[kyle-sexton]

Refs: melodic-software/ci-workflows#884

Summary

Registers the pr-review-cli.yml reusable-workflow contract at ci-workflows v0.65.9 (4fbceb4b75ffd568dfa5db31de0d0e753c0c64e6). Callers pinned to that release then pass runner-policy.

Fix

• Copies the v0.65.8 entry (@4f79cc9244498ae856504cf74aeeb05dcc9c6b43) forward in components/runner-policy/policy.json.
• Adds the matching copy-forward test in runner-policy.test.mjs, following feat(runner-policy): register the ci-workflows v0.65.8 pr-review-cli contract #877.
• v0.65.9 (ci-workflows#884) writes the review's full diff with git diff --text. A head .gitattributes or a NUL byte can no longer hide a file's text from the review model.
• Inputs, secrets and runner are unchanged.

Verification

• node components/runner-policy/runner-policy.mjs --root <worktree>: Runner policy passed.
• node --test components/runner-policy/runner-policy.test.mjs: 351 pass, 0 fail.
• biome ci on the two changed files: clean.

Related

• melodic-software/ci-workflows#884 (released as v0.65.9)
• feat(runner-policy): register the ci-workflows v0.65.8 pr-review-cli contract #877 (the v0.65.8 contract)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T00:57:10.278907Z	22f0901	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed 22f09010137230f8ad2fc394a077f88237bfc1bb: 0 finding(s), 0 as inline comments.

No findings. Skip gate did not apply, and I found nothing to flag.

• Copy-forward is exact. I compared the new pr-review-cli.yml@4fbceb4b… entry in components/runner-policy/policy.json with the v0.65.8 entry (@4f79cc92…, line 1077). Routing, fixedRunsOn, allowedInputs (11 items, same order) and allowedSecrets are identical.
• The new test matches the existing pattern. It does a deepEqual against the v0.65.8 entry and asserts exactly one key ends in the new SHA, like the earlier copy-forward tests.
• No closing issue. The PR uses Refs: melodic-software/ci-workflows#884, so there are no acceptance criteria to check.
• Body contract and scope. The PR body has the Refs: line and the Summary, Fix, Verification and Related sections. No path-scoped rule or paved-path row applies to the changed files, and neither changed file is a plugin manifest.
• Not verified: the PR's claims that runner-policy.mjs passes, 351 tests pass and biome ci is clean are the author's own. I did not run them.
• Not verified: I did not check that 4fbceb4… is the v0.65.9 tag in ci-workflows.

[github-actions]

claude-security-review reviewed 22f09010137230f8ad2fc394a077f88237bfc1bb: 0 finding(s), 0 as inline comments.

Security review: PR #878 (head 22f0901)

No security issues found. 0 findings.

Change: adds an approvedReusableWorkflowContracts entry for melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@4fbceb4b75ffd568dfa5db31de0d0e753c0c64e6 in components/runner-policy/policy.json, plus a test in runner-policy.test.mjs that the new entry equals the v0.65.8 entry (4f79cc92…).

Checked:

• The new entry is identical to the v0.65.8 entry: hosted-only routing, fixed runner ubuntu-24.04, the same 11 allowed inputs, and the same two allowed secrets (REVIEWS_CLAUDE_API_KEY, REVIEWS_CLAUDE_CODE_OAUTH_TOKEN). Nothing is widened.
• The test asserts equality with the previous entry and that exactly one entry exists for the new SHA, so later drift fails.
• The pin is a full 40-character commit SHA, not a mutable ref.
• No trusted-path, instruction-surface, plugin-manifest, or userConfig change is in the diff, so those lenses do not apply.

Not verified: a gh api call to confirm that SHA 4fbceb4b… is what the v0.65.9 tag points to was declined, so the PR's claim that it is the v0.65.9 commit (ci-workflows#884) is unconfirmed. This allowlist admits a workflow revision to receive review secrets, so the reviewer or the repin automation should confirm it.

critical-findings: 0