build(ci): bump select-runner to liveness revision

[kyle-sexton]

Summary

Bumps the select-runner reusable-workflow pin in this repo's own CI to the liveness routing revision of the central selector (melodic-software/ci-workflows#86, commit 3415de3). That revision was already approved owner-scoped in the runner policy by #100, so this PR changes only the single consumer pin line in .github/workflows/ci.yml — the zizmor.yml reference and components/runner-policy/ are untouched.

Part of melodic-software/github-iac#79 (epic #78).

Verification

• node --test components/runner-policy/runner-policy.test.mjs: 95 pass, 0 fail
• node --test components/lefthook-dotnet/dotnet-format-staged.test.mjs: 12 pass, 0 fail
• GITHUB_REPOSITORY=melodic-software/standards npm run lint:runner-policy: "Runner policy passed."
• git diff origin/main --stat: only the single ci.yml line changed

🤖 Generated with Claude Code

https://claude.ai/code/session_01EPDbXgonTuFwFwdTtHaCmw

---

Note

Low Risk
Single pinned SHA bump for CI runner selection only; policy approval for this ref is already owner-scoped, with no application or security logic changes.

Overview
Updates the select-runner reusable workflow pin in .github/workflows/ci.yml from de50a08 to 3415de3, adopting the central selector’s liveness routing revision from melodic-software/ci-workflows.

No other workflow pins, runner-policy files, or job wiring change—the same with/secrets contract and ubuntu-24.04 fallback behavior stay as documented in the workflow header.

^{Reviewed by Cursor Bugbot for commit df89fa1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_95be6423-4023-4ac1-b69c-0beb8fabe6d5)

[claude]

Claude finished @kyle-sexton's task in 55s —— View job

---

PR Review

• Gather context
• Read CLAUDE.md / REVIEW.md guidelines (none present)
• Review the changed file
• Post findings

---

Summary

This is a minimal, well-scoped pin bump: a single line in .github/workflows/ci.yml advancing the select-runner reusable-workflow reference from de50a08 (2026-07-12) to 3415de3 (2026-07-13). No issues found. The change is correct and safe to merge.

---

Review

.github/workflows/ci.yml L28

The updated pin is correctly formatted:

• Full 40-character SHA (3415de3ff2fafee40e4d087eb6073d2f6952b595) — secure, not a mutable tag or branch ref.
• Inline comment matches (# 3415de3 2026-07-13) — short SHA and date both correct.
• permissions: {} on the select-runner job is unchanged and correct.
• secrets: and with: inputs are untouched.

Policy gate alignment: The runner-policy job (L192–L217) runs on ubuntu-24.04 directly (independent of the liveness selector) and validates this repo's own CI config. The PR description confirms all three policy/test suites pass against the new revision — consistent with PR #100 having already approved this SHA owner-scoped.

zizmor.yml pin deliberately held: L451 still references the prior SHA (de50a08). This is intentional per the PR description — zizmor.yml is a separate workflow with its own revision timeline, and the PR scope is limited to the select-runner consumer. No inconsistency here.

No CLAUDE.md or REVIEW.md found in this repository, so no repo-specific review criteria to check against beyond the above.

Verdict: Approved. Clean, minimal, correctly-formed pin bump with pre-approved policy coverage and passing verification.

[cursor]

Risk: low. Cursor Bugbot skipped (usage limit reached), so automated review did not complete and I cannot approve. Human review is needed; no additional reviewers were assigned because the sole repo contributor is the PR author.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}