feat(runner-policy): review the retirement-aligned drift-check contract

[kyle-sexton]

Why

melodic-software/github-iac#112 bumps its pulumi-version-drift-check.yml pin to ci-workflows 15aefd8 (the commit whose deploy-guard contract matches post-retirement Pulumi OIDC trust — melodic-software/ci-workflows#96). The runner-policy engine allowlists reusable-workflow contracts by exact path@SHA, so the consumer lane rejects the new pin until it is reviewed here (Codex confirmed this on github-iac#112; the Runner policy check fails there today).

What

• policy.json: add the pulumi-version-drift-check.yml@15aefd8 contract (identical shape: hosted-only, fixedRunsOn: ubuntu-24.04)
• runner-policy.test.mjs: assert the new reviewed reference alongside the existing one (same staged-set pattern the selector allowlist already uses)

Cleanup contract

The @99ac2f8 drift-check entry stays only until github-iac#112 merges; a follow-up removes it the same day — no lingering legacy references.

Verification

• node --test components/runner-policy/runner-policy.test.mjs: 101 pass / 0 fail

🤖 Generated with Claude Code

https://claude.ai/code/session_01JLfjHY8PY6ozhgZPiuHKik

[claude]

Claude finished @kyle-sexton's task in 1m 6s —— View job

---

PR Review

• Gather context (CLAUDE.md, PR diff, changed files)
• Review policy.json changes
• Review runner-policy.test.mjs changes
• Post findings

---

Overall: LGTM — clean, minimal, well-tested.

policy.json

The new entry at policy.json#L95–100 is correctly shaped and correctly positioned:

"melodic-software/ci-workflows/.github/workflows/pulumi-version-drift-check.yml@15aefd8799e8a8b5ffdfcc183dcbfcbf58044481": {
  "routing": "hosted-only",
  "allowedInputs": [],
  "allowedSecrets": {},
  "fixedRunsOn": ["ubuntu-24.04"]
}

• Shape matches the existing @99ac2f8 entry exactly — correct for a drift-check workflow that takes no inputs and no secrets.
• Security posture is tight: hosted-only routing, empty secrets, pinned to ubuntu-24.04. No regression from the previous contract.
• Placement follows the pattern of other dual-SHA entries (e.g., zizmor.yml, semantic-pr.yml), keeping the old @99ac2f8 pin alive for the rollout window.
• The old entry's presence until github-iac#112 merges is intentional and documented — no action needed here.

runner-policy.test.mjs

The additions at runner-policy.test.mjs#L24–25 and #L1018–1023 are correct:

• RETIREMENT_ALIGNED_GUARD_SHA (15aefd8799e8a8b5ffdfcc183dcbfcbf58044481) matches the policy.json key exactly.
• The deepEqual assertion verifies all four contract fields — routing, inputs, secrets, runner — mirroring the existing PULUMI_DRIFT_REUSABLE_REFERENCE assertion directly above it. This is the right pattern.
• Constants defined at module scope, consistent with PRODUCTION_SHA, FAIL_CLOSED_SEMANTIC_PR_SHA, etc.

No issues found. The change is additive-only, follows established conventions, and the test suite is kept in sync.