From ed197d51a801b0bf83d62bdac813fc2fccc1e2a4 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Wed, 28 Oct 2026 19:38:39 -0400
Subject: [PATCH] feat(runner-policy): register the ci-workflows v0.66.1
 pr-review-cli contract

The v0.66.1 tag adds actions: read and checks: read to the pr-review-cli
status job (ci-workflows#904), which declines surface-diff auto-approval.
The hosted-only contract records no job permissions, so the entry copies
the v0.65.14 entry forward unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 components/runner-policy/README.md            |  9 ++++++++
 components/runner-policy/policy.json          | 22 +++++++++++++++++++
 .../runner-policy/runner-policy.test.mjs      | 15 +++++++++++++
 3 files changed, 46 insertions(+)

diff --git a/components/runner-policy/README.md b/components/runner-policy/README.md
index 491fabbe..633e2b1b 100644
--- a/components/runner-policy/README.md
+++ b/components/runner-policy/README.md
@@ -1483,6 +1483,15 @@ renames the review lanes' fallback secret slot from
 `fallback-claude-code-oauth-token` to that name (ci-workflows#897), so a
 caller maps the central fallback subscription under its own name. The lane
 retries once on it after a usage limit only. No permission or routing change.
+At the v0.66.1 tag `20a822d73b6e2d7e21d48e609a01b427e0e161e7`, the
+pr-review-cli contract copies its v0.65.14 entry forward unchanged: the
+release has the status job take a cost decision's decided head from this
+lane's earlier check-run notices (ci-workflows#904), so that job's
+permissions add `actions: read` and `checks: read` and its hold step takes a
+`STATUS_JOB` env built from the `lane` input. The contract records no job
+permissions, and a hosted-only contract checks no caller permissions, so the
+callers' read grants need no entry. No input, secret, write permission or
+routing change.
 The Zizmor contract at `de50a08b6093d231519ee7a4c9371db76c0a7e1e`
 uses its reviewed `runner` input and checksum-verified native Linux binary, so
 enrolled consumers may route that advisory lane onto the managed fleet
diff --git a/components/runner-policy/policy.json b/components/runner-policy/policy.json
index 26e79e29..1cb5b577 100644
--- a/components/runner-policy/policy.json
+++ b/components/runner-policy/policy.json
@@ -1409,6 +1409,28 @@
         "FALLBACK_CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.FALLBACK_CLAUDE_CODE_OAUTH_TOKEN }}"
       }
     },
+    "melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@20a822d73b6e2d7e21d48e609a01b427e0e161e7": {
+      "routing": "hosted-only",
+      "fixedRunsOn": ["ubuntu-24.04"],
+      "allowedInputs": [
+        "lane",
+        "publish",
+        "role",
+        "model-args",
+        "allowed-bot-sender-ids",
+        "allowed-author-ids",
+        "docs-only-paths",
+        "incremental-review",
+        "cli-version",
+        "hold-label",
+        "hold-paths"
+      ],
+      "allowedSecrets": {
+        "CLAUDE_API_KEY": "${{ secrets.REVIEWS_CLAUDE_API_KEY }}",
+        "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.REVIEWS_CLAUDE_CODE_OAUTH_TOKEN }}",
+        "FALLBACK_CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.FALLBACK_CLAUDE_CODE_OAUTH_TOKEN }}"
+      }
+    },
     "melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2": {
       "routing": "runner-input",
       "runnerInput": "runner",
diff --git a/components/runner-policy/runner-policy.test.mjs b/components/runner-policy/runner-policy.test.mjs
index e53f4e74..af06e39f 100644
--- a/components/runner-policy/runner-policy.test.mjs
+++ b/components/runner-policy/runner-policy.test.mjs
@@ -10554,3 +10554,18 @@ test("the pr-review and pr-review-security contracts at the v0.65.16 tag add onl
   }
   assert.equal(Object.keys(contracts).filter((k) => k.endsWith(`@${sha}`)).length, 2);
 });
+
+// v0.66.1 adds actions: read and checks: read to the pr-review-cli status job
+// (ci-workflows#904). The hosted-only contract records no job permissions, so
+// the entry copies its v0.65.14 entry forward unchanged.
+test("the pr-review-cli contract at the v0.66.1 tag copies its v0.65.14 entry forward unchanged", () => {
+  const contracts = BASE_POLICY.approvedReusableWorkflowContracts;
+  const key = (sha) => `melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@${sha}`;
+  const sha = "20a822d73b6e2d7e21d48e609a01b427e0e161e7";
+  const prior = contracts[key(REPINE_LANE_SHA_V0_65_14)];
+  assert.ok(prior);
+  assert.deepEqual(contracts[key(sha)], prior);
+  assert.equal(contracts[key(sha)].routing, "hosted-only");
+  assert.equal(contracts[key(sha)].allowedCallerPermissions, undefined);
+  assert.equal(Object.keys(contracts).filter((k) => k.endsWith(`@${sha}`)).length, 1);
+});