[kyle-sexton]

No related issue: runner-policy contract for the claude-code-plugins intake move onto ci-workflows' run-claude-cli launcher (melodic-software/ci-workflows#784)

Hold: a human merges this.

Summary

claude-code-plugins' intake now calls ci-workflows intake-triage.yml at v0.51.0, which runs on the run-claude-cli launcher funded by the automations role. The caller passes the role's two secrets, AUTOMATIONS_CLAUDE_API_KEY and AUTOMATIONS_CLAUDE_CODE_OAUTH_TOKEN. The same-name rule for privileged contracts (from #140) refused that mapping, so the contract could not load.

Fix

• Security control change, owner-approved 2026-10-19. A contract with allowedCallerPermissions may map a secret to its own name, as before, or to its funding role's prefixed name, NAME: ${{ secrets.<ROLE>_NAME }}. The prefixed form is allowed only when:

  • the contract declares a literal role (lower kebab);
  • role is in its allowedInputs;
  • the caller passes role: as that exact literal.

  Any other rename is still refused, as are expressions and other prefixes. The role is a reviewed literal, never an expression. This lets several funding roles share one repository.

• Registers intake-triage.yml@f129f4c142d00ec3feacbf2b9102d327088504bf (v0.51.0) with role: automations. It is the v0.49.0 entry plus the role input, with the one OAuth secret replaced by the role's API key and subscription token. Permissions and routing are unchanged. The v0.49.0 entry stays until the caller repins.

• policy.schema.json gains the optional role property, and the README documents the rule.

Verification

node --test components/runner-policy/*.test.mjs: 319/319 pass. The new tests:

• a declared role's prefixed secret is accepted;
• another role's prefix is refused, and so is a prefix with no declared role;
• a declared role missing from allowedInputs is refused;
• a caller passing another role is refused;
• the v0.51.0 entry equals the v0.49.0 entry plus the role, its input and its secrets.

Related

• feat(intake-triage): run the intake lane on run-claude-cli ci-workflows#784 and feat(github-actions-conventions): mark pr unblock in use and retire update, fix-ci, address-feedback #781: the intake move and the launcher.
• feat(runner-policy): review privileged reusable callers #140: the same-name control this narrows.
• claude-code-plugins branch feat/intake-on-run-claude-cli: the caller, opened after this syncs.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T02:38:05.367533Z	0bcc13d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed 0bcc13dface6be3dd7805ab1f7ecdb26de638b6b: 0 finding(s), 0 as inline comments.

Security review: PR #811 at 0bcc13d

No security findings.

I read the diff (policy.json, policy.schema.json, runner-policy.mjs, tests, README) and the surrounding reusableWorkflowStatus enforcement path in runner-policy.mjs.

Role-named secrets. The check does not let a caller choose a secret name.

• validatePolicy accepts a role-prefixed secret expression only when the contract itself declares role. The prefix comes from that role, upper-snaked. Any other rename is still refused.
• The caller side is exactCanonicalMap(job.secrets, contract.allowedSecrets, …). It requires the caller's secrets: block to match the reviewed contract exactly, so the policy file fixes which secret expression a caller can pass.
• A contract that declares role must list role in allowedInputs. The caller must pass inputs.role as a strict !== literal match. An expression, such as ${{ inputs.x }} or ${{ github.event.* }}, cannot satisfy it.
• The role is added to reviewedContractSurface. A Dependabot SHA bump that changes the role is therefore not treated as an unchanged surface, and the README keeps secret-capable runner-input contracts out of the Dependabot auto-approval extension.

New intake-triage contract. It pins a 40-character SHA. It keeps the exact caller permissions (contents: read, issues: write). It maps only the two AUTOMATIONS_* secrets by whole named expression. It adds no secrets: inherit or wildcard path.

Residual note, not a finding. A role prefix lets a reviewed contract name any <ROLE>_<NAME> secret. That is bounded by human review of policy.json, and the same review already gates the existing same-name mapping. I did not independently confirm that SHA f129f4c… is the ci-workflows v0.51.0 tag. The sandbox blocked the gh api lookup. The PR marks sign-off as pending.

No instruction-surface deletions: no rule, hook or allowlist was removed or softened. I did not consult the instruction exception register, because no standing instruction was deleted.

[github-actions]

claude-review reviewed 0bcc13dface6be3dd7805ab1f7ecdb26de638b6b: 0 finding(s), 0 as inline comments.

No findings. I read the full diff, the PR context, and the surrounding runner-policy.mjs code. I did not run the tests myself. The PR's "319/319 pass" is author-claimed and unverified by me.

• Validation: validatePolicy accepts a secret mapped to its own name or to ${{ secrets.<ROLE>_NAME }}. The prefixed form is accepted only when a literal role is declared and role is in allowedInputs. Every other rename is still refused, and the generic whole-expression check still applies afterwards.
• Caller check: reusableWorkflowStatus requires inputs.role to equal the contract's role. An expression or another role therefore fails the strict comparison. The check runs after the secrets and allowedInputs checks.
• Auto-approval: reviewedContractSurface now includes role, so a Dependabot bump cannot change a contract's role without a human review. Contracts with allowedCallerPermissions are still declined for auto-approval.
• Schema: role is constrained to lower kebab, so toUpperCase().replaceAll("-", "_") cannot produce a collision.
• Policy entry: the v0.51.0 intake-triage entry matches the README text and the equality test against the v0.49.0 entry, and the v0.49.0 entry is kept.
• Tests: the new tests cover the accepted prefixed secret, another role's prefix, a prefix with no declared role, a declared role missing from allowedInputs, and a caller passing the wrong role.
• PR body: the body follows the contract (No related issue: line with a reason, plus Summary, Fix, Verification and Related sections).
• Closing issues: the PR closes none, so there are no acceptance criteria to check.
• Rules: the only path-scoped rule file, .claude/rules/pr-body-contract.md, covers PR bodies, not the changed files.