chore(claude-lanes): re-pin the review lanes to ci-workflows v0.10.2 - #337
Merged
Conversation
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 80af7f1e60
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
## Summary The scheduled `claude-lanes-repin` job has resolved v0.10.2 every day since 2026-08-05 and opened nothing: no re-pin App credential is provisioned, so it warns and directs a re-pin by hand. This is that hand re-pin, with the component rewrite performed by `repin-callers.sh apply` rather than by editing the pins directly. v0.10.2 is `e94438746c300b02385a7f8a2a2dcd19a7f4ad4a` (lightweight tag, ref points straight at the commit). ## Contract surface Both lane reusables carry an unchanged workflow-call contract against v0.9.1: identical input names, identical secret key set and required-ness, and no change to `runs-on` or the caller-permission surface. `select-runner.yml` is byte-identical between the two tags. The new `approvedReusableWorkflowContracts` entries are therefore verbatim copies of their `c136b27f` predecessors under a new SHA key, and the selector reference is owner-scoped as before. The lane deltas are internal to the reusables: the review lane moves its inline-comment tool grant out of the caller-replaceable `claude-args` default into the compose step, adds a scoped `Bash(gh pr diff:*)` grant, routes findings to line-anchored review comments, and narrows its retry gate to count real assistant turns. ## Scope `standards` is the manifest source, not a sync target, so its repo-local `.github/workflows/claude-review.yml` is re-pinned here alongside the components. The managed consumers (dotfiles, github-iac, medley, provisioning) receive the bump through the normal sync cascade; the one locally-owned caller set (claude-code-plugins) is re-pinned in its own repository. Ref: melodic-software/ci-workflows#355 Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
kyle-sexton
force-pushed
the
chore/repin-claude-lanes-v0.10.2
branch
from
August 8, 2026 07:40
80af7f1 to
dd08011
Compare
kyle-sexton
added a commit
to melodic-software/claude-code-plugins
that referenced
this pull request
Aug 8, 2026
Both lane callers here are `locally-owned` in the standards sync manifest —
this is the org's one PUBLIC caller target, and runner-policy forbids a public
repository from referencing the governed select-runner indirection — so the
pins are bumped in this repository rather than arriving by sync.
v0.10.2 is `e94438746c300b02385a7f8a2a2dcd19a7f4ad4a`. Neither reusable
changes its input names, secret key set, `runs-on`, or caller-permission
surface against v0.9.1, so the callers need no edit beyond the pin.
BLOCKED on the policy sync. `.github/standards/runner-policy/policy.json` is a
MANAGED materialization and is deliberately not touched here; it still approves
only `c136b27f`, so the gate fails closed on the new SHA:
runner-target-contract: the reusable workflow path@SHA has no reviewed
runner-input contract (auto-approval declined: inputs changed since the
previously reviewed ...@1d3762c2)
melodic-software/standards#337 adds the v0.10.2 contracts. This branch goes
green only once that merges and its sync PR delivers the updated policy.json
here.
Ref: melodic-software/standards#337
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
kyle-sexton
added a commit
to melodic-software/claude-lane-sandbox
that referenced
this pull request
Aug 8, 2026
) ## Summary Re-pins this fixture's Claude review caller from ci-workflows v0.9.1 (`c136b27f`) to v0.10.2 (`e94438746c300b02385a7f8a2a2dcd19a7f4ad4a`). The workflow's own header records why this is a hand re-pin: > LOCALLY OWNED — not a sync-manifest target and not a standards-managed file. > This fixture is deliberately outside the caller wave […] Repin it by hand > when the fleet pin moves. ## Contract surface The reusable's input names, secret key set, `runs-on`, and caller-permission surface are unchanged against v0.9.1, so the caller needs no edit beyond the pin line. ## No policy dependency Unlike the claude-code-plugins caller bump, this repository carries no `.github/standards/runner-policy/` materialization and no runner-policy gate, so this PR has no ordering dependency on the standards policy approval and can merge on its own. ## Related No linked issue. This PR closes nothing. Related, not closed: - melodic-software/standards#337 — the policy approval and component re-pin. - melodic-software/claude-code-plugins#1990 — the locally-owned caller bump (blocked on the sync). - melodic-software/ci-workflows#355 — the change released as v0.10.2. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The v0.10.2 allowlist entry raises the approved selector revisions to thirteen total, ten of them owner-scoped; the README inventory still said twelve and nine. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HCJfVqDNYt92YRyvKUMgYW
kyle-sexton
added a commit
to melodic-software/claude-code-plugins
that referenced
this pull request
Aug 8, 2026
…1990) > [!WARNING] > **Do not merge before melodic-software/standards#337 has merged AND its sync > PR has landed here.** CI on this branch is expected RED until then — see > "Ordering" below. The `do-not-merge` label is applied deliberately. ## Summary Re-pins both Claude lane callers from ci-workflows v0.9.1 (`c136b27f`) to v0.10.2 (`e94438746c300b02385a7f8a2a2dcd19a7f4ad4a`). These two callers are `locally-owned` in the standards sync manifest, not managed — this is the org's one PUBLIC caller target, and runner-policy forbids a public repository from referencing the governed `select-runner` indirection — so the pins are bumped here rather than arriving by sync. Neither reusable changes its input names, secret key set, `runs-on`, or caller-permission surface against v0.9.1, so no caller edit beyond the pin is required. ## Ordering — this PR is blocked `.github/standards/runner-policy/policy.json` is a MANAGED materialization and is deliberately **not** touched here. It still approves only `c136b27f`, and the gate fails closed on the new SHA. Measured locally on this branch: ``` $ node .github/standards/runner-policy/runner-policy.mjs --root . .github/workflows/claude-review.yml#review: runner-target-contract: the reusable workflow path@SHA has no reviewed runner-input contract (auto-approval declined: inputs changed since the previously reviewed ...@1d3762c2) .github/workflows/claude-security-review.yml#security-review: runner-target-contract: the reusable workflow path@SHA has no reviewed runner-input contract (auto-approval declined: inputs changed since the previously reviewed ...@66073e58) exit 1 ``` The same command on the unmodified base exits `0`, so this is caused by the pin bump and not pre-existing. melodic-software/standards#337 adds the v0.10.2 contracts to the policy source. Merging it triggers the sync cascade (`sync.yml` runs on `push` to `main`), which delivers the updated `policy.json` here. Once that sync PR merges, re-run CI on this branch and it goes green. ## Test plan - `node .github/standards/runner-policy/runner-policy.mjs --root .` — currently exits 1 by design (above); expected to exit 0 after the policy sync lands. - No other repository check is affected: the change is two `uses:` pin lines. ## Related No linked issue. This PR closes nothing. Related, not closed: - melodic-software/standards#337 — the policy approval and component re-pin this PR depends on. - melodic-software/ci-workflows#355 — the change released as v0.10.2. - melodic-software/claude-lane-sandbox#3 — the hand-wired fixture bump (independent; no policy dependency). Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Aug 8, 2026
kyle-sexton
added a commit
that referenced
this pull request
Aug 9, 2026
…344) Re-pins the claude-lanes components and the repo-local caller from v0.10.2 (`e9443874`) to v0.11.0 (`ee96bd28a43eebfa06b61aee8b518cc5b1b195b3`), and extends the runner-policy allowlist for the new revision. ## What the new revision carries Everything ci-workflows merged since v0.10.2: validation-skip visibility for the review lane (A1/A2, its #387/#389), the security lane failing closed on a validation self-skip (its #392), and the drop-proof inline-comment compose step in the security lane (its #395). Contract check between the tags: no caller-facing input/secret surface changed shape — the security lane's `claude-args` input DEFAULT moved its inline-comment grant into an unconditional compose step (effective grants identical, verified empirically on that PR's own run), and `select-runner.yml` is byte-identical between the tags. ## Runner-policy lockstep - Selector allowlist: `select-runner.yml@ee96bd28…` added to the owner-scoped list (revision pins move together even though the file is unchanged). - Reusable contract entries added for both lanes at the new SHA; the retained prior-revision entries keep managed consumers green until the sync cascade delivers their repins. - `runner-policy.test.mjs` exhaustive assertions updated to match. ## Verification - `node --test components/runner-policy/runner-policy.test.mjs` — 242 pass, 0 fail; `npm run lint:runner-policy` — "Runner policy passed." - `harness/shell/run-tests.sh` — all pass (one machine-local golangci-lint cache failure reproduced identically on main, cleared by `golangci-lint cache clean`, and never touched this diff's files). ## Related No linked issue. For reference: melodic-software/ci-workflows v0.11.0 release; precedent PR #337 (the v0.10.2 repin). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01HCJfVqDNYt92YRyvKUMgYW Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Re-pins the Claude review and security lane callers from ci-workflows v0.9.1
(
c136b27f) to v0.10.2 (e94438746c300b02385a7f8a2a2dcd19a7f4ad4a), andapproves that revision in
runner-policy.The scheduled
claude-lanes-repinjob has resolved v0.10.2 on every run since2026-08-05 and opened nothing — no re-pin App credential is provisioned, so it
warns and directs a re-pin by hand:
This is that hand re-pin. The component rewrite was produced by
repin-callers.sh apply v0.10.2 <sha>— the same subject the scheduled jobruns — rather than by editing the pins directly, so the script's own count
guard covered the rewrite.
Contract surface
Both lane reusables carry an unchanged workflow-call contract against
v0.9.1:
claude-review.ymlandclaude-security-review.ymlrequired:flagsruns-onor to any caller-permission surfaceselect-runner.ymlis byte-identical between the two tagsThe new
approvedReusableWorkflowContractsentries are therefore verbatimcopies of their
c136b27fpredecessors under a new SHA key, and the selectorreference stays owner-scoped to
melodic-software.The lane deltas are internal to the reusables: the review lane moves its
inline-comment tool grant out of the caller-replaceable
claude-argsdefaultinto the compose step (so replacing that default can no longer drop it), adds a
scoped
Bash(gh pr diff:*)grant in its place, routes findings toline-anchored review comments, and narrows its retry gate to count real
assistant turns. The one security-relevant delta — routing every
line-anchorable finding through the inline-comment tool widens the surface on
which untrusted diff content reaches a rendered comment carrying a
one-click-applicable suggestion block — sits inside the reusable, not on the
contract, and is recorded in the runner-policy README alongside the
contents: readprecedent.Scope
standardsis the manifest source, not a sync target, so its repo-local.github/workflows/claude-review.ymlis re-pinned here alongside thecomponents.
bump through the normal sync cascade — not hand-edited.
locally-ownedcaller set (claude-code-plugins) is re-pinned in itsown repository.
claude-lane-sandboxis a hand-wired fixture and is re-pinned separately.Test plan
components/runner-policy:node --test runner-policy.test.mjs— 242/242pass. The selector-allowlist assertion required the new revision's constant
(
INLINE_COMMENT_LANE_SHA) and list entry; that is the only test change.npm run lint:runner-policy(the self-gate CI runs) —Runner policy passed.harness/shell/run-tests.sh— 23 passed, 0 failed, 3 skipped. This includescomponents/claude-lanes/claude-lanes.test.sh(30/30), which materializesthe re-pinned component into every managed consumer and actionlints the
result.
Related
No linked issue.
This PR closes nothing. Related, not closed:
which is BLOCKED until this PR merges and its sync PR delivers the updated
policy.jsonthere.(independent; no policy dependency).
Operator note: no
CLAUDE_LANES_REPIN_APP_CLIENT_ID/CLAUDE_LANES_REPIN_APP_PRIVATE_KEYis provisioned, which is why this re-pinis manual. Provisioning them would let the scheduled job open this PR itself.