[kyle-sexton]

No related issue: G6 part 2 of the lane-funding plan (owner-approved 2026-10-23).

Summary

ci-workflows v0.65.0 (d02b8697e092705153f0996549b05f95a446bb52) writes each run's list-price cost as costUsd in the lane-outcome record (ci-workflows#872). This re-pins every caller of report-lane-outcome and run-claude-cli in this repository, so the field reaches the records the morning brief's SPEND lines read (#9494).

Fix

Only uses: lines change in the workflows:

• pr-verify.yml: run-claude-cli and report-lane-outcome (2 each), plus apply-claude-managed-settings (2). replay.mjs's RUN_CLAUDE_CLI_PIN names one SHA for both actions, so they move together. apply-claude-managed-settings is unchanged between v0.61.0 and v0.65.0. These pins move from v0.61.0.
• pr-run-activity-read.yml: run-claude-cli (2), report-lane-outcome (2) and apply-claude-managed-settings (1), from v0.61.0. pr-run-activity-write.yml: report-lane-outcome (1), from v0.61.0.
• intake-triage.yml: the intake-triage reusable, from v0.62.0. pr-review-hosted.yml and pr-review-security-hosted.yml: the pr-review-cli reusable, from v0.64.2. Both reusables call the actions through $/, so they run v0.65.0's actions. Their contracts were registered in standards#856 and synced in #9495.

Between v0.61.0 and v0.65.0, run-claude-cli adds only the optional structured-output-file output (ci-workflows#861). execution-file still carries structured_output, so the callers' jq reads are unchanged. cliArgs, --permission-prompts none (lane.cjs:357-358 at d02b8697) and SUMMARY_NOTES are unchanged too.

The tests that name the pinned SHA move with it:

• callers.test.mjs: the intake PINNED, the activity-read launcher, PERMISSION_PROMPTS_NONE_LAUNCHERS (adds d02b8697 after reading lane.cjs) and the SUMMARY_NOTES comment.
• replay.mjs: RUN_CLAUDE_CLI_PIN.
• scripts/ci-review-lanes.test.sh: the review-caller pin.

Verification

• node .github/standards/runner-policy/runner-policy.mjs --root .: "Runner policy passed" after the sync merged. Before the sync, it failed on exactly the three reusable pins.
• node --test .github/actions/resolve-config/callers.test.mjs: 161 pass. node --test .github/scripts/pr-verify/probe/parity.test.mjs: 13 pass. bash scripts/ci-review-lanes.test.sh: 55 pass, 0 fail.
• Left out: other repositories' callers (agent-automations, agent-plugins and ci-runner pin pr-review.yml or pr-review-security.yml at v0.55.0, and pr-pipeline-sandbox pins v0.54.0 and v0.58.0). Re-pinning those jumps many releases, and the morning brief does not read them.

Related

• ci-workflows#872, standards#856, #9495, #9494.
• Automation Lanes' E3 log-api-budget steps touch pr-verify.yml, intake-triage.yml and the review callers. This PR changes only uses: lines there; whichever PR merges second merges main.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-23T21:47:12.959406Z	58b7e73	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed 58b7e73abb3b2f64dceb9672b7b90d2c965de47f: 0 finding(s), 0 as inline comments.

No security issues found in this pull request. critical-findings: 0

Scope. All nine files re-pin existing melodic-software/ci-workflows references from earlier releases (v0.61.0, v0.62.0 and v0.64.2) to the single full-SHA pin d02b8697e092705153f0996549b05f95a446bb52 (v0.65.0). The test and probe constants that name the pin move with it.

Checked.

• Every changed workflow line is a uses: line, and each is still pinned to a full 40-character commit SHA with a version comment. No permissions:, with:, secrets:, if:, trigger or env: line changed, so the diff widens no token, secret or trust boundary. I did not re-report pin hygiene, which zizmor covers.
• The three pin-sensitive tests are updated consistently with the workflows: the intake PINNED value, the activity-read launcher value, and ci-review-lanes.test.sh. The grep in ci-review-lanes.test.sh still requires an exact SHA plus version comment, so it keeps enforcing a SHA pin.
• PERMISSION_PROMPTS_NONE_LAUNCHERS in callers.test.mjs is an allowlist of launcher SHAs that check-permission-mode.sh trusts to pass --permission-prompts none. This PR adds d02b8697 to it. The new entry is the SHA that every run-claude-cli caller in this diff now uses. The PR description says the claim was checked by reading lane.cjs:357-358 at that SHA. I can't read that upstream file from this checkout, so I took the claim from the PR description. The change is narrow: it adds one SHA and keeps the older two, with no wildcard or prefix match. Treat this as a reviewer reminder, not a finding.
• .github/standards/trusted-actors/**, .github/actions/check-trusted-trigger/**, CODEOWNERS and .gitmodules are untouched, so there is no trust-gate hold.
• No plugin manifests (plugin.json or marketplace.json) changed, so there are no manifest <field> lines. The diff deletes or softens no standing instruction.
• The PR description contains no embedded directives.

No hold is requested.

[github-actions]

claude-review reviewed 58b7e73abb3b2f64dceb9672b7b90d2c965de47f: 0 finding(s), 0 as inline comments.

No findings. This is a pin bump from several older ci-workflows releases to v0.65.0 (d02b8697…). I read the whole diff and the PR context. I ran no tests, so the PR's test counts are author-claimed and unverified.

What I checked

• Pins. Every changed uses: line carries the same d02b8697… SHA and a # v0.65.0 comment. Nothing else changes in the workflows.
• Stragglers. A search for the old SHAs (164c2809, 6d6cb798, 2fe38c03) and old tags (v0.64.2, v0.61.0) finds no caller left on them.
  • callers.test.mjs keeps 164c2809 and 7b362428 in PERMISSION_PROMPTS_NONE_LAUNCHERS on purpose, as the allow-list of launcher SHAs already checked.
  • policy.json and the babysit-prs fixtures still hold older SHAs. Those are other repositories' callers and recorded run data, not callers in this repo.
• Runner policy. .github/standards/runner-policy/policy.json already has entries for intake-triage.yml@d02b8697… (line 310) and pr-review-cli.yml@d02b8697… (line 883). This matches the PR's note that chore: sync standards components #9495 synced them.
• Tests. The test and replay changes (callers.test.mjs, replay.mjs, scripts/ci-review-lanes.test.sh) move the pinned SHA and tag in step with the workflows.
• Closing issue. None. The PR says "No related issue", so there are no acceptance criteria to check.
• Manifests. The diff changes no plugin.json or marketplace.json, so there are no manifest lines to report.
• Hold. No hold applies.
  • cost: the change adds no model call, agent run, schedule, or higher limit.
  • trust-gate: it touches no trusted-actors files, check-trusted-trigger, CODEOWNERS or .gitmodules.
  • critical-security: none.

Not verified

• That v0.65.0's lane.cjs:357-358 passes --permission-prompts none. The author says they read it, and I did not read that file.
• That apply-claude-managed-settings is unchanged since v0.61.0. This is also the author's claim.