sandbox required approval for them, so the 349/349 pass result is author-claimed.
• I did not verify the claim that v0.65.6→v0.65.7 changes no inputs, secrets or permissions. It would need the upstream compare, which I didn't read.

Closing issue: the PR uses Refs: melodic-software/ci-workflows#880, so it closes no issue and has no acceptance criteria to check.

[github-actions]

claude-security-review reviewed 3048a20154bd085cf8663845980389fc159991f4: 0 finding(s), 0 as inline comments.

Security review: PR #876 (head 3048a20)

No security findings.

critical-findings: 0

Scope. The PR touches two files: components/runner-policy/policy.json and its test, runner-policy.test.mjs. It adds one approved reusable-workflow contract for melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@4c531cea137f5cbb38d4c132dbfa6e38f76fba7d (v0.65.7).

What I checked.

• The new entry matches the v0.65.6 entry (...@914264587c35692c15e05c965103426eec18d1f0) line for line. Both have routing: hosted-only, fixedRunsOn: ["ubuntu-24.04"], the same 11 allowedInputs (including hold-label and hold-paths), and the same two allowedSecrets mappings.
• The entry does not widen anything. It adds no new input, no new secret, no runner change, and no loosened routing. The secrets stay mapped to the REVIEWS_* org secrets.
• The pin is a full 40-character commit SHA, not a mutable tag or branch.
• The new test asserts the entry deep-equals the v0.65.6 entry and that exactly one key ends in the new SHA. A drift from the copy-forward, or a duplicate key, would fail the test.
• The diff does not touch .github/standards/trusted-actors/**, check-trusted-trigger, CODEOWNERS or .gitmodules, so there is no trust-gate hold. It has no CRITICAL findings, so no critical-security hold either.
• It removes or softens no standing instruction, so the instruction-surface lens does not apply. It changes no plugin manifest, so there are no manifest <field> lines.

Not verified. I could not confirm that 4c531cea… is the commit the v0.65.7 tag points to. The sandbox blocked the gh api call to ci-workflows. This is a provenance check on the pin, not a defect I found in the diff. The approval list only applies if a workflow references exactly this SHA, so a wrong SHA would make the contract unused, not grant access to anything else.

Actions-hardening topics such as permissions and pin changes are zizmor's lane and are not repeated here.