From 3048a20154bd085cf8663845980389fc159991f4 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sat, 24 Oct 2026 12:27:52 -0400
Subject: [PATCH] feat(runner-policy): register the ci-workflows v0.65.7
 pr-review-cli contract

Copies the v0.65.6 entry forward to v0.65.7
(4c531cea137f5cbb38d4c132dbfa6e38f76fba7d) with a copy-forward test.
v0.65.7 (ci-workflows#880) changes only what the hold step and the
prompt do with holds; inputs, secrets and runner are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 components/runner-policy/policy.json          | 21 +++++++++++++++++++
 .../runner-policy/runner-policy.test.mjs      | 13 ++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/components/runner-policy/policy.json b/components/runner-policy/policy.json
index 24439b5..bf0fdec 100644
--- a/components/runner-policy/policy.json
+++ b/components/runner-policy/policy.json
@@ -1053,6 +1053,27 @@
         "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.REVIEWS_CLAUDE_CODE_OAUTH_TOKEN }}"
       }
     },
+    "melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@4c531cea137f5cbb38d4c132dbfa6e38f76fba7d": {
+      "routing": "hosted-only",
+      "fixedRunsOn": ["ubuntu-24.04"],
+      "allowedInputs": [
+        "lane",
+        "publish",
+        "role",
+        "model-args",
+        "allowed-bot-sender-ids",
+        "allowed-author-ids",
+        "docs-only-paths",
+        "incremental-review",
+        "cli-version",
+        "hold-label",
+        "hold-paths"
+      ],
+      "allowedSecrets": {
+        "CLAUDE_API_KEY": "${{ secrets.REVIEWS_CLAUDE_API_KEY }}",
+        "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.REVIEWS_CLAUDE_CODE_OAUTH_TOKEN }}"
+      }
+    },
     "melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2": {
       "routing": "runner-input",
       "runnerInput": "runner",
diff --git a/components/runner-policy/runner-policy.test.mjs b/components/runner-policy/runner-policy.test.mjs
index a1fbdb9..d0d4fc8 100644
--- a/components/runner-policy/runner-policy.test.mjs
+++ b/components/runner-policy/runner-policy.test.mjs
@@ -10032,6 +10032,19 @@ test("the pr-review-cli contract at the v0.65.6 tag copies its v0.65.5 entry for
   assert.equal(Object.keys(contracts).filter((k) => k.endsWith(`@${sha}`)).length, 1);
 });
 
+// v0.65.7 changes only what the hold step and the prompt do with holds
+// (ci-workflows#880): hold-paths becomes extra security scrutiny in the
+// prompt, not a hold, and a cost hold needs a real charge. The hold-paths
+// input stays, and inputs, secrets and runner are unchanged, so the contract
+// copies forward.
+test("the pr-review-cli contract at the v0.65.7 tag copies its v0.65.6 entry forward verbatim", () => {
+  const contracts = BASE_POLICY.approvedReusableWorkflowContracts;
+  const key = (sha) => `melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@${sha}`;
+  const sha = "4c531cea137f5cbb38d4c132dbfa6e38f76fba7d";
+  assert.deepEqual(contracts[key(sha)], contracts[key("914264587c35692c15e05c965103426eec18d1f0")]);
+  assert.equal(Object.keys(contracts).filter((k) => k.endsWith(`@${sha}`)).length, 1);
+});
+
 // Convergence as a property, never as a hardcoded SHA. The daily
 // claude-lanes-repin lane rewrites these components on every ci-workflows
 // release, and a test naming one revision would go red by construction on