ci: bump do-not-merge-gate pin to the gh-CLI-free revision by kyle-sexton · Pull Request #332 · melodic-software/claude-code-plugins

kyle-sexton · 2026-07-18T08:19:49Z

Summary

Bumps the do-not-merge-gate reusable pin to ci-workflows 90f1c54 (melodic-software/ci-workflows#144): the label refetch now runs via actions/github-script instead of gh api, so the required-context no longer fails exit 127: gh: command not found on self-hosted runners without the gh CLI (observed on #330).

This PR's own do-not-merge / do-not-merge check still runs the OLD pin from main (pull_request_target evaluates the base-branch definition) and may fail the same way — expected until this merges; the check is not in the required set.

No linked issue

Verification

actionlint clean

🤖 Generated with Claude Code

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1f4f21851a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

claude · 2026-07-18T10:47:46Z

Claude finished @kyle-sexton's task in 1m 51s —— View job

PR Review

Gather context
Read changed file
Check runner-policy allowlist
Post review findings

Summary

The change is a targeted, correct pin bump: .github/workflows/do-not-merge.yml L51 replaces ec91c343... with 90f1c549.... The motivation (removing the gh api call that fails with exit 127 on self-hosted runners) is sound, the inline comment is accurate, and no secrets or permissions changed.

The rest of the file is unchanged and correct: the || 'ubuntu-24.04' fallback, the if: ${{ always() }} on the gate, and the prerequisite-result passthrough are all consistent with the existing contract shape.

Findings

Blocker — policy.json is missing the new SHA contract

.github/standards/runner-policy/policy.json L248–253 has an approvedReusableWorkflowContracts entry for the old do-not-merge-gate.yml@ec91c343... but none for do-not-merge-gate.yml@90f1c549....

The auto-approval path in runner-policy.mjs (L1772–1778) explicitly declines any workflow whose matching basis contract carries selectorResultInput:

if (matchedBasis.contract.selectorResultInput) {
  diagnostics.set(reference,
    `… fail-closed selector-result reporter; its required-check behavior cannot be proven unchanged by this surface diff, so auto-approval is declined`);
  continue;
}

The do-not-merge-gate contract is exactly that shape — "selectorResultInput": "prerequisite-result" — so auto-approval is ineligible. runner-policy.mjs will reject the unrecognized @90f1c549 reference at CI time, causing the aggregate CI gate to fail.

Fix: add a new entry to approvedReusableWorkflowContracts in policy.json with the same terms as the ec91c343 entry but for the new SHA:

"melodic-software/ci-workflows/.github/workflows/do-not-merge-gate.yml@90f1c54935203fa31b5b3d1f41531228be2c2b7f": {
  "routing": "runner-input",
  "runnerInput": "runner",
  "selectorResultInput": "prerequisite-result",
  "allowedInputs": ["runner", "prerequisite-result", "label"],
  "allowedSecrets": {}
}

Fix this →

This confirms the Codex P1 finding. The blocker is consistent with the policy's design intent: contracts with selectorResultInput are explicitly excluded from auto-approval and must be manually reviewed before any SHA bump lands.

…I-free SHA (#190) ## Summary Advances the reviewed runner-input contract key for the `do-not-merge-gate` reusable from `8853021` to `90f1c54` (melodic-software/ci-workflows#144 — label refetch via `actions/github-script` instead of `gh api`, fixing exit-127 failures on self-hosted runners without the gh CLI). Input surface is unchanged: `runner`, `prerequisite-result`, `label`; no secrets; same routing (`runner-input`). SHA re-review only. Consumer follow-up: melodic-software/claude-code-plugins#332 bumps the workflow pin and is blocked on this entry syncing. No linked issue ## Related - melodic-software/ci-workflows#144 (the gate fix) - melodic-software/claude-code-plugins#332 (blocked consumer pin bump) ## Verification - `policy.json` parses; biome/typos/gitleaks/editorconfig pre-commit lanes pass; entry identical apart from the SHA 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Fable 5 (1M context) <noreply@anthropic.com>

The prior pin ran `gh api` on the caller-selected runner; the self-hosted image ships no gh CLI, so the check failed exit 127 with no blocking label present (observed on #330). The bumped revision refetches labels via actions/github-script (ci-workflows#144). Co-Authored-By: Claude Fable 5 (1M context) <noreply@anthropic.com>

claude · 2026-07-18T14:20:47Z

Claude finished @kyle-sexton's task in 1m 30s —— View job

PR Review

Gather context
Read changed file
Verify policy.json has new SHA (prior blocker from Codex P1 finding)
Post review findings

Summary

The workflow change itself is correct: do-not-merge.yml L51 bumps only the do-not-merge-gate ref from ec91c343... to 90f1c549..., with the inline comment updated accordingly. The select-runner pin (L31) is correctly left unchanged. The if: ${{ always() }}, || 'ubuntu-24.04' fallback, and prerequisite-result passthrough are all intact and correct.

The branch is one commit ahead of main with a single-line change — exactly as expected for a pin bump.

Findings

Blocker — policy.json still does not have the new SHA

Contrary to the resolution comment ("sync PR #334 delivered it to policy.json"), I've verified the current branch: policy.json contains entries for do-not-merge-gate.yml at 8853021... and ec91c343... but not at 90f1c54935203fa31b5b3d1f41531228be2c2b7f.

The runner-policy checker explicitly declines auto-approval for workflows whose contract carries selectorResultInput (which this gate uses). An unrecognized SHA will cause the CI gate to fail.

The PR description notes this PR was rebased onto the main that includes PR #334, but #334's sync did not add the new contract — the SHA is absent from the file in the working tree right now.

Fix needed — add to approvedReusableWorkflowContracts in policy.json immediately after the existing ec91c343 do-not-merge-gate entry (around L257–263):

"melodic-software/ci-workflows/.github/workflows/do-not-merge-gate.yml@90f1c54935203fa31b5b3d1f41531228be2c2b7f": {
  "routing": "runner-input",
  "runnerInput": "runner",
  "selectorResultInput": "prerequisite-result",
  "allowedInputs": ["runner", "prerequisite-result", "label"],
  "allowedSecrets": {}
}

Fix this →

## What Move the ci-workflows compatibility pin `c36e881` (v0.5.0) → `90f1c54` (v0.6.1) across all 20 workflow references, the pin-metadata test constants, and `release/dependencies.json`. ## Why v0.5.0's `do-not-merge-gate` shells `gh` in its label refetch; v0.6.1 carries the github-script rewrite (melodic-software/ci-workflows#144) plus the ubuntu-slim fallback removal (melodic-software/ci-workflows#141). This repo's Product policy gate requires every ci-workflows reference to move as one reviewed pin with a canonical `@<sha> # vX.Y.Z` comment, so the org's narrow gate-only bump pattern converges here as a full pin move instead. ## Verification All 28 `.github/scripts` tests pass locally, including the pin-metadata inventory (20 references, one SHA, one release). This PR's own do-not-merge run resolves the bumped ref. `git grep c36e881` = 0. v0.5.0..v0.6.1 caller impact reviewed: new `link-check` inputs all carry defaults; fallback runner labels and gate internals changed inside the reusables only. No caller contract changes. ## Related No linked issue. Sibling bumps: melodic-software/provisioning#167, melodic-software/claude-code-plugins#332, melodic-software/dotfiles#220; gate fix melodic-software/ci-workflows#144. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01YZxBP1B8Hf7ZRaqDrP6ma9 --------- Co-authored-by: Claude Fable 5 (1M context) <noreply@anthropic.com>

…ge-gate-pin

kyle-sexton · 2026-07-18T20:09:43Z

Parked pending the public-posture CI migration — see the migration issue. Merge order once it lands: #345 → #332 → #344.

chatgpt-codex-connector Bot reviewed Jul 18, 2026

View reviewed changes

Comment thread .github/workflows/do-not-merge.yml

kyle-sexton mentioned this pull request Jul 18, 2026

fix(runner-policy): re-review do-not-merge-gate contract at the gh-CLI-free SHA melodic-software/standards#190

Merged

kyle-sexton force-pushed the chore/bump-do-not-merge-gate-pin branch from 1f4f218 to fcee948 Compare July 18, 2026 13:26

kyle-sexton mentioned this pull request Jul 18, 2026

ci: move the ci-workflows compatibility pin to v0.6.1 as one set melodic-software/ci-runner#96

Merged

Merge remote-tracking branch 'origin/main' into chore/bump-do-not-mer…

4e98c72

…ge-gate-pin

kyle-sexton merged commit e61cb5d into main Jul 18, 2026
18 of 20 checks passed

kyle-sexton deleted the chore/bump-do-not-merge-gate-pin branch July 18, 2026 19:11

This was referenced Jul 18, 2026

Migrate CI to the public-repo posture (hosted-only, no governed selector) #347

Closed

chore: sync standards components #345

Closed

kyle-sexton mentioned this pull request Jul 18, 2026

build: fix the stale ci-workflows Dependabot ignore comment #344

Merged

Navigation Menu

Uh oh!

ci: bump do-not-merge-gate pin to the gh-CLI-free revision - #332

ci: bump do-not-merge-gate pin to the gh-CLI-free revision#332
kyle-sexton merged 2 commits into
mainfrom
chore/bump-do-not-merge-gate-pin

kyle-sexton commented Jul 18, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

claude Bot commented Jul 18, 2026 •

edited

Loading

Uh oh!

claude Bot commented Jul 18, 2026 •

edited

Loading

Uh oh!

Uh oh!

kyle-sexton commented Jul 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

kyle-sexton commented Jul 18, 2026

Summary

Related

Verification

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

claude Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review

Summary

Findings

Uh oh!

claude Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review

Summary

Findings

Uh oh!

Uh oh!

kyle-sexton commented Jul 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

claude Bot commented Jul 18, 2026 •

edited

Loading

claude Bot commented Jul 18, 2026 •

edited

Loading