[kyle-sexton]

No related issue: the org's GITHUB_TOKEN bucket for pull_request jobs ran dry three times on 2026-10-23, and this repins both review lanes to the release that cuts their API spend.

Summary

pr-review-hosted.yml and pr-review-security-hosted.yml now call pr-review-cli.yml at 6d6cb798e7cb7560a0f9327d8a22398961c23b31 (v0.64.2) instead of v0.64.1.

Fix

v0.64.2 is ci-workflows#869, and it changes only how the lane's steps read the GitHub API:

• The PR file list is read once per run instead of three times.
• pulls.get is read twice instead of three times.
• The publish gate is fetched through git instead of three REST calls.
• The full diff reuses scope's merge base.

Inputs, check names, the marker comment, the review-complete notice and holds are unchanged. The runner-policy contract for the new SHA arrived through the standards sync (standards#853, #9441). scripts/ci-review-lanes.test.sh pins the new SHA, and a changelog fragment records the change.

Verification

Job-token requests per run, measured by ci-workflows' pr-review-cli-api-calls.test.cjs, assuming one page per list:

run shape	v0.64.1	v0.64.2
whole review, one inline comment	15	8
whole review, no inline comment	14	6
incremental review, one inline comment	17	10
no-change skip after a base-branch merge	13	8
whole review that holds on a hold-paths file	17	11

That is about 7 requests saved per reviewing run. At about 22 reviewing runs an hour per lane, it comes to roughly 150 requests an hour per lane and 300 an hour for both.

• bash scripts/ci-review-lanes.test.sh: 51 pass, 0 fail.

Related

• ci-workflows#869, standards#853

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-23T15:43:45.844700Z	2d39d69	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed 2d39d690f6bf3e514f63e6af2b5aeca891c3a04c: 0 finding(s), 0 as inline comments.

Security review: no findings

critical-findings: 0

The PR makes three changes and no others:

• It moves the uses: pin for pr-review-cli.yml from the v0.64.1 SHA to the v0.64.2 SHA (6d6cb798…) in pr-review-hosted.yml and pr-review-security-hosted.yml.
• It updates the matching pin assertions in scripts/ci-review-lanes.test.sh.
• It adds a changelog fragment.

Review lane wiring.

• The permissions: blocks are unchanged (contents: read, pull-requests: write).
• The triggers, lane, publish: comments, hold-label: needs-human and hold-paths inputs are unchanged.
• The pin stays a full 40-character SHA with a version comment, and it points at the same org's ci-workflows repository. It is not loosened or unpinned.
• The test script still asserts the exact SHA, so the hold paths and pin stay checked. The hold paths are .github/standards/trusted-actors/**, .github/actions/check-trusted-trigger/**, **/CODEOWNERS and **/.gitmodules.

Not covered.

• I could not read the called workflow (v0.64.2, ci-workflows#869), so I cannot confirm what it does. The PR says it only changes how the lane reads the GitHub API, and that the publish gate now comes through git. I could not check that the SHA matches the v0.64.2 tag, or that the git-based publish gate keeps the same behavior as the REST calls it replaces. The reviewer of the pin bump should confirm both.
• Supply-chain and Actions-hardening concerns about the pin are left to zizmor, as the lane specifies.

Manifests, instruction surfaces, trust gate.

• No plugin.json or marketplace.json is touched, so there are no manifest <field> lines.
• No standing instruction, rule or allowlist is deleted or narrowed, so the instruction-surface lens found nothing. I did not need the protected-class register.
• No trust-gate path is touched, so no hold is set.

PR context. The description is data. It contains no embedded directives aimed at the review lane.

[github-actions]

claude-review reviewed 2d39d690f6bf3e514f63e6af2b5aeca891c3a04c: 0 finding(s), 0 as inline comments.

No findings. This PR repins both review-lane callers (pr-review-hosted.yml and pr-review-security-hosted.yml) from pr-review-cli.yml v0.64.1 to v0.64.2 (6d6cb798…). It also updates the pin assertions in scripts/ci-review-lanes.test.sh and adds a changelog fragment with bump: patch.

What I checked:

• Pin consistency: both callers, the test regexes and the fragment link all use the same SHA, and each # v0.64.2 comment matches it.
• Runner-policy contract: .github/standards/runner-policy/policy.json has an entry for the new SHA at line 836. The old SHA's entry at line 815 is still there, which is harmless.
• Test coverage: the test script still checks the job id, publish: comments, hold-label: needs-human, the hold paths and the pin. The old pin would now fail it, so a drifted pin is caught.
• Changelog bump: patch fits a CI-internal repin that changes no inputs, check names or outputs.
• Hold classes: none apply. The diff doesn't touch trusted-actors, check-trusted-trigger, CODEOWNERS or .gitmodules. It adds no model call, schedule or runner, and the PR describes the change as reducing GitHub API requests.
• Closing issue: the PR states "No related issue", so there are no acceptance criteria to check.
• Plugin manifests: the diff changes no plugin.json or marketplace.json.

Not verified: the PR's request-count table and its "51 pass, 0 fail" test result are author-claimed. I didn't run anything. I also didn't inspect the upstream v0.64.2 code behind the SHA, so the claim that it only changes how the lane reads the GitHub API is unverified.