Skip to content

feat(runner-policy): register the ci-workflows v0.65.14 pr-review-cli contract - #885

Merged
kyle-sexton merged 1 commit into
mainfrom
chore/runner-policy-v0.65.14
Oct 26, 2026
Merged

feat(runner-policy): register the ci-workflows v0.65.14 pr-review-cli contract#885
kyle-sexton merged 1 commit into
mainfrom
chore/runner-policy-v0.65.14

Conversation

@kyle-sexton

@kyle-sexton kyle-sexton commented Oct 26, 2026

Copy link
Copy Markdown
Member

No related issue: registers the reviewed contract for the ci-workflows v0.65.14 release.

Summary

This PR registers the ci-workflows v0.65.14 pr-review-cli.yml contract at 3180217076b19bbdfccc43026c7f91c604da673d, so callers can pin to that release. The release reports a failed "Isolate the runner" install as install-failed (ci-workflows#893).

Fix

  • policy.json: the v0.65.14 pr-review-cli.yml entry copies its v0.65.13 entry forward. The v0.65.13 and earlier pins stay.
  • README.md: one sentence about the v0.65.14 contract.
  • runner-policy.test.mjs: a test that the v0.65.14 entry equals the v0.65.13 entry and that exactly one contract sits at the new sha.

Verification

  • node --test components/runner-policy/runner-policy.test.mjs components/claude-lanes/repin-policy-lockstep.test.mjs passes 389 of 389.
  • Between v0.65.13 and v0.65.14, pr-review-cli.yml changes only the failure-class job output expression (three jobs) and adds a step id: isolate. A diff of the two files shows no change to on.workflow_call inputs, secrets or permissions.
  • Left out: intake-triage.yml, which this release does not register.

Related

  • ci-workflows#893 is the fix this release ships.
  • #882 registered v0.65.13, and this PR follows the same shape.

🤖 Generated with Claude Code

@kyle-sexton @claude
feat(runner-policy): register the ci-workflows v0.65.14 pr-review-cli…
659d002 
… contract

Copies the pr-review-cli v0.65.13 entry forward unchanged for the
v0.65.14 tag 3180217076b19bbdfccc43026c7f91c604da673d.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 26, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review 🔄 Running since 2026-10-26T04:52:01.999778Z 659d002 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

claude-review reviewed 659d002b6bf46be03b92377a2ff30207fa31d386: 0 finding(s), 0 as inline comments.

No findings.

The PR registers the ci-workflows v0.65.14 pr-review-cli.yml contract at 3180217076b19bbdfccc43026c7f91c604da673d.

  • Policy entry: I read the new policy.json entry against the v0.65.13 entry at ba7af78d291f10bd75651857a0db2357c23df0fe (components/runner-policy/policy.json:1268-1289). routing, fixedRunsOn, allowedInputs and allowedSecrets are identical, so "copies forward unchanged" holds. The v0.65.13 and earlier pins stay.
  • Test: the new test asserts that the old entry exists, that the two entries are deep-equal, and that exactly one contract sits at the new sha. That would fail if the entry drifted or were duplicated.
  • README: the new sentence follows the existing v0.65.12 and v0.65.13 wording.
  • Closing issue: none. The body says No related issue: ... and has the four required sections.
  • Manifests and paved paths: the diff has no plugin manifests and no paved-path rows apply.

I did not run the tests. The tool refused the compound commands I tried. The 389 of 389 pass count and the claim that the v0.65.13 to v0.65.14 workflow diff leaves inputs, secrets and permissions unchanged are author-claimed and unverified by me.

@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

claude-security-review reviewed 659d002b6bf46be03b92377a2ff30207fa31d386: 0 finding(s), 0 as inline comments.

Security review: PR #885 (head 659d002)

No security findings.

critical-findings: 0

What the diff does. It registers the pr-review-cli.yml contract at ci-workflows v0.65.14 (3180217076b19bbdfccc43026c7f91c604da673d) in components/runner-policy/policy.json. It also adds a README note and a test.

Checks done.

  • The new entry matches the v0.65.13 entry (ba7af78d…) field for field. I compared the two blocks by eye in the diff and the file. Both have routing: hosted-only, fixedRunsOn: ["ubuntu-24.04"], the same 11 allowedInputs, and the same 3 allowedSecrets mappings.
  • Nothing is widened: no new input, no new secret, no routing change, and no self-hosted or runner-input routing.
  • The new test asserts this equality. It also asserts exactly one entry for the new SHA.
  • The entry is pinned by a full 40-character SHA, not a tag or branch.
  • The diff has no trusted-path matches, no instruction-surface deletions, and no plugin manifests.

Not verified. I did not confirm that 3180217076b19bbdfccc43026c7f91c604da673d is the real v0.65.14 tag commit upstream. The GitHub API lookup needed approval and I did not run it. The allowlist only takes effect for that exact SHA, so a wrong SHA would fail closed rather than widen anything.

@kyle-sexton
kyle-sexton merged commit b2e3101 into main Oct 26, 2026
22 checks passed
@kyle-sexton
kyle-sexton deleted the chore/runner-policy-v0.65.14 branch October 26, 2026 04:57
@kyle-sexton kyle-sexton mentioned this pull request Oct 26, 2026
Merged
kyle-sexton added a commit that referenced this pull request Oct 26, 2026
@kyle-sexton @claude
feat(runner-policy): register the claude-lanes contracts for ci-workf…
fc516bf 
…lows v0.65.14 (#889)

Refs: #844

## Summary

This PR registers the runner-policy contracts that the claude-lanes
re-pin
([#844](#844)) needs
at
[ci-workflows
v0.65.14](https://github.com/melodic-software/ci-workflows/releases/tag/v0.65.14)
(`3180217076b19bbdfccc43026c7f91c604da673d`). The lockstep declined
`pr-review.yml` and `pr-review-security.yml`, because their inputs
changed
since `3a2c748` (v0.55.0). It withheld `maintenance-sync-standards.yml`.
Each of
the three is registered at the new SHA as a verbatim copy of its newest
entry.

## Fix

- `policy.json`: `pr-review` and `pr-review-security` at `3180217` copy
their
v0.62.0 (`2fe38c0`) entries. `maintenance-sync-standards` at `3180217`
copies
  its v0.55.0 (`3a2c748`) entry. Every earlier entry stays.
- `README.md`: one rollout record after the existing v0.65.14
`pr-review-cli`
  record.
- `runner-policy.test.mjs`: adds `REPINE_LANE_SHA_V0_65_14` and a
verbatim
copy-forward test for the three paths. The #885 v0.65.14 `pr-review-cli`
test
asserted that exactly one contract sits at `3180217`, and this PR adds
three
more. That count is dropped. The test's `deepEqual` copy-forward
assertion
  stays.

### Security review, v0.55.0 (`3a2c748`) to v0.65.14 (`3180217`)

Both revisions of each file were parsed and compared on `on`,
`workflow_call` inputs, secrets and outputs, top-level and job
`permissions`,
`runs-on`, `needs`, job `if`, and which steps reference which secrets.

| Change | Class | Evidence |
|---|---|---|
| New input `credential-name` (string, default
`CLAUDE_CODE_OAUTH_TOKEN`). It holds a secret's name, never its value |
(a) optional, not passed by any caller, not allowed |
`pr-review.yml@3180217:205-214`,
`pr-review-security.yml@3180217:183-192` |
| New input `fallback-credential-name` (string, default empty) | (a)
optional, not passed, not allowed | `pr-review.yml@3180217:215-222`,
`pr-review-security.yml@3180217:193-200` |
| New step `first-attempt-outcome` (report-lane-outcome, no secret). It
runs only when the fallback attempt runs, which needs
`fallback-claude-code-oauth-token`, and no allowed caller maps that
secret | (a) no new trust | `pr-review.yml@3180217:1030-1043` |
| claude-code-action `f27be6b` (v1.0.252) to `5eb090f3` (v1.0.253) in
both credential steps. It is one upstream commit that bumps the Claude
Code and Agent SDK versions | none. Already hand-reviewed at v0.59.1
(README record) | `pr-review.yml@3180217:861,1050` |
| Isolation install step: gains `id: isolate`, uses one bounded apt-get
deadline, and fails without socat. The status job classifies a failure
there as `install-failed` | none, no secret, no permission |
`pr-review.yml@3180217:804-838,1397,1421-1425` |
| The result step raises a findings count that is below the summary's
`manifest <field>: flag` lines | none |
`pr-review.yml@3180217:1227-1241` |
| report-lane-outcome (`$/` action) writes the lane-outcome record. It
uses no new secret, network call or exec, and keeps the same
`actions/github-script` pin | none |
`.github/actions/report-lane-outcome/action.yml@3180217:191` |
| `workflow_call` secrets, outputs, `on`, workflow permissions
(`contents: read`), job permissions (`contents: read`, `pull-requests:
write`, `id-token: write`) | unchanged | parsed at both SHAs |
| `maintenance-sync-standards.yml` | unchanged. The blob `93c4c18` is
the same at both SHAs | contents API |

There is no class (b), meaning a removed or renamed input that a
component
still passes, and no class (c), meaning a change that widens trust.

## Verification

- At this commit, `node --test components/runner-policy/*.test.mjs
components/claude-lanes/*.test.mjs`
  passes 391 of 391, `claude-lanes.test.sh` passes 86 of 86, and
  `repin-callers.test.sh` passes 165 of 165.
- I applied a simulated re-pin in a scratch worktree: all nine caller
pins moved
from `3a2c748` to `3180217`. On top of this commit, the same suites
pass, and
  so does `managed-files-guard.test.sh` (175 of 175). With this PR's
`policy.json` reverted, 5 runner-policy tests fail, including "every
managed
  target of a claude lane caller admits that caller".

## Related

- [#844](#844) is the
re-pin
  this PR unblocks.
- [#589](#589) set the
shape
  that #844's lockstep note names.
- [#885](#885)
registered
  `pr-review-cli` at the same tag.

### Owner decisions not taken here

- The allowed inputs are copied verbatim, so they still admit some
inputs that
no synced component passes: `incremental-review` and `model-args` on
both
  lanes, and `manifest`, `standards-ref` and `environment` on the sync
reusable. This keeps the copy-forward shape. It also keeps admitting any
consumer-owned caller that passes them. Narrowing them is a separate
decision.
- No component maps `fallback-claude-code-oauth-token`. Only the
`pr-review-cli`
contracts (v0.65.12 and later) allow `FALLBACK_CLAUDE_CODE_OAUTH_TOKEN`.
The
#844 re-pin alone therefore gives the `pr-review` and
`pr-review-security`
lanes no fallback attempt. Getting one takes a component change plus an
  allowed-secret addition.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@kyle-sexton kyle-sexton mentioned this pull request Oct 26, 2026
Merged
kyle-sexton added a commit that referenced this pull request Oct 26, 2026
@kyle-sexton @claude
feat(runner-policy): register the ci-workflows v0.65.15 intake-triage…
6081206 
… contract (#891)

No related issue: registers the reviewed contract for the ci-workflows
v0.65.15 release.

## Summary

This PR registers the [ci-workflows
v0.65.15](https://github.com/melodic-software/ci-workflows/releases/tag/v0.65.15)
`intake-triage.yml` contract at
`30b251532b2e9f7e0c4215e1dee5be0d3c688743`, so callers can pin to that
release. The release makes priority labels exclusive in the triage apply
step
([ci-workflows#896](melodic-software/ci-workflows#896)).

## Fix

- `policy.json`: the v0.65.15 `intake-triage.yml` entry copies its
v0.65.13 (`ba7af78d291f10bd75651857a0db2357c23df0fe`) entry forward. The
earlier pins stay.
- `README.md`: one sentence about the v0.65.15 contract.
- `runner-policy.test.mjs`: a test that the v0.65.15 entry equals the
v0.65.13 entry and that exactly one contract sits at the new sha.

## Verification

- `node --test components/runner-policy/runner-policy.test.mjs
components/claude-lanes/repin-policy-lockstep.test.mjs` passes 392 of
392; `npm run lint:runner-policy` passes.
- Parsed with a YAML library, `on.workflow_call` inputs, secrets and
outputs and every job's `permissions:` are identical between v0.65.13
and v0.65.15, except the `floor-label` input description ("applied
exactly one" became "picked exactly one"). Input names, types, defaults
and required flags are unchanged. The description edit is what makes the
auto-approval surface diff report "inputs changed".
- Left out: every other workflow, which this PR does not register.

## Related

-
[ci-workflows#896](melodic-software/ci-workflows#896)
is the change this release ships.
- [#885](#885)
registered v0.65.14, and this PR follows the same shape.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@kyle-sexton kyle-sexton mentioned this pull request Oct 28, 2026
Merged
kyle-sexton added a commit that referenced this pull request Oct 29, 2026
@kyle-sexton @claude
fix(runner-policy): approve pr-review-cli.yml v0.66.1 contract with s…
63cafbf 
…tatus job reads (#900)

Refs: melodic-software/claude-code-plugins#9635

## Summary

This PR registers the reviewed `pr-review-cli.yml` contract at the
[ci-workflows
v0.66.1](https://github.com/melodic-software/ci-workflows/releases/tag/v0.66.1)
tag (`20a822d73b6e2d7e21d48e609a01b427e0e161e7`), so callers can pin
that
release. Auto-approval declines it today: "jobPermissions changed since
the
previously reviewed ...pr-review-cli.yml@3180217". The change is

[ci-workflows#904](melodic-software/ci-workflows#904):
the status job adds `actions: read` and `checks: read` so the cost hold
can
read its earlier runs' check-run notices. The owner approved those
read-only
scopes for this lane (claude-code-plugins#9635, Q1(a)).

## Fix

- `policy.json`: the v0.66.1 `pr-review-cli.yml` entry copies its
v0.65.14
(`3180217`) entry forward unchanged. A hosted-only contract has no field
for
caller permissions (the schema refuses `minimumCallerPermissions`
without
`runnerInput`), so the reviewed change is recorded in the README and
test,
  not in the entry.
- `README.md`: one paragraph on the v0.66.1 contract and the reviewed
  permission change.
- `runner-policy.test.mjs`: a test that the v0.66.1 entry equals the
v0.65.14
  entry.

## Verification

- Surface diff of `pr-review-cli.yml` between `3180217` and `20a822d`
(comments excluded): the status job's `actions: read` and `checks: read`
  lines and one `STATUS_JOB` step env value. `on.workflow_call` inputs,
  secrets and `runs-on` do not change.
- `node --test components/runner-policy/runner-policy.test.mjs
components/claude-lanes/repin-policy-lockstep.test.mjs`:
  398 pass, 0 fail.
- `runner-policy.mjs --root <claude-code-plugins#10782 head d4b21de>`:
  - with this `policy.json`: `Runner policy passed.`
- with the currently synced `policy.json`: the two
`pr-review-cli.yml@20a822d`
    runner-target-contract findings that fail #10782's `lint-repo`.
- Left out: `pr-review-cli.yml@9a886d5` (v0.66.0). No caller pins it.

## Related

-
[claude-code-plugins#10782](melodic-software/claude-code-plugins#10782):
  repins the review callers to v0.66.1. Its `lint-repo` and `ci-status`
  fail on this missing contract and pass once it syncs.
- [#895](#895): the
claude-lanes
  re-pin to v0.66.0. It copies forward `pr-review.yml`,
  `pr-review-security.yml` and `maintenance-sync-standards.yml` but not
  `pr-review-cli.yml`.
- [#885](#885): the
v0.65.14
  `pr-review-cli.yml` registration, which this follows.
-
[ci-workflows#904](melodic-software/ci-workflows#904):
  the permission change reviewed here.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@kyle-sexton