From 4c4723465914b3a5a5e7d0d95d2cad879a61a993 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Wed, 28 Oct 2026 18:58:20 -0400 Subject: [PATCH] fix(runner-policy): approve pr-review-cli.yml v0.66.1 contract with status job reads Register the reviewed pr-review-cli.yml contract at the ci-workflows v0.66.1 tag (20a822d73b6e2d7e21d48e609a01b427e0e161e7). Since v0.65.14 the workflow's only surface change is the status job's permissions block, which adds actions: read and checks: read so the cost hold can read its earlier runs' check-run notices (ci-workflows#904). Both are read-only scopes the callers already grant, and a hosted-only contract records no caller permissions, so the entry copies v0.65.14 forward unchanged. Auto-approval declines on that jobPermissions change, so the entry is added by hand. Co-authored-by: Claude Opus 5.5 --- components/runner-policy/README.md | 8 ++++++- components/runner-policy/policy.json | 22 +++++++++++++++++++ .../runner-policy/runner-policy.test.mjs | 12 ++++++++++ 3 files changed, 41 insertions(+), 1 deletion(-) diff --git a/components/runner-policy/README.md b/components/runner-policy/README.md index 491fabbe..17eaa120 100644 --- a/components/runner-policy/README.md +++ b/components/runner-policy/README.md @@ -1461,7 +1461,13 @@ At the v0.65.14 tag `3180217076b19bbdfccc43026c7f91c604da673d`, the pr-review-cl contract copies its v0.65.13 entry forward unchanged: the release reports a failed "Isolate the runner" install as install-failed (ci-workflows#893), with no input, secret, permission or routing change. -At the same tag, the claude-lanes re-pin moves `pr-review`, +At the v0.66.1 tag `20a822d73b6e2d7e21d48e609a01b427e0e161e7`, the pr-review-cli +contract copies its v0.65.14 entry forward unchanged. The one surface change is +reviewed here: since ci-workflows#904 the status job's `permissions:` block adds +`actions: read` and `checks: read` to read its earlier runs' cost hold notices. +Both are read-only scopes its callers already grant, and a hosted-only contract +records no caller permissions. Inputs, secrets and routing are unchanged. +At the v0.65.14 tag, the claude-lanes re-pin moves `pr-review`, `pr-review-security` and `maintenance-sync-standards` off v0.55.0. `pr-review` and `pr-review-security` copy their v0.62.0 entries forward verbatim: since v0.62.0 each only gives the isolation install step an id and diff --git a/components/runner-policy/policy.json b/components/runner-policy/policy.json index 26e79e29..1cb5b577 100644 --- a/components/runner-policy/policy.json +++ b/components/runner-policy/policy.json @@ -1409,6 +1409,28 @@ "FALLBACK_CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.FALLBACK_CLAUDE_CODE_OAUTH_TOKEN }}" } }, + "melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@20a822d73b6e2d7e21d48e609a01b427e0e161e7": { + "routing": "hosted-only", + "fixedRunsOn": ["ubuntu-24.04"], + "allowedInputs": [ + "lane", + "publish", + "role", + "model-args", + "allowed-bot-sender-ids", + "allowed-author-ids", + "docs-only-paths", + "incremental-review", + "cli-version", + "hold-label", + "hold-paths" + ], + "allowedSecrets": { + "CLAUDE_API_KEY": "${{ secrets.REVIEWS_CLAUDE_API_KEY }}", + "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.REVIEWS_CLAUDE_CODE_OAUTH_TOKEN }}", + "FALLBACK_CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.FALLBACK_CLAUDE_CODE_OAUTH_TOKEN }}" + } + }, "melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2": { "routing": "runner-input", "runnerInput": "runner", diff --git a/components/runner-policy/runner-policy.test.mjs b/components/runner-policy/runner-policy.test.mjs index e53f4e74..148e92e7 100644 --- a/components/runner-policy/runner-policy.test.mjs +++ b/components/runner-policy/runner-policy.test.mjs @@ -10343,6 +10343,18 @@ test("the pr-review-cli contract at the v0.65.14 tag copies its v0.65.13 entry u assert.deepEqual(contracts[key(sha)], contracts[key(previous)]); }); +// v0.66.1's status job adds actions: read and checks: read (ci-workflows#904), +// read-only scopes a hosted-only contract does not record; inputs, secrets and +// routing are unchanged, so the entry copies v0.65.14 forward. +test("the pr-review-cli contract at the v0.66.1 tag copies its v0.65.14 entry unchanged", () => { + const contracts = BASE_POLICY.approvedReusableWorkflowContracts; + const key = (sha) => `melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@${sha}`; + const sha = "20a822d73b6e2d7e21d48e609a01b427e0e161e7"; + const previous = "3180217076b19bbdfccc43026c7f91c604da673d"; + assert.ok(contracts[key(previous)]); + assert.deepEqual(contracts[key(sha)], contracts[key(previous)]); +}); + // At v0.65.14 the claude-lanes re-pin leaves v0.55.0. Both review workflows // differ from v0.62.0 only in the isolation install step's id and its // install-failed class; maintenance-sync-standards is byte-identical to