ci: route claude-review through the governed selector to the review tier - #158
Merged
Conversation
The dedicated select-review job resolves the capped review-tier label (CI_REVIEW_SELF_HOSTED_LABEL) through the governed selector, and the review job takes its runner from that output under the reviewed caller-permission waiver, so automated review runs on the fleet's review scale set instead of hosted compute. The privileged-control-plane hosted exception is retired with the routing it justified. Co-Authored-By: Claude Fable 5 (1M context) <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4cc367ed48
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
!cancelled() overrides GitHub's skip propagation, so a selector job that hard-fails before emitting a runner output would otherwise fall through to the hosted fallback and run the privileged review job on hosted compute, violating the fail-closed routing contract. Requiring needs.select-review.result == 'success' keeps the route fail-closed. Co-Authored-By: Claude Fable 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
select-reviewjob resolving${{ vars.CI_REVIEW_SELF_HOSTED_LABEL }}through the governed selector (pinnedselect-runner@cdc5917c).reviewjob's runner from the selector output to the fleet claude-review reusable (pinnedclaude-review@4dbb0dfc), permissions exactly per the reviewed caller-perms waiver.privileged-control-planehosted exception forclaude-review.yml#review.Why
Campaign A of the zero-hosted directive (epic melodic-software/github-iac#78): automated review moves to the dedicated capped review tier. Shape matches this repo's own runner-policy E2E fixture (#155);
runner-policy.mjs --root .passes locally with zero findings.Supersedes the closed draft #142.
🤖 Generated with Claude Code
https://claude.ai/code/session_01K3QehVwmWzkBLpKokNCkkt