[kyle-sexton]

Closes #927

Summary

A contract-only ci-status re-run fails closed when GitHub's jobs API lags on re-run jobs, which left a red ci-status on heads whose full run passed. ci-workflows v0.69.0 contains the aggregate-results fix (ci-workflows#929); this PR adopts it.

Fix

• Re-pin every melodic-software/ci-workflows/.github/actions/... pin in pr-require-checks.yml and the two managed-files-guard caller components to v0.69.0 (94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3), using components/claude-lanes/repin-callers.sh apply, the script the repin workflow runs.
• Pass step-name: Aggregate lane results to aggregate-results, matching the step's name:.
• Raise the ci-status job timeout-minutes from 3 to 8: the action can wait about 337 s, and a job that times out ends cancelled, which counts as red. v0.69.0's action.yml recommends a calling-job timeout of 7 for this configuration.

Verification

• actionlint, zizmor --offline on pr-require-checks.yml, npm run lint:runner-policy, lint:concurrency-policy, lint:github-actions-conventions and harness/shell/run-tests.sh components/claude-lanes/repin-callers.test.sh all pass.
• The acceptance re-run of a failed contract-only ci-status can only be observed after merge.

Related

• fix(aggregate-results): carry a full run's success past jobs-API lag on re-runs ci-workflows#929, feat(runner-policy): register ci-workflows v0.60.0 intake and review contracts #842, fix(runner-policy): auto-approve only ci-workflows release commits #883, fix(lefthook-typescript): pass --no-errors-on-unmatched to the biome lane #914
• ci-workflows v0.69.0

🤖 Generated with Claude Code

https://claude.ai/code/session_01VcupojYKhHyDni9LuAXBuX

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-31T14:28:38.500117Z	c2072a6	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed c2072a6cf1d7bb63ec8b0b34d9b75d7e9083c858: 0 finding(s), 0 as inline comments.

No findings. I read the full diff and the PR context for closing issue #927.

• Pins: No 0691df79… pin is left in the repo. Every ci-workflows action pin in pr-require-checks.yml and the two managed-files-guard callers moves to 94f22d06… (v0.69.0). I did not confirm the SHA against the v0.69.0 tag. The gh api call needed approval and was not run, so the SHA-to-tag match is unverified here.
• step-name: It is set to Aggregate lane results. That matches the aggregate step's name: at .github/workflows/pr-require-checks.yml:1086.
• Timeout: ci-status goes from 3 to 8 minutes. That covers the roughly 337 s worst case the new comment describes. The PR says v0.69.0's action.yml recommends 7 for this configuration, which I did not check.
• Acceptance criteria: The first two are met by the diff. The third, a re-run of a failed contract-only ci-status turning green, can only be observed after merge. The PR says so.
• Verification: I ran no tests or linters. The lint and test results in the PR body are the author's claims and unverified.
• Embedded instructions: None found in the PR context.
• Manifests: The diff changes no plugin manifests.

[github-actions]

claude-security-review reviewed c2072a6cf1d7bb63ec8b0b34d9b75d7e9083c858: 0 finding(s), 0 as inline comments.

Security review: no findings

critical-findings: 0

The diff covers 3 files. It moves every melodic-software/ci-workflows action pin from 0691df79… (v0.68.0) to 94f22d06… (v0.69.0) in pr-require-checks.yml and in both managed-files-guard workflows.

• Pins: The old SHA no longer appears anywhere in the tree except pr.diff, so no step is left on a mixed pin. Both new pins are full 40-character SHAs with a version comment. I could not check that 94f22d06… is the commit behind the v0.69.0 tag. The gh api call needed approval and was not run, so that mapping is unverified. The pin is to an owned org repo, and a pin or repin ceremony is one of the owner's named friction holds, so I did not treat it as a finding.
• Permissions and triggers: No permissions: block, trigger, if: condition, secret or token scope changed. The check-contract and aggregate-results steps still receive ${{ github.token }}, as before.
• New input: aggregate-results now gets step-name: Aggregate lane results. It is a literal string and carries no attacker-controlled data.
• Timeout: The ci-status timeout-minutes goes from 3 to 8. This is a bound on the job's run time and opens no path to a leak, compromise or charge. The comment explains the bound.
• Merge hold and trust controls: The ci-status job in pr-require-checks.yml is a merge-hold step, so I read its whole change. The treat-skipped-as: fail setting is unchanged, and nothing in the diff weakens or removes a hold. Behaviour inside the v0.69.0 action is outside this diff.
• Manifests and instructions: The diff touches no plugin manifests, instruction surfaces, CODEOWNERS, .gitmodules or trusted-actor files.