From 2d7af37b0c081ab44c5afacd18e18d686d61e32a Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Fri, 23 Oct 2026 17:27:10 -0400 Subject: [PATCH] ci: re-pin the Claude lane callers to ci-workflows v0.65.0 v0.65.0 writes each run's list-price cost as costUsd in the lane-outcome record. Re-pin run-claude-cli, report-lane-outcome and apply-claude-managed-settings in pr-verify and pr-run-activity-read/write, the intake-triage reusable, and the pr-review-cli review callers, and move the tests that name the pinned SHA. Co-Authored-By: Claude Opus 5.5 --- .github/actions/resolve-config/callers.test.mjs | 16 ++++++++++------ .github/scripts/pr-verify/probe/replay.mjs | 2 +- .github/workflows/intake-triage.yml | 2 +- .github/workflows/pr-review-hosted.yml | 2 +- .github/workflows/pr-review-security-hosted.yml | 2 +- .github/workflows/pr-run-activity-read.yml | 10 +++++----- .github/workflows/pr-run-activity-write.yml | 2 +- .github/workflows/pr-verify.yml | 12 ++++++------ scripts/ci-review-lanes.test.sh | 6 +++--- 9 files changed, 29 insertions(+), 25 deletions(-) diff --git a/.github/actions/resolve-config/callers.test.mjs b/.github/actions/resolve-config/callers.test.mjs index b14fe35232..5954189d80 100644 --- a/.github/actions/resolve-config/callers.test.mjs +++ b/.github/actions/resolve-config/callers.test.mjs @@ -1310,7 +1310,7 @@ test("the trigger-gate check names an ungated job and accepts only the lanes' ga const admit = (step = { id: "gate", uses: TRUSTED_TRIGGER }) => ({ outputs: { proceed: "${{ steps.gate.outputs.proceed }}" }, steps: [step] }); const gates = (on, jobs) => Object.fromEntries(gatedTriggerJobs(["f.yml"], () => ({ on, jobs }))); const intake = (uses, ids) => ({ uses, with: { "allowed-author-ids": ids }, secrets: { CLAUDE_CODE_OAUTH_TOKEN: "${{ secrets.AUTOMATIONS_CLAUDE_CODE_OAUTH_TOKEN }}" } }); - const PINNED = "melodic-software/ci-workflows/.github/workflows/intake-triage.yml@2fe38c031867900824c164e33a140a335ed9ecf0"; + const PINNED = "melodic-software/ci-workflows/.github/workflows/intake-triage.yml@d02b8697e092705153f0996549b05f95a446bb52"; const cases = { "ungated issues job": [{ issues: { types: ["labeled"] } }, { run: { steps: [launcher] } }, { "f.yml run": [] }], "ungated issue_comment job": [{ issue_comment: { types: ["created"] } }, { run: { steps: [launcher] } }, { "f.yml run": [] }], @@ -1367,7 +1367,7 @@ test("pr-run-activity-read.yml: the run job can only read, and each launcher ste const { jobs } = workflow("pr-run-activity-read.yml"); assert.deepEqual(jobs.run.permissions, { contents: "read", "pull-requests": "read" }, "read-only, no id-token"); const step = (id) => jobs.run.steps.find((s) => s.id === id); - const launcher = "melodic-software/ci-workflows/.github/actions/run-claude-cli@164c2809f6150429b6f24d4a2777bb377af953d9"; + const launcher = "melodic-software/ci-workflows/.github/actions/run-claude-cli@d02b8697e092705153f0996549b05f95a446bb52"; for (const [id, input, secret] of [ ["act-key", "api-key", "claude-api-key"], ["act-token", "subscription-token", "claude-code-oauth-token"], @@ -1424,9 +1424,13 @@ test("no run-claude-cli plugin-dirs or add-dirs value names runner.temp, RUNNER_ // Launcher SHAs checked to pass `--permission-prompts none` unconditionally, // under which the default mode denies every call no rule allows, as dontAsk // does; check-permission-mode.sh accepts default for dontAsk on that basis. -// 7b362428: lane.cjs:311-312; 164c2809: lane.cjs:355-358; in cliArgs. A pin bump fails here until its -// lane.cjs is read and its SHA added. -const PERMISSION_PROMPTS_NONE_LAUNCHERS = new Set(["7b362428c76085a160e28656cd2c75c3147a69ff", "164c2809f6150429b6f24d4a2777bb377af953d9"]); +// 7b362428: lane.cjs:311-312; 164c2809: lane.cjs:355-358; d02b8697: lane.cjs:357-358; in cliArgs. A pin +// bump fails here until its lane.cjs is read and its SHA added. +const PERMISSION_PROMPTS_NONE_LAUNCHERS = new Set([ + "7b362428c76085a160e28656cd2c75c3147a69ff", + "164c2809f6150429b6f24d4a2777bb377af953d9", + "d02b8697e092705153f0996549b05f95a446bb52", +]); test("pr-run-activity-read.yml: every run-claude-cli pin is a launcher checked to pass --permission-prompts none", () => { const pins = []; @@ -3229,7 +3233,7 @@ test("scan job: every gate, skip and launcher class value the runner sets passes const schema = JSON.parse(read("../../../docs/conventions/pr-pipeline/pr-pipeline.schema.json")); const gateReasons = Object.keys(JSON.parse(read("../report-check-run/gate-skip-reasons.json"))); // run-claude-cli's failure classes, the keys of SUMMARY_NOTES in lane.cjs at - // the pinned 164c2809. cant-fail-ok: an external contract's value list. + // the pinned d02b8697. cant-fail-ok: an external contract's value list. const laneClasses = ["credit-stop", "rate-limit", "auth", "overloaded", "max-turns", "timeout", "other"]; const cases = [ ...schema.$defs["skip-reason"].enum.map((value) => ["skip-reason", value]), diff --git a/.github/scripts/pr-verify/probe/replay.mjs b/.github/scripts/pr-verify/probe/replay.mjs index 29790c6b74..5ab02f1489 100644 --- a/.github/scripts/pr-verify/probe/replay.mjs +++ b/.github/scripts/pr-verify/probe/replay.mjs @@ -60,7 +60,7 @@ const REPOSITORY = "melodic-software/claude-code-plugins"; // apply-claude-managed-settings to. cliArgs, LEG_ENV, CLI_VERSION and // MANAGED_SETTINGS were read from that SHA; the parity test fails when the // pin moves, so they are read again. -export const RUN_CLAUDE_CLI_PIN = "164c2809f6150429b6f24d4a2777bb377af953d9"; +export const RUN_CLAUDE_CLI_PIN = "d02b8697e092705153f0996549b05f95a446bb52"; export const CLI_VERSION = "latest"; export const MANAGED_SETTINGS = Object.freeze({ apiKeyHelper: "", diff --git a/.github/workflows/intake-triage.yml b/.github/workflows/intake-triage.yml index cefb2c60cb..319e1c5e28 100644 --- a/.github/workflows/intake-triage.yml +++ b/.github/workflows/intake-triage.yml @@ -193,7 +193,7 @@ jobs: concurrency: group: intake-triage-${{ github.event.issue.number || inputs.issue-number || github.run_id }} cancel-in-progress: false - uses: melodic-software/ci-workflows/.github/workflows/intake-triage.yml@2fe38c031867900824c164e33a140a335ed9ecf0 # v0.62.0 + uses: melodic-software/ci-workflows/.github/workflows/intake-triage.yml@d02b8697e092705153f0996549b05f95a446bb52 # v0.65.0 with: runner: ubuntu-24.04 role: automations diff --git a/.github/workflows/pr-review-hosted.yml b/.github/workflows/pr-review-hosted.yml index 742d2bf94d..3884dd74c8 100644 --- a/.github/workflows/pr-review-hosted.yml +++ b/.github/workflows/pr-review-hosted.yml @@ -166,7 +166,7 @@ jobs: contents: read pull-requests: write # the review, its inline comments and the lane's # reviewed-head marker comment - uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@6d6cb798e7cb7560a0f9327d8a22398961c23b31 # v0.64.2 + uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@d02b8697e092705153f0996549b05f95a446bb52 # v0.65.0 with: lane: code publish: comments diff --git a/.github/workflows/pr-review-security-hosted.yml b/.github/workflows/pr-review-security-hosted.yml index 778dca7a2e..ff506b9c65 100644 --- a/.github/workflows/pr-review-security-hosted.yml +++ b/.github/workflows/pr-review-security-hosted.yml @@ -172,7 +172,7 @@ jobs: contents: read pull-requests: write # the review, its inline comments and the lane's # reviewed-head marker comment - uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@6d6cb798e7cb7560a0f9327d8a22398961c23b31 # v0.64.2 + uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@d02b8697e092705153f0996549b05f95a446bb52 # v0.65.0 with: lane: security publish: comments diff --git a/.github/workflows/pr-run-activity-read.yml b/.github/workflows/pr-run-activity-read.yml index 05d65e9184..cbe55c1225 100644 --- a/.github/workflows/pr-run-activity-read.yml +++ b/.github/workflows/pr-run-activity-read.yml @@ -1020,7 +1020,7 @@ jobs: # need sudo, so they are written before the runner is isolated. - name: Apply the Claude managed settings if: steps.launch.outcome == 'success' && steps.go.outputs.run == 'true' - uses: melodic-software/ci-workflows/.github/actions/apply-claude-managed-settings@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 + uses: melodic-software/ci-workflows/.github/actions/apply-claude-managed-settings@d02b8697e092705153f0996549b05f95a446bb52 # v0.65.0 # Nothing after this step needs sudo or docker. - name: Isolate the runner @@ -1299,7 +1299,7 @@ jobs: if: steps.key-present.outputs.present == 'true' continue-on-error: true timeout-minutes: 50 - uses: melodic-software/ci-workflows/.github/actions/run-claude-cli@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 + uses: melodic-software/ci-workflows/.github/actions/run-claude-cli@d02b8697e092705153f0996549b05f95a446bb52 # v0.65.0 env: # No work may outlive the result message the launcher reads. CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1" @@ -1351,7 +1351,7 @@ jobs: if: steps.token-present.outputs.present == 'true' continue-on-error: true timeout-minutes: 50 - uses: melodic-software/ci-workflows/.github/actions/run-claude-cli@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 + uses: melodic-software/ci-workflows/.github/actions/run-claude-cli@d02b8697e092705153f0996549b05f95a446bb52 # v0.65.0 env: CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1" LD_LIBRARY_PATH: "" @@ -1697,7 +1697,7 @@ jobs: if: >- always() && inputs.issue-number != '' && (steps.act-skill.outcome == 'success' || steps.act-skill.outcome == 'failure') - uses: melodic-software/ci-workflows/.github/actions/report-lane-outcome@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 + uses: melodic-software/ci-workflows/.github/actions/report-lane-outcome@d02b8697e092705153f0996549b05f95a446bb52 # v0.65.0 with: outcome: ${{ steps.act-result.outputs.outcome || steps.act-skill.outcome }} execution-file: >- @@ -1716,7 +1716,7 @@ jobs: always() && steps.key-present.outputs.present != 'false' && steps.act-key.outputs.lane-class != 'credit-stop' && (steps.act-key.outcome == 'success' || steps.act-key.outcome == 'failure' || steps.act-token.outcome == 'success' || steps.act-token.outcome == 'failure') - uses: melodic-software/ci-workflows/.github/actions/report-lane-outcome@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 + uses: melodic-software/ci-workflows/.github/actions/report-lane-outcome@d02b8697e092705153f0996549b05f95a446bb52 # v0.65.0 with: outcome: ${{ steps.act-key.outcome != 'skipped' && steps.act-key.outcome || steps.act-token.outcome }} execution-file: ${{ steps.act-key.outputs.execution-file || steps.act-token.outputs.execution-file }} diff --git a/.github/workflows/pr-run-activity-write.yml b/.github/workflows/pr-run-activity-write.yml index 10f1723d63..3beede6985 100644 --- a/.github/workflows/pr-run-activity-write.yml +++ b/.github/workflows/pr-run-activity-write.yml @@ -1610,7 +1610,7 @@ jobs: - name: Record the lane outcome id: lane-record if: always() && (steps.act-skill.outcome == 'success' || steps.act-skill.outcome == 'failure') - uses: melodic-software/ci-workflows/.github/actions/report-lane-outcome@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 + uses: melodic-software/ci-workflows/.github/actions/report-lane-outcome@d02b8697e092705153f0996549b05f95a446bb52 # v0.65.0 with: outcome: ${{ steps.act-result.outputs.outcome || steps.act-skill.outcome }} execution-file: >- diff --git a/.github/workflows/pr-verify.yml b/.github/workflows/pr-verify.yml index e128abbff0..aaa5d296ac 100644 --- a/.github/workflows/pr-verify.yml +++ b/.github/workflows/pr-verify.yml @@ -209,7 +209,7 @@ jobs: # need sudo, so they are written before the runner is isolated. - name: Apply the Claude managed settings if: steps.agree.outcome == 'success' - uses: melodic-software/ci-workflows/.github/actions/apply-claude-managed-settings@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 + uses: melodic-software/ci-workflows/.github/actions/apply-claude-managed-settings@d02b8697e092705153f0996549b05f95a446bb52 # v0.65.0 - name: Isolate the runner if: steps.agree.outcome == 'success' @@ -259,7 +259,7 @@ jobs: if: steps.credential.outputs.present == 'true' continue-on-error: true timeout-minutes: 22 - uses: melodic-software/ci-workflows/.github/actions/run-claude-cli@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 + uses: melodic-software/ci-workflows/.github/actions/run-claude-cli@d02b8697e092705153f0996549b05f95a446bb52 # v0.65.0 env: # No work may outlive the result message the launcher reads. CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1" @@ -318,7 +318,7 @@ jobs: # it, and auth as auth. - name: Report the judgment's outcome if: (steps.judge.outcome == 'success' || steps.judge.outcome == 'failure') && (steps.judge.outputs.handoff != 'true' || steps.key-leg.outcome == 'failure') - uses: melodic-software/ci-workflows/.github/actions/report-lane-outcome@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 + uses: melodic-software/ci-workflows/.github/actions/report-lane-outcome@d02b8697e092705153f0996549b05f95a446bb52 # v0.65.0 with: outcome: ${{ steps.judge.outcome }} execution-file: ${{ steps.judge.outputs.execution-file }} @@ -533,7 +533,7 @@ jobs: # need sudo, so they are written before the runner is isolated. - name: Apply the Claude managed settings if: steps.agree.outcome == 'success' - uses: melodic-software/ci-workflows/.github/actions/apply-claude-managed-settings@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 + uses: melodic-software/ci-workflows/.github/actions/apply-claude-managed-settings@d02b8697e092705153f0996549b05f95a446bb52 # v0.65.0 - name: Isolate the runner if: steps.agree.outcome == 'success' @@ -581,7 +581,7 @@ jobs: if: steps.credential.outputs.present == 'true' continue-on-error: true timeout-minutes: 22 - uses: melodic-software/ci-workflows/.github/actions/run-claude-cli@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 + uses: melodic-software/ci-workflows/.github/actions/run-claude-cli@d02b8697e092705153f0996549b05f95a446bb52 # v0.65.0 env: # No work may outlive the result message the launcher reads. CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1" @@ -616,7 +616,7 @@ jobs: - name: Report the judgment's outcome if: steps.judge.outcome == 'success' || steps.judge.outcome == 'failure' - uses: melodic-software/ci-workflows/.github/actions/report-lane-outcome@164c2809f6150429b6f24d4a2777bb377af953d9 # v0.61.0 + uses: melodic-software/ci-workflows/.github/actions/report-lane-outcome@d02b8697e092705153f0996549b05f95a446bb52 # v0.65.0 with: outcome: ${{ steps.judge.outcome }} execution-file: ${{ steps.judge.outputs.execution-file }} diff --git a/scripts/ci-review-lanes.test.sh b/scripts/ci-review-lanes.test.sh index 2779a4b704..50343efb57 100755 --- a/scripts/ci-review-lanes.test.sh +++ b/scripts/ci-review-lanes.test.sh @@ -76,10 +76,10 @@ for pair in 'pr-review-hosted.yml pr-review:' 'pr-review-security-hosted.yml pr- caller="$ROOT/.github/workflows/$file" if grep -qxF " $job" "$caller" && grep -qxF ' publish: comments' "$caller" && grep -qxF ' hold-label: needs-human' "$caller" && - grep -qE '^ uses: melodic-software/ci-workflows/\.github/workflows/pr-review-cli\.yml@6d6cb798e7cb7560a0f9327d8a22398961c23b31 # v0\.64\.2$' "$caller"; then - ok "$file calls pr-review-cli v0.64.2 as job ${job%:} with publish: comments and hold-label: needs-human" + grep -qE '^ uses: melodic-software/ci-workflows/\.github/workflows/pr-review-cli\.yml@d02b8697e092705153f0996549b05f95a446bb52 # v0\.65\.0$' "$caller"; then + ok "$file calls pr-review-cli v0.65.0 as job ${job%:} with publish: comments and hold-label: needs-human" else - fail "$file lost its job id, publish: comments, hold-label or v0.64.2 pin" + fail "$file lost its job id, publish: comments, hold-label or v0.65.0 pin" fi paths="$(awk '/^ hold-paths: \|$/ { on = 1; next } on && /^ / { sub(/^ +/, ""); print; next } on { exit }' "$caller")" if [[ "$paths" == $'.github/standards/trusted-actors/**\n.github/actions/check-trusted-trigger/**\n**/CODEOWNERS\n**/.gitmodules' ]]; then