feat(runner-policy): register the ci-workflows v0.65.13 intake-triage and pr-review-cli contracts by kyle-sexton · Pull Request #882 · melodic-software/standards

kyle-sexton · 2026-10-26T02:13:49Z

No related issue: registers the reviewed contracts for the ci-workflows v0.65.13 release.

Summary

This PR registers the ci-workflows v0.65.13 intake-triage.yml and pr-review-cli.yml contracts at ba7af78d291f10bd75651857a0db2357c23df0fe, so callers can pin to that release. The release fixes the pr-review-cli status job, which reported no-outcome whenever the counted token leg succeeded (ci-workflows#892).

Fix

policy.json: both v0.65.13 entries copy their v0.65.12 entries forward, including the FALLBACK_CLAUDE_CODE_OAUTH_TOKEN secret that #881 added. The v0.65.12 and earlier pins stay.
README.md: one line about the v0.65.13 contracts.
runner-policy.test.mjs: a test that both v0.65.13 entries equal their v0.65.12 entries and that exactly two contracts sit at the new sha.

Verification

node --test components/runner-policy/runner-policy.test.mjs passes 355 of 355.
node --test components/claude-lanes/repin-policy-lockstep.test.mjs passes 23 of 23.
Between v0.65.12 and v0.65.13, pr-review-cli.yml changes only an internal step output name. It adds no input, secret or permission.
Left out: nothing.

… and pr-review-cli contracts Both entries copy v0.65.12 forward unchanged: v0.65.13 fixes the pr-review-cli status job's read of the counted token leg's job result (ci-workflows#892), with no input, secret, permission or routing change. The v0.65.12 and earlier pins stay. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

chatgpt-codex-connector · 2026-10-26T02:14:05Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T02:14:55.522661Z	`064d2ef`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

github-actions · 2026-10-26T02:14:56Z

claude-security-review reviewed 064d2ef87ba7719e45a8e21bb1d00bceaa4f6920: 0 finding(s), 0 as inline comments.

Security review: PR #882 at `064d2ef`

No security findings.

critical-findings: 0

What changed. The PR registers the ci-workflows v0.65.13 pin ba7af78d291f10bd75651857a0db2357c23df0fe in components/runner-policy/policy.json. It adds one entry each for intake-triage.yml and pr-review-cli.yml. It also adds a README note and a test.

What I checked.

Entries copy v0.65.12 unchanged. I compared both new entries with their 78ee7a26… predecessors at policy.json lines 414 and 1246. They are field-for-field identical on routing, allowedInputs, allowedSecrets and allowedCallerPermissions. Nothing widens:
- intake-triage.yml keeps contents: read and issues: write, with the same three secret mappings.
- pr-review-cli.yml stays hosted-only on ubuntu-24.04 and takes the same input list. That list includes the hold-label and hold-paths inputs, which were already approved.
Test guards the copy. The new test in runner-policy.test.mjs asserts the entries are deep-equal to the previous ones. It also asserts that exactly two contracts exist for the new SHA, so extra entries would fail it.
No other risk surface. The diff has no manifest changes, no instruction-surface deletions, no trusted-path files and no workflow files.

Not verified. I could not confirm that the pinned SHA ba7af78d… is the v0.65.13 tag, because the sandbox blocked the gh api lookup against melodic-software/ci-workflows. The existing policy validation should catch a SHA that doesn't match its pinned tag.

manifest fields: not applicable (no plugin manifests in this diff).

github-actions · 2026-10-26T02:15:07Z

claude-review reviewed 064d2ef87ba7719e45a8e21bb1d00bceaa4f6920: 0 finding(s), 0 as inline comments.

No findings on #882 at 064d2ef.

I read the whole diff (policy.json, README.md and runner-policy.test.mjs) and the PR context.

Copy-forward claim holds. I compared the new intake-triage.yml@ba7af78d… and pr-review-cli.yml@ba7af78d… entries line by line with their v0.65.12 entries (@78ee7a26…). Routing, allowedInputs, allowedSecrets (including FALLBACK_CLAUDE_CODE_OAUTH_TOKEN) and allowedCallerPermissions are identical, so the "unchanged" statement in the README and the new test matches the data.
Test. The new test checks both entries with deepEqual against v0.65.12 and that exactly two contracts sit at the new sha. It follows the v0.65.12 test next to it. I did not run it. The Bash sandbox blocked my attempts to run node --test, so the PR's "355 of 355" and "23 of 23" results are author-claimed and unverified by me.
Cross-doc reconciliation. The only files that mention the v0.65.12 sha are the three the PR changes, so no other file needs updating.
Not checked. I could not confirm against ci-workflows that pr-review-cli.yml changed between v0.65.12 and v0.65.13 only in an internal step output name. That is author-claimed.
Closing issue. None; the body says No related issue with a reason, which fits the body contract. The body has all four sections.
Manifests and holds. No plugin manifests changed, and no cost or critical-security hold applies.

) No related issue: owner-authorized hardening of runner-policy auto-approval against imposter commits. ## Summary Auto-approval copies a reviewed contract forward onto any full SHA whose security surface matches a reviewed basis. It never checked that the SHA is a real ci-workflows release. GitHub resolves a SHA from anywhere in a repository's fork network, so a fork-only or unreleased commit with a matching surface and malicious steps would be approved. The hosted-only `pr-review-cli` contract forwards the `REVIEWS_*` OAuth tokens and API keys. Background: [Chainguard, imposter commits](https://www.chainguard.dev/unchained/what-the-fork-imposter-commits-in-github-actions-and-ci-cd) and [StepSecurity, triaging imposter commits](https://docs.stepsecurity.io/github-actions/harden-runner/runbooks/triaging-action-uses-imposter-commit). ## Fix - `runner-policy.mjs`: after every existing decline rule, a candidate is approved only when a tag of its source repository points at it and that tag's release is immutable, published and not a prerelease. It reads `GET /repos/{owner}/{repo}/git/matching-refs/tags/`, peels annotated tags through `git/tags/{sha}`, then reads `releases/tags/{tag}`, all through the existing fetch seam with `GITHUB_TOKEN` when set. A non-release commit declines with a diagnostic; any failed request declines (fail closed). A tag with no release (404) is skipped, not treated as a release. - Immutability is required, not just preferred: the releases API exposes `immutable`, and every recent ci-workflows release has it set. A future release published without immutability will be declined and needs a reviewed contract. - The tree request now shares a small `fetchGitHubJson` helper; its error text is unchanged. - Existing decline rules are unchanged, and the release check runs last, so their diagnostics do not change. - `README.md`: one paragraph on the release-commit requirement. ## Verification - `node --test components/runner-policy/runner-policy.test.mjs`: 365 of 365 pass (355 before, plus 10 new cases): a lightweight release-tag commit is approved; an annotated tag is peeled and approved; an annotated tag peeling to another commit, a non-release SHA with an identical surface, a tag without a release, and draft, prerelease and non-immutable releases are declined; a 500 from the tag list or the release lookup is declined. - The shared test mocks now serve each test's source SHAs as release commits, so the existing approval tests keep exercising approval. - Mutants killed: always-true release check, dropping the `immutable` condition, skipping the peel, and treating a 404 release as approved each fail at least one test. - `node --test components/claude-lanes/repin-policy-lockstep.test.mjs`: 23 of 23 pass. - `npm run lint:runner-policy`: passes. Biome check and markdownlint: clean. - Live check of the API shapes: `releases/tags/v0.65.13` returns `draft: false, prerelease: false, immutable: true`, a missing tag returns 404, and `matching-refs/tags/` returns all 109 ci-workflows tags in one response. ## Related - [#882](#882) registered v0.65.13 (`ba7af78`), the SHA a local probe showed being auto-approved with no token before it was registered. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01DpzEJAE4EMndcWQXiKSZYn --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

… contract (#885) No related issue: registers the reviewed contract for the ci-workflows v0.65.14 release. ## Summary This PR registers the [ci-workflows v0.65.14](https://github.com/melodic-software/ci-workflows/releases/tag/v0.65.14) `pr-review-cli.yml` contract at `3180217076b19bbdfccc43026c7f91c604da673d`, so callers can pin to that release. The release reports a failed "Isolate the runner" install as `install-failed` ([ci-workflows#893](melodic-software/ci-workflows#893)). ## Fix - `policy.json`: the v0.65.14 `pr-review-cli.yml` entry copies its v0.65.13 entry forward. The v0.65.13 and earlier pins stay. - `README.md`: one sentence about the v0.65.14 contract. - `runner-policy.test.mjs`: a test that the v0.65.14 entry equals the v0.65.13 entry and that exactly one contract sits at the new sha. ## Verification - `node --test components/runner-policy/runner-policy.test.mjs components/claude-lanes/repin-policy-lockstep.test.mjs` passes 389 of 389. - Between v0.65.13 and v0.65.14, `pr-review-cli.yml` changes only the `failure-class` job output expression (three jobs) and adds a step `id: isolate`. A diff of the two files shows no change to `on.workflow_call` inputs, secrets or permissions. - Left out: `intake-triage.yml`, which this release does not register. ## Related - [ci-workflows#893](melodic-software/ci-workflows#893) is the fix this release ships. - [#882](#882) registered v0.65.13, and this PR follows the same shape. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

kyle-sexton merged commit ece3e32 into main Oct 26, 2026
22 checks passed

kyle-sexton deleted the chore/runner-policy-v0.65.13 branch October 26, 2026 02:18

This was referenced Oct 26, 2026

ci(lanes): repin the Claude lane callers to ci-workflows v0.65.13 and pass the fallback token melodic-software/claude-code-plugins#10151

Merged

fix(runner-policy): auto-approve only ci-workflows release commits #883

Merged

kyle-sexton mentioned this pull request Oct 26, 2026

feat(runner-policy): register the ci-workflows v0.65.14 pr-review-cli contract #885

Merged

Navigation Menu

Repository navigation

feat(runner-policy): register the ci-workflows v0.65.13 intake-triage and pr-review-cli contracts - #882

feat(runner-policy): register the ci-workflows v0.65.13 intake-triage and pr-review-cli contracts#882
kyle-sexton merged 1 commit into
mainfrom
chore/runner-policy-v0.65.13

kyle-sexton commented Oct 26, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

kyle-sexton commented Oct 26, 2026

Summary

Fix

Verification

Related

Uh oh!

chatgpt-codex-connector Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

github-actions Bot commented Oct 26, 2026

Security review: PR #882 at 064d2ef

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

chatgpt-codex-connector Bot commented Oct 26, 2026 •

edited

Loading

Security review: PR #882 at `064d2ef`