chore(claude-lanes): re-pin the review lanes to ci-workflows v0.10.2 - #1990
Merged
Conversation
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
Claude has reviewed this PR 3 times. The lane skips further automatic reviews after 5; deleting this comment resets the count. |
Both lane callers here are `locally-owned` in the standards sync manifest —
this is the org's one PUBLIC caller target, and runner-policy forbids a public
repository from referencing the governed select-runner indirection — so the
pins are bumped in this repository rather than arriving by sync.
v0.10.2 is `e94438746c300b02385a7f8a2a2dcd19a7f4ad4a`. Neither reusable
changes its input names, secret key set, `runs-on`, or caller-permission
surface against v0.9.1, so the callers need no edit beyond the pin.
BLOCKED on the policy sync. `.github/standards/runner-policy/policy.json` is a
MANAGED materialization and is deliberately not touched here; it still approves
only `c136b27f`, so the gate fails closed on the new SHA:
runner-target-contract: the reusable workflow path@SHA has no reviewed
runner-input contract (auto-approval declined: inputs changed since the
previously reviewed ...@1d3762c2)
melodic-software/standards#337 adds the v0.10.2 contracts. This branch goes
green only once that merges and its sync PR delivers the updated policy.json
here.
Ref: melodic-software/standards#337
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
kyle-sexton
force-pushed
the
chore/repin-claude-lanes-v0.10.2
branch
from
August 8, 2026 07:41
cce06a8 to
47a6401
Compare
kyle-sexton
added a commit
to melodic-software/claude-lane-sandbox
that referenced
this pull request
Aug 8, 2026
) ## Summary Re-pins this fixture's Claude review caller from ci-workflows v0.9.1 (`c136b27f`) to v0.10.2 (`e94438746c300b02385a7f8a2a2dcd19a7f4ad4a`). The workflow's own header records why this is a hand re-pin: > LOCALLY OWNED — not a sync-manifest target and not a standards-managed file. > This fixture is deliberately outside the caller wave […] Repin it by hand > when the fleet pin moves. ## Contract surface The reusable's input names, secret key set, `runs-on`, and caller-permission surface are unchanged against v0.9.1, so the caller needs no edit beyond the pin line. ## No policy dependency Unlike the claude-code-plugins caller bump, this repository carries no `.github/standards/runner-policy/` materialization and no runner-policy gate, so this PR has no ordering dependency on the standards policy approval and can merge on its own. ## Related No linked issue. This PR closes nothing. Related, not closed: - melodic-software/standards#337 — the policy approval and component re-pin. - melodic-software/claude-code-plugins#1990 — the locally-owned caller bump (blocked on the sync). - melodic-software/ci-workflows#355 — the change released as v0.10.2. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
kyle-sexton
added a commit
to melodic-software/standards
that referenced
this pull request
Aug 8, 2026
…337) ## Summary Re-pins the Claude review and security lane callers from ci-workflows v0.9.1 (`c136b27f`) to v0.10.2 (`e94438746c300b02385a7f8a2a2dcd19a7f4ad4a`), and approves that revision in `runner-policy`. The scheduled `claude-lanes-repin` job has resolved v0.10.2 on every run since 2026-08-05 and opened nothing — no re-pin App credential is provisioned, so it warns and directs a re-pin by hand: > `components/claude-lanes/` is behind ci-workflows v0.10.2, but no re-pin App > credential is configured, so no pull request was opened. […] Until then, > re-pin by hand. This is that hand re-pin. The component rewrite was produced by `repin-callers.sh apply v0.10.2 <sha>` — the same subject the scheduled job runs — rather than by editing the pins directly, so the script's own count guard covered the rewrite. ## Contract surface Both lane reusables carry an **unchanged** workflow-call contract against v0.9.1: - identical input names on `claude-review.yml` and `claude-security-review.yml` - identical secret key set and `required:` flags - no change to `runs-on` or to any caller-permission surface - `select-runner.yml` is **byte-identical** between the two tags The new `approvedReusableWorkflowContracts` entries are therefore verbatim copies of their `c136b27f` predecessors under a new SHA key, and the selector reference stays owner-scoped to `melodic-software`. The lane deltas are internal to the reusables: the review lane moves its inline-comment tool grant out of the caller-replaceable `claude-args` default into the compose step (so replacing that default can no longer drop it), adds a scoped `Bash(gh pr diff:*)` grant in its place, routes findings to line-anchored review comments, and narrows its retry gate to count real assistant turns. The one security-relevant delta — routing every line-anchorable finding through the inline-comment tool widens the surface on which untrusted diff content reaches a rendered comment carrying a one-click-applicable suggestion block — sits inside the reusable, not on the contract, and is recorded in the runner-policy README alongside the `contents: read` precedent. ## Scope `standards` is the manifest **source**, not a sync target, so its repo-local `.github/workflows/claude-review.yml` is re-pinned here alongside the components. - Managed consumers (dotfiles, github-iac, medley, provisioning) receive the bump through the normal sync cascade — not hand-edited. - The one `locally-owned` caller set (claude-code-plugins) is re-pinned in its own repository. - `claude-lane-sandbox` is a hand-wired fixture and is re-pinned separately. ## Test plan - `components/runner-policy`: `node --test runner-policy.test.mjs` — 242/242 pass. The selector-allowlist assertion required the new revision's constant (`INLINE_COMMENT_LANE_SHA`) and list entry; that is the only test change. - `npm run lint:runner-policy` (the self-gate CI runs) — `Runner policy passed.` - `harness/shell/run-tests.sh` — 23 passed, 0 failed, 3 skipped. This includes `components/claude-lanes/claude-lanes.test.sh` (30/30), which materializes the re-pinned component into every managed consumer and actionlints the result. ## Related No linked issue. This PR closes nothing. Related, not closed: - melodic-software/ci-workflows#355 — the change released as v0.10.2. - melodic-software/claude-code-plugins#1990 — the locally-owned caller bump, which is BLOCKED until this PR merges and its sync PR delivers the updated `policy.json` there. - melodic-software/claude-lane-sandbox#3 — the hand-wired fixture bump (independent; no policy dependency). Operator note: no `CLAUDE_LANES_REPIN_APP_CLIENT_ID` / `CLAUDE_LANES_REPIN_APP_PRIVATE_KEY` is provisioned, which is why this re-pin is manual. Provisioning them would let the scheduled job open this PR itself. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Aug 8, 2026
kyle-sexton
added a commit
that referenced
this pull request
Aug 12, 2026
) Fixes #1995 Since the ci-workflows v0.10.2 repin (#1990), `.github/claude-security-paths` is matched as root-anchored gitignore patterns via `git check-ignore`, not GitHub Actions `paths:` syntax. The header now states gitignore semantics and that `!`, `?`, and `+` are forbidden. ## Related - #1990 --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Kyle Sexton <kyle-sexton@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Warning
Do not merge before melodic-software/standards#337 has merged AND its sync
PR has landed here. CI on this branch is expected RED until then — see
"Ordering" below. The
do-not-mergelabel is applied deliberately.Summary
Re-pins both Claude lane callers from ci-workflows v0.9.1 (
c136b27f) tov0.10.2 (
e94438746c300b02385a7f8a2a2dcd19a7f4ad4a).These two callers are
locally-ownedin the standards sync manifest, notmanaged — this is the org's one PUBLIC caller target, and runner-policy forbids
a public repository from referencing the governed
select-runnerindirection —so the pins are bumped here rather than arriving by sync.
Neither reusable changes its input names, secret key set,
runs-on, orcaller-permission surface against v0.9.1, so no caller edit beyond the pin is
required.
Ordering — this PR is blocked
.github/standards/runner-policy/policy.jsonis a MANAGED materialization andis deliberately not touched here. It still approves only
c136b27f, andthe gate fails closed on the new SHA. Measured locally on this branch:
The same command on the unmodified base exits
0, so this is caused by the pinbump and not pre-existing.
melodic-software/standards#337 adds the v0.10.2 contracts to the policy source.
Merging it triggers the sync cascade (
sync.ymlruns onpushtomain),which delivers the updated
policy.jsonhere. Once that sync PR merges, re-runCI on this branch and it goes green.
Test plan
node .github/standards/runner-policy/runner-policy.mjs --root .— currentlyexits 1 by design (above); expected to exit 0 after the policy sync lands.
uses:pin lines.Related
No linked issue.
This PR closes nothing. Related, not closed:
this PR depends on.
(independent; no policy dependency).