ci: pin ci-workflows reusables and selector at v0.6.0

[kyle-sexton]

No linked issue.

Repins every ci-workflows selector and reusable-workflow reference to ec91c3433a8c3c0a7ebbdd239286e5a6a25eeec5 (v0.6.0), registered in the runner policy by melodic-software/standards#175 and distributed by the just-merged standards-sync PR. Gate callers gain merge_group / same-repo pull_request_target selector routing; the claude-review lane picks up per-head concurrency and the superseded-head guard.

Verification

• Local dogfood: GITHUB_REPOSITORY=melodic-software/claude-code-plugins node .github/standards/runner-policy/runner-policy.mjs --root . passes against the feat(claude-config-audit): add permission-hygiene grant audit + convention #175 policy.
• No residual pre-v0.6.0 ci-workflows workflow pins (grep-verified).

Related

• feat(runner-policy): register the ci-workflows v0.6.0 revision standards#175 (policy registration)
• melodic-software/github-iac#78 (epic — Campaign A)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 22c2582aba

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 1m 47s —— View job

---

PR Review

• Gather context
• Examine changed files
• Review for correctness, security, and alignment with guidelines
• Post findings

---

Summary

Clean, well-scoped mechanical pin bump. All 12 reusable-workflow and selector references are consistently updated to ec91c343 (v0.6.0) across all 6 workflow files. The change is internally consistent with no version drift between callers, the policy-registration ordering is correct (standards#175 registered the SHA, the sync PR distributed it, then this PR pins), and the Codex P1 finding was correctly resolved by Kyle's inline comment.

Findings

Correctness — no issues

All six files × two refs each = 12 pins, every one at the same ec91c3433a8c3c0a7ebbdd239286e5a6a25eeec5. The inline comments (# ec91c34 2026-07-17) are accurate. The scope is correctly limited to reusable workflows and the selector — composite action refs (c2654182…) are untouched, as expected for this PR.

Security — no issues

Pinning to full commit SHAs (not branch names or tags) is the correct supply-chain practice. All privileged callers (do-not-merge, pr-issue-linkage) continue to use pull_request_target + merge_group triggers with appropriate permissions: scopes. claude-review.yml correctly passes only the one named secret rather than secrets: inherit.

Codex P1 — correctly resolved

The Codex finding that the new SHA wasn't yet registered in the runner policy was valid in isolation, but the registration landed upstream before this PR (standards#175 + standards-sync), and Kyle's response documents this correctly. The gate evaluates the merge ref, which already included the synced policy.json. No action needed.

Pre-existing observation (not introduced by this PR)

The gitleaks composite action at ci.yml:72 is pinned to f2d5e06757201f2fce187096a2c6fa805836c3d2 — a third SHA distinct from both the old batch (c2654182) and the new batch (ec91c343), and it's the only composite-action pin in the file that carries no inline comment annotation (no abbreviated SHA, no date). Since gitleaks is a security-sensitive step, the missing annotation makes it harder to audit when this pin was last reviewed. This predates the PR; worth tidying in a follow-up.

Verdict

No issues with the changes in this PR. The pin bump is complete, consistent, and correctly sequenced. ✓