ci: route control-plane lanes through the governed selector

[kyle-sexton]

Wave 3 per-repo floor conversion (melodic-software/github-iac#78, 2026-07-16 owner override): converts every remaining hosted control-plane lane to governed selector routing — claude-code-plugins ends with ZERO runner-policy exceptions.

No linked issue.

What

• ci.yml: ci-status aggregate routes with if: ${{ !cancelled() }} (fails closed through execution on the hosted fallback, never by skipping); the workflow-schema files: list gains the two new callers.
• pr-title.yml: the required-check status wrapper routes to the fleet; semantic-pr pin bumped to 51012e2 with prerequisite-result (if: ${{ always() }} per the validator's fail-closed reporter contract).
• link-check.yml: select-runner added; pin bumped to the 3dfb184 runner-input variant; retired the CI_RUNNER_POLICY != self-hosted-only pause guard.
• New do-not-merge + pr-issue-linkage callers (Roll out do-not-merge-gate caller to all requires-ci repos ci-workflows#120 / feat(work-items): republish v2 plugin from post-seam provider-neutral core #121 rollout): pull_request_target + merge_group; execute on the hosted fallback until select-runner: admit pull_request_target and merge_group metadata-only events for fleet routing ci-workflows#130 admits those events.
• runner-policy.json: all 3 exceptions dropped → "exceptions": {}.

Verification

• Local runner-policy.mjs run (CI env parity): clean; the two new callers' contracts landed via the standards sync (chore: sync standards components #236) already merged to main.
• actionlint clean; every converted runs-on keeps the || 'ubuntu-24.04' fallback (epic decision 4).

Related

• melodic-software/github-iac#78 (epic — Wave 3)
• Roll out do-not-merge-gate caller to all requires-ci repos ci-workflows#120, Roll out pr-issue-linkage caller to all requires-ci repos ci-workflows#121, select-runner: admit pull_request_target and merge_group metadata-only events for fleet routing ci-workflows#130

🤖 Generated with Claude Code

https://claude.ai/code/session_01K3QehVwmWzkBLpKokNCkkt

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4621267c29

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 3m 57s —— View job

---

PR Review — ci: route control-plane lanes through the governed selector

• Gather context and understand request
• Read changed files (runner-policy.json, ci.yml, do-not-merge.yml, link-check.yml, pr-issue-linkage.yml, pr-title.yml)
• Validate runner-policy contract coverage for new workflows
• Review governed selector routing correctness
• Check fail-closed semantics and fallback logic
• Assess security posture and pin hygiene
• Post final review

---

Summary

The fleet-routing migration itself is structurally sound — fail-closed semantics are applied consistently and the design decisions are well-documented. However, there is one blocking gap that will cause the runner-policy CI lane to fail: the two new reusable workflow SHAs called from do-not-merge.yml and pr-issue-linkage.yml are absent from policy.json.

---

🔴 Blocking — Missing runner-policy contracts

Codex's P1 findings are confirmed.

do-not-merge.yml:51 calls:

melodic-software/ci-workflows/.github/workflows/do-not-merge-gate.yml@885302176345486ca6c2c392d83131f9b5389251

pr-issue-linkage.yml:50 calls:

melodic-software/ci-workflows/.github/workflows/pr-issue-linkage.yml@f7e94a80254fdca0aa85a600a07d784753b090e3

Neither SHA appears in .github/standards/runner-policy/policy.json's approvedReusableWorkflowContracts. The runner-policy.mjs validator (reusableWorkflowStatus, line ~857 of the script) will return approved: false with "the reusable workflow path@SHA has no reviewed runner-input contract" for both, failing the runner-policy CI lane.

The PR description states these contracts "landed via the standards sync (#236) already merged to main," but #236 does not appear in the branch's git ancestry — the most recent standards sync visible is b26444f (#232). This suggests #236 has not been merged yet, or the contracts weren't included in it.

Both callers follow the selectorResultInput pattern (passing prerequisite-result), which means auto-approval is explicitly declined by the validator even if matching basis SHAs existed (the code at line ~1620 of runner-policy.mjs declines any selectorResultInput contract from auto-approval because the fail-closed behavior cannot be proven via surface diff). These entries must be added explicitly to policy.json.

Required entries follow the same shape as the existing semantic-pr.yml@51012e2 contract:

"melodic-software/ci-workflows/.github/workflows/do-not-merge-gate.yml@885302176345486ca6c2c392d83131f9b5389251": {
  "routing": "runner-input",
  "runnerInput": "runner",
  "selectorResultInput": "prerequisite-result",
  "allowedInputs": ["runner", "prerequisite-result"],
  "allowedSecrets": {},
  "allowedCallerPermissions": {
    "pull-requests": "read"
  }
},
"melodic-software/ci-workflows/.github/workflows/pr-issue-linkage.yml@f7e94a80254fdca0aa85a600a07d784753b090e3": {
  "routing": "runner-input",
  "runnerInput": "runner",
  "selectorResultInput": "prerequisite-result",
  "allowedInputs": ["runner", "prerequisite-result"],
  "allowedSecrets": {}
}

(exact allowedCallerPermissions depend on what do-not-merge-gate.yml declares — pull-requests: read is required by the do-not-merge job at line 49, and the validator enforces that caller grants match the contract's allowedCallerPermissions)

Resolution: Either merge standards sync #236 first (if it truly contains these contracts), or add them to policy.json in this PR.

---

✅ What looks correct

ci-status fail-closed routing (ci.yml:356–388)

Adding select-runner to ci-status's needs and switching from runs-on: ubuntu-24.04 to ${{ needs.select-runner.outputs.runner || 'ubuntu-24.04' }} with if: ${{ !cancelled() }} is the correct pattern. The !cancelled() guard (not always()) means a cancelled workflow won't run the aggregate, but it still runs on selector failure (falling through to the hosted fallback) and the case-based loop correctly rejects any non-success result — including skipped. The old always() was removed correctly; always() would include cancelled state, but !cancelled() is sufficient here since a cancelled required check is treated as pending, not a skip-as-success.

pr-title.yml pattern upgrade (pr-title.yml:36–71)

The shift from if: ${{ !cancelled() && needs.select-runner.result == 'success' }} to if: ${{ always() }} on validate-pr-title (coupled with the prerequisite-result input to semantic-pr@51012e2) correctly delegates the fail-closed decision into the reusable. The pr-title wrapper's change from if: ${{ always() && !cancelled() }} to if: ${{ !cancelled() }} is also correct — always() && !cancelled() was redundant (always() implies !cancelled() is possible but doesn't need the AND).

link-check.yml retirement of the pause guard (link-check.yml:24–46)

The CI_RUNNER_POLICY != 'self-hosted-only' pause guard was a workaround for issue-writing on self-hosted runners. The new link-check.yml@3dfb184 contract in policy.json accepts a runner input with an allowedCallerPermissions entry including issues: write, which is the correct upgrade path. The condition if: ${{ !cancelled() && needs.select-runner.result == 'success' }} (not always()) is appropriate here since link-check is advisory and doesn't need to materialize a required check on selector failure.

pull_request_target usage in new callers

The security justification in the comments is sound: do-not-merge reads PR label metadata via API; pr-issue-linkage reads PR body from the event payload. Neither executes head-branch code. Using pull_request_target is the correct trigger choice for base-branch–evaluated gates.

runner-policy.json — clean exceptions removal

Dropping all 3 exceptions (runner-policy.json) correctly reflects that ci-status, link-check, and pr-title no longer need hosted-only carveouts.

---

🟡 Minor — select-runner SHA version skew

New workflows (do-not-merge.yml, pr-issue-linkage.yml, link-check.yml) pin select-runner at cdc5917 (2026-07-16), while ci.yml and pr-title.yml pin at 3415de3 (2026-07-13). Both are in approvedSelectorReferencesByRepositoryOwner, so this won't fail policy. But aligning all callers to the same SHA would make future Dependabot bumps simpler to review.

---

Bottom line

Merge is blocked on the missing policy.json contracts. Everything else — the routing semantics, fail-closed patterns, security model, and permission scope — is well-executed. Once the contract gap is resolved (either by landing #236 first or adding entries here), this is clean to merge.