From 2d39d690f6bf3e514f63e6af2b5aeca891c3a04c Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Fri, 23 Oct 2026 11:34:04 -0400
Subject: [PATCH] perf(pr-pipeline): repin both review lanes to pr-review-cli
 v0.64.2

v0.64.2 (ci-workflows#869) reads the pull request's file list once per run
instead of three times and pulls.get twice instead of three times, and
fetches the publish gate through git: a whole review with an inline
comment spends 8 job-token requests instead of 15.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .changes/pr-pipeline/perf-review-lanes-v0-64-2-4b7d2c19.md | 7 +++++++
 .github/workflows/pr-review-hosted.yml                     | 2 +-
 .github/workflows/pr-review-security-hosted.yml            | 2 +-
 scripts/ci-review-lanes.test.sh                            | 6 +++---
 4 files changed, 12 insertions(+), 5 deletions(-)
 create mode 100644 .changes/pr-pipeline/perf-review-lanes-v0-64-2-4b7d2c19.md

diff --git a/.changes/pr-pipeline/perf-review-lanes-v0-64-2-4b7d2c19.md b/.changes/pr-pipeline/perf-review-lanes-v0-64-2-4b7d2c19.md
new file mode 100644
index 0000000000..a3d625ba38
--- /dev/null
+++ b/.changes/pr-pipeline/perf-review-lanes-v0-64-2-4b7d2c19.md
@@ -0,0 +1,7 @@
+---
+bump: patch
+---
+
+### Changed
+
+- `pr-review-hosted.yml` and `pr-review-security-hosted.yml` call ci-workflows' [`pr-review-cli.yml`](https://github.com/melodic-software/ci-workflows/blob/6d6cb798e7cb7560a0f9327d8a22398961c23b31/.github/workflows/pr-review-cli.yml) v0.64.2, which spends fewer job-token API requests per run ([ci-workflows#869](https://github.com/melodic-software/ci-workflows/pull/869)). It reads the pull request's file list once instead of three times and pulls.get twice instead of three times, and the publish gate now comes through git. A whole review with an inline comment drops from 15 requests to 8. Check names, the marker comment, the review-complete notice and holds are unchanged.
diff --git a/.github/workflows/pr-review-hosted.yml b/.github/workflows/pr-review-hosted.yml
index e8fa01d052..742d2bf94d 100644
--- a/.github/workflows/pr-review-hosted.yml
+++ b/.github/workflows/pr-review-hosted.yml
@@ -166,7 +166,7 @@ jobs:
       contents: read
       pull-requests: write   # the review, its inline comments and the lane's
                              # reviewed-head marker comment
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@9aca743c4ed9aaf7870288a36586c3994e9321e4 # v0.64.1
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@6d6cb798e7cb7560a0f9327d8a22398961c23b31 # v0.64.2
     with:
       lane: code
       publish: comments
diff --git a/.github/workflows/pr-review-security-hosted.yml b/.github/workflows/pr-review-security-hosted.yml
index 25a6d4909c..778dca7a2e 100644
--- a/.github/workflows/pr-review-security-hosted.yml
+++ b/.github/workflows/pr-review-security-hosted.yml
@@ -172,7 +172,7 @@ jobs:
       contents: read
       pull-requests: write   # the review, its inline comments and the lane's
                              # reviewed-head marker comment
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@9aca743c4ed9aaf7870288a36586c3994e9321e4 # v0.64.1
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@6d6cb798e7cb7560a0f9327d8a22398961c23b31 # v0.64.2
     with:
       lane: security
       publish: comments
diff --git a/scripts/ci-review-lanes.test.sh b/scripts/ci-review-lanes.test.sh
index 21626577ac..c059111eab 100755
--- a/scripts/ci-review-lanes.test.sh
+++ b/scripts/ci-review-lanes.test.sh
@@ -71,10 +71,10 @@ for pair in 'pr-review-hosted.yml pr-review:' 'pr-review-security-hosted.yml pr-
   caller="$ROOT/.github/workflows/$file"
   if grep -qxF "  $job" "$caller" && grep -qxF '      publish: comments' "$caller" &&
     grep -qxF '      hold-label: needs-human' "$caller" &&
-    grep -qE '^    uses: melodic-software/ci-workflows/\.github/workflows/pr-review-cli\.yml@9aca743c4ed9aaf7870288a36586c3994e9321e4 # v0\.64\.1$' "$caller"; then
-    ok "$file calls pr-review-cli v0.64.1 as job ${job%:} with publish: comments and hold-label: needs-human"
+    grep -qE '^    uses: melodic-software/ci-workflows/\.github/workflows/pr-review-cli\.yml@6d6cb798e7cb7560a0f9327d8a22398961c23b31 # v0\.64\.2$' "$caller"; then
+    ok "$file calls pr-review-cli v0.64.2 as job ${job%:} with publish: comments and hold-label: needs-human"
   else
-    fail "$file lost its job id, publish: comments, hold-label or v0.64.1 pin"
+    fail "$file lost its job id, publish: comments, hold-label or v0.64.2 pin"
   fi
   paths="$(awk '/^      hold-paths: \|$/ { on = 1; next } on && /^        / { sub(/^ +/, ""); print; next } on { exit }' "$caller")"
   if [[ "$paths" == $'.github/standards/trusted-actors/**\n.github/actions/check-trusted-trigger/**\n**/CODEOWNERS\n**/.gitmodules' ]]; then