[kyle-sexton]

Refs: melodic-software/claude-code-plugins#9635

Summary

Every re-pin pull request whose lockstep copies a runner-policy contract forward fails
check-typescript, because repin-policy-lockstep.mjs writes policy.json with
JSON.stringify(policy, null, 2). That spreads short arrays such as allowedInputs over one
line per item, and Biome's format check (File content differs from formatting output) rejects
the file. #895 failed this way at 09f6f35.

Fix

maintenance-repin-ci-workflows.yml gains a step after the lockstep step, gated on the same
steps.repin.outputs.changed == 'true'. It runs npm ci --ignore-scripts at the root and
node_modules/.bin/biome format --write --config-path=components/biome/biome.json on
components/runner-policy/policy.json. The root lockfile pins @biomejs/biome 2.5.15, the
version check-typescript's biome action derives from the root package.json, and the config
is the one check-typescript passes. No new action and no new permission.

Verification

• Ran the step's commands on chore(claude-lanes): re-pin callers to ci-workflows v0.66.0 #895's unformatted policy.json (09f6f35): the output is
  byte-identical to the hand-formatted fix cc1d460, on which check-typescript and ci-status
  pass.
• actionlint and zizmor (offline) report nothing for the workflow.
• No existing test covers this workflow's step list; repin-callers.test.sh covers the script.

Related

• chore(claude-lanes): re-pin callers to ci-workflows v0.66.0 #895, the re-pin pull request this failure blocked.
• fix(runner-policy): approve pr-review-cli.yml v0.66.1 contract with status job reads #900, which also edits components/runner-policy/policy.json.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T01:14:58.111533Z	70452a0	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed 70452a0fa9debd307f349d9627fffba9dc8560a6: 0 finding(s), 0 as inline comments.

No findings. The PR adds one step, Format runner-policy with Biome, to .github/workflows/maintenance-repin-ci-workflows.yml. It runs after the lockstep step and under the same steps.repin.outputs.changed == 'true' gate.

What I checked in the repository:

• Biome version: root package.json and package-lock.json both pin @biomejs/biome 2.5.15, so npm ci at the root installs it.
• Config: components/biome/biome.json is the config pr-require-checks.yml passes to the biome action. components/runner-policy is in that action's paths, so policy.json is covered by the format check.
• Source of the failure: repin-policy-lockstep.mjs:323 writes policy.json with JSON.stringify(policy, null, 2), which matches the failure the PR describes.
• Other writes: the script's only other write (line 94) appends to a file with flag: "a". The lockstep script writes no other formatted file that needs this step.
• Placement: the step runs before create-pull-request, which only stages the listed add-paths, so the root node_modules is not committed.
• Ordering and flags: --ignore-scripts avoids the lefthook install script. set -euo pipefail is set.
• Existing steps: the earlier npm ci --prefix components/runner-policy and the new root npm ci install into different directories, so they do not conflict.

I did not run the step myself: node_modules/.bin/biome is not installed in this sandbox. The PR's claim that the output is byte-identical to the hand-formatted fix (cc1d460) is the author's and unverified by me.

--config-path points at a root: false config rather than the root biome.jsonc, which extends it. That matches what the CI biome action is given, and the author reports it works.

No manifest items, no closing issue (the PR uses Refs:), and no paved-path rows apply. The one rule file, .claude/rules/pr-body-contract.md, is satisfied: the body has the Refs: line and the four required sections.

[github-actions]

claude-security-review reviewed 70452a0fa9debd307f349d9627fffba9dc8560a6: 0 finding(s), 0 as inline comments.

No security issues found in PR #901 at 70452a0.

The PR adds one step to .github/workflows/maintenance-repin-ci-workflows.yml. It runs npm ci --ignore-scripts at the repo root, then biome format --write on components/runner-policy/policy.json.

• What the step runs: The checkout is pinned to the default branch (ref: steps.default-branch.outputs.name, persist-credentials: false). So the lockfile and the Biome binary come from main, not from a dispatch ref or a fork. The root package-lock.json pins @biomejs/biome 2.5.15 with an integrity hash.
• Install scripts: --ignore-scripts blocks install-time lifecycle scripts.
• Credentials: The new step runs before the "Mint the re-pin App token" step. The App secrets reach only the mint step's with:, and the job-level env carries only the boolean HAS_APP_CREDENTIAL. The new step has no secret or token in its environment. The job's permissions: stays contents: read.
• Inputs and outputs: The formatter takes fixed paths, with no ${{ }} interpolation of event data. It reads only the repo's own Biome config and one JSON file. create-pull-request still limits what is committed through add-paths, which names only components/runner-policy/policy.json under runner-policy. node_modules/ is gitignored, so the install cannot leak into the commit.
• Controls checked: This workflow is not one of the listed trust controls. The change does not widen the trusted-actor list, the token scope, the kill switch, the merge holds or the signer.

Manifest items: none hit. No plugin manifests changed.

critical-findings: 0