From aa6b1b151def7c608fac159feb368ec63c2f126e Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Mon, 26 Oct 2026 05:36:38 -0400 Subject: [PATCH] feat(runner-policy): register the claude-lanes contracts for ci-workflows v0.65.14 The claude-lanes re-pin (#844) moves pr-review, pr-review-security and maintenance-sync-standards off v0.55.0. Register each at the v0.65.14 tag 3180217 as a verbatim copy of its newest entry: the review lanes from v0.62.0, whose only change since is the isolation install step's id and its install-failed class, and maintenance-sync-standards from v0.55.0, byte-identical at both tags. No input, secret, caller permission or routing widens. The v0.65.14 pr-review-cli test no longer counts every contract at the tag, which this registration adds to. Co-Authored-By: Claude Opus 5.5 --- components/runner-policy/README.md | 10 +++++ components/runner-policy/policy.json | 41 +++++++++++++++++++ .../runner-policy/runner-policy.test.mjs | 25 ++++++++++- 3 files changed, 75 insertions(+), 1 deletion(-) diff --git a/components/runner-policy/README.md b/components/runner-policy/README.md index daee337e..5a4d7c37 100644 --- a/components/runner-policy/README.md +++ b/components/runner-policy/README.md @@ -1461,6 +1461,16 @@ At the v0.65.14 tag `3180217076b19bbdfccc43026c7f91c604da673d`, the pr-review-cl contract copies its v0.65.13 entry forward unchanged: the release reports a failed "Isolate the runner" install as install-failed (ci-workflows#893), with no input, secret, permission or routing change. +At the same tag, the claude-lanes re-pin moves `pr-review`, +`pr-review-security` and `maintenance-sync-standards` off v0.55.0. +`pr-review` and `pr-review-security` copy their v0.62.0 entries forward +verbatim: since v0.62.0 each only gives the isolation install step an id and +classifies its failure as `install-failed`, and their `workflow_call` inputs, +secrets, outputs, workflow and job permissions and triggers are unchanged. +The `credential-name` and `fallback-credential-name` inputs (v0.61.0) stay +unallowed because no caller passes them. `maintenance-sync-standards` copies +its v0.55.0 entry forward verbatim; its file is byte-identical at both tags. +No input, secret, caller permission, or routing changes. The Zizmor contract at `de50a08b6093d231519ee7a4c9371db76c0a7e1e` uses its reviewed `runner` input and checksum-verified native Linux binary, so enrolled consumers may route that advisory lane onto the managed fleet diff --git a/components/runner-policy/policy.json b/components/runner-policy/policy.json index 9104539c..ce6b7428 100644 --- a/components/runner-policy/policy.json +++ b/components/runner-policy/policy.json @@ -703,6 +703,25 @@ "id-token": "write" } }, + "melodic-software/ci-workflows/.github/workflows/pr-review.yml@3180217076b19bbdfccc43026c7f91c604da673d": { + "routing": "runner-input", + "runnerInput": "runner", + "allowedInputs": [ + "runner", + "incremental-review", + "allowed-bot-sender-ids", + "model-args", + "allowed-author-ids" + ], + "allowedSecrets": { + "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}" + }, + "allowedCallerPermissions": { + "contents": "read", + "pull-requests": "write", + "id-token": "write" + } + }, "melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2": { "routing": "runner-input", "runnerInput": "runner", @@ -911,6 +930,19 @@ "id-token": "write" } }, + "melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@3180217076b19bbdfccc43026c7f91c604da673d": { + "routing": "runner-input", + "runnerInput": "runner", + "allowedInputs": ["runner", "incremental-review", "allowed-bot-sender-ids", "model-args"], + "allowedSecrets": { + "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}" + }, + "allowedCallerPermissions": { + "contents": "read", + "pull-requests": "write", + "id-token": "write" + } + }, "melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@8778094736e414233110f3e0d6d9948628ba77b5": { "routing": "hosted-only", "fixedRunsOn": ["ubuntu-24.04"], @@ -1462,6 +1494,15 @@ "STANDARDS_SYNC_APP_PRIVATE_KEY": "${{ secrets.STANDARDS_SYNC_APP_PRIVATE_KEY }}" } }, + "melodic-software/ci-workflows/.github/workflows/maintenance-sync-standards.yml@3180217076b19bbdfccc43026c7f91c604da673d": { + "routing": "runner-input", + "runnerInput": "runner", + "allowedInputs": ["runner", "manifest", "standards-ref", "dry-run", "targets", "environment"], + "allowedSecrets": { + "STANDARDS_SYNC_APP_CLIENT_ID": "${{ secrets.STANDARDS_SYNC_APP_CLIENT_ID }}", + "STANDARDS_SYNC_APP_PRIVATE_KEY": "${{ secrets.STANDARDS_SYNC_APP_PRIVATE_KEY }}" + } + }, "melodic-software/ci-workflows/.github/workflows/pr-audit-workflows.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2": { "routing": "runner-input", "runnerInput": "runner", diff --git a/components/runner-policy/runner-policy.test.mjs b/components/runner-policy/runner-policy.test.mjs index d07fb9f9..733a4da1 100644 --- a/components/runner-policy/runner-policy.test.mjs +++ b/components/runner-policy/runner-policy.test.mjs @@ -57,6 +57,7 @@ const REPINE_LANE_SHA_V0_59_1 = "8bd4d7f963a06627dd2d551ffcd8d9db5e6b881b"; const REPINE_LANE_SHA_V0_60_0 = "82ca5ca9be6e18a1addb7986eae15689339aedbc"; const REPINE_LANE_SHA_V0_61_0 = "164c2809f6150429b6f24d4a2777bb377af953d9"; const REPINE_LANE_SHA_V0_62_0 = "2fe38c031867900824c164e33a140a335ed9ecf0"; +const REPINE_LANE_SHA_V0_65_14 = "3180217076b19bbdfccc43026c7f91c604da673d"; const STANDARDS_SYNC_SHA = "35f2684ac953794b854bac1959df00e74eeca1d9"; const REUSABLE_PATH = "melodic-software/ci-workflows/.github/workflows/osv-scanner.yml"; const REUSABLE_REFERENCE = `${REUSABLE_PATH}@${SHA}`; @@ -10340,7 +10341,29 @@ test("the pr-review-cli contract at the v0.65.14 tag copies its v0.65.13 entry u const previous = "ba7af78d291f10bd75651857a0db2357c23df0fe"; assert.ok(contracts[key(previous)]); assert.deepEqual(contracts[key(sha)], contracts[key(previous)]); - assert.equal(Object.keys(contracts).filter((k) => k.endsWith(`@${sha}`)).length, 1); +}); + +// At v0.65.14 the claude-lanes re-pin leaves v0.55.0. Both review workflows +// differ from v0.62.0 only in the isolation install step's id and its +// install-failed class; maintenance-sync-standards is byte-identical to +// v0.55.0. No interface widens, so each entry is its newest predecessor verbatim. +test("the claude-lanes contracts at the v0.65.14 tag copy their previous entries forward verbatim", () => { + const contracts = BASE_POLICY.approvedReusableWorkflowContracts; + const previousShas = { + "pr-review": REPINE_LANE_SHA_V0_62_0, + "pr-review-security": REPINE_LANE_SHA_V0_62_0, + "maintenance-sync-standards": REPINE_LANE_SHA_V0_55_0, + }; + for (const [reusable, previousSha] of Object.entries(previousShas)) { + const workflowPath = `melodic-software/ci-workflows/.github/workflows/${reusable}.yml`; + const previous = contracts[`${workflowPath}@${previousSha}`]; + assert.ok(previous, `expected a ${previousSha} contract for ${reusable}`); + assert.deepEqual( + contracts[`${workflowPath}@${REPINE_LANE_SHA_V0_65_14}`], + previous, + `${reusable} at the v0.65.14 tag is not a verbatim copy of its previous entry`, + ); + } }); // Convergence as a property, never as a hardcoded SHA. The daily