[kyle-sexton]

Refs: melodic-software/ci-workflows#882

Summary

Registers the pr-review-cli.yml reusable-workflow contract at ci-workflows v0.65.8 (4f79cc9244498ae856504cf74aeeb05dcc9c6b43), so callers pinned to that release pass runner-policy.

Fix

Copies the v0.65.7 entry (@4c531cea137f5cbb38d4c132dbfa6e38f76fba7d) forward in components/runner-policy/policy.json and adds the matching copy-forward test in runner-policy.test.mjs, following #874 and #876. v0.65.8 (ci-workflows#882) adds a check-key-credit job that skips the key job while the key's recent credit stop is inside key-credit-window-hours. Callers pass no new input. They grant actions: read on the calling job, which the contract does not record. Inputs, secrets and runner are unchanged.

Verification

• node components/runner-policy/runner-policy.mjs --root <worktree>: Runner policy passed.
• node --test components/runner-policy/runner-policy.test.mjs: 350 pass, 0 fail.

Related

• melodic-software/ci-workflows#882 (released as v0.65.8)
• feat(runner-policy): register the ci-workflows v0.65.7 pr-review-cli contract #876 (the v0.65.7 contract)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T18:21:54.450132Z	017c785	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed 017c785406f74b92deb66b1c06011eeda92d024f: 0 finding(s), 0 as inline comments.

Code review: no findings

The PR registers the ci-workflows v0.65.8 pr-review-cli.yml contract (@4f79cc92…) by copying the v0.65.7 (@4c531cea…) entry forward in components/runner-policy/policy.json. It adds a matching copy-forward test in runner-policy.test.mjs.

Checked

• The new policy entry has the same routing, fixedRunsOn, allowedInputs and allowedSecrets as the v0.65.7 entry (compared by eye, line by line, since I could not run a script to diff them). See policy.json L1056-L1097.
• The test follows the established copy-forward pattern: it asserts deep equality with the v0.65.7 entry and that the new SHA key appears exactly once.
• The PR body meets the contract: it opens with Refs: #… and has the Summary, Fix, Verification and Related sections.
• There is no closing issue, so there are no acceptance criteria to check. No .claude/rules/ file with a paths: glob matches the changed files, and no plugin manifest changed. No paved-path index row was consulted.
• No hold applies: no model-spend increase, no trust-gate files, no critical security finding.

Not verified

• The claim that v0.65.8 adds no new workflow input (check-key-credit / key-credit-window-hours) is author-stated. I could not read the upstream workflow, because my gh api call was not approved. If key-credit-window-hours is a workflow_call input, allowedInputs would need it.
• The Verification results (policy validator passed, 350 tests pass) are the author's. I did not run them.

[github-actions]

claude-security-review reviewed 017c785406f74b92deb66b1c06011eeda92d024f: 0 finding(s), 0 as inline comments.

No security issues found in this pull request.

The PR changes two files: components/runner-policy/policy.json and its test, runner-policy.test.mjs.

• Policy entry: It adds one approved-reusable-workflow entry for pr-review-cli.yml@4f79cc9…. I diffed it against the existing @4c531cea… entry and the two are identical. Both are hosted-only on ubuntu-24.04, with the same 11 allowed inputs and the same two secrets, REVIEWS_CLAUDE_API_KEY and REVIEWS_CLAUDE_CODE_OAUTH_TOKEN. The new pin grants no extra input, secret, or runner.
• Pinning: The entry is pinned by full 40-character SHA, not a tag or branch, and the old entry stays in place.
• Test: The new test only asserts that the new entry equals the v0.65.7 entry and that exactly one entry exists for the new SHA. It does not weaken any existing assertion.

I could not confirm that 4f79cc9… is the commit the v0.65.8 tag points to. The sandbox denied the gh api call against melodic-software/ci-workflows, so that check did not run. The PR's comment says the new version adds a check-key-credit job. It also says callers need actions: read, which the contract does not record. That claim came from the diff comment and I did not check it against the upstream workflow. Neither point affects the policy file's trust surface, because the new entry grants no more than the one it copies.

The skill's manifest <field> lines do not apply, since the PR touches no plugin manifest. The PR does not touch a trust-gate path (trusted-actors, check-trusted-trigger, CODEOWNERS, .gitmodules), so no hold is needed. The PR deletes or softens no standing instruction.

critical-findings: 0