From 209f38a2772c740a74a6e5c6c53e3d9fb93cf91b Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Sat, 24 Oct 2026 00:41:41 -0400 Subject: [PATCH 1/4] chore(ci): re-pin the review callers to ci-workflows v0.65.2 v0.65.2 makes each review job report the job token's api budget and stops the hold step re-adding a cost hold the owner already decided. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/pr-review-hosted.yml | 2 +- .github/workflows/pr-review-security-hosted.yml | 2 +- scripts/ci-review-lanes.test.sh | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/pr-review-hosted.yml b/.github/workflows/pr-review-hosted.yml index a5c81a3de6..2db9822247 100644 --- a/.github/workflows/pr-review-hosted.yml +++ b/.github/workflows/pr-review-hosted.yml @@ -166,7 +166,7 @@ jobs: contents: read pull-requests: write # the review, its inline comments and the lane's # reviewed-head marker comment - uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@b49ac366bb3426039363a6927c41512e44533808 # v0.65.1 + uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@e7f935fc799fc9c78f1dc52646e8bbd54823502a # v0.65.2 with: lane: code publish: comments diff --git a/.github/workflows/pr-review-security-hosted.yml b/.github/workflows/pr-review-security-hosted.yml index 20c5e745ed..8966fcce0d 100644 --- a/.github/workflows/pr-review-security-hosted.yml +++ b/.github/workflows/pr-review-security-hosted.yml @@ -172,7 +172,7 @@ jobs: contents: read pull-requests: write # the review, its inline comments and the lane's # reviewed-head marker comment - uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@b49ac366bb3426039363a6927c41512e44533808 # v0.65.1 + uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@e7f935fc799fc9c78f1dc52646e8bbd54823502a # v0.65.2 with: lane: security publish: comments diff --git a/scripts/ci-review-lanes.test.sh b/scripts/ci-review-lanes.test.sh index b0ed4bedd4..748cb32939 100755 --- a/scripts/ci-review-lanes.test.sh +++ b/scripts/ci-review-lanes.test.sh @@ -76,10 +76,10 @@ for pair in 'pr-review-hosted.yml pr-review:' 'pr-review-security-hosted.yml pr- caller="$ROOT/.github/workflows/$file" if grep -qxF " $job" "$caller" && grep -qxF ' publish: comments' "$caller" && grep -qxF ' hold-label: needs-human' "$caller" && - grep -qE '^ uses: melodic-software/ci-workflows/\.github/workflows/pr-review-cli\.yml@b49ac366bb3426039363a6927c41512e44533808 # v0\.65\.1$' "$caller"; then - ok "$file calls pr-review-cli v0.65.1 as job ${job%:} with publish: comments and hold-label: needs-human" + grep -qE '^ uses: melodic-software/ci-workflows/\.github/workflows/pr-review-cli\.yml@e7f935fc799fc9c78f1dc52646e8bbd54823502a # v0\.65\.2$' "$caller"; then + ok "$file calls pr-review-cli v0.65.2 as job ${job%:} with publish: comments and hold-label: needs-human" else - fail "$file lost its job id, publish: comments, hold-label or v0.65.1 pin" + fail "$file lost its job id, publish: comments, hold-label or v0.65.2 pin" fi paths="$(awk '/^ hold-paths: \|$/ { on = 1; next } on && /^ / { sub(/^ +/, ""); print; next } on { exit }' "$caller")" if [[ "$paths" == $'.github/standards/trusted-actors/**\n.github/actions/check-trusted-trigger/**\n**/CODEOWNERS\n**/.gitmodules' ]]; then From 8d7f78fe544a104fe370e5da573bfa313b5a536d Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Sat, 24 Oct 2026 01:28:29 -0400 Subject: [PATCH 2/4] chore(ci): re-pin the review callers to ci-workflows v0.65.3 v0.65.3 aligns the hold step's cost-decision matching with the merge-side readers (#9569). Co-Authored-By: Claude Opus 5.5 --- .github/workflows/pr-review-hosted.yml | 2 +- .github/workflows/pr-review-security-hosted.yml | 2 +- scripts/ci-review-lanes.test.sh | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/pr-review-hosted.yml b/.github/workflows/pr-review-hosted.yml index 2db9822247..0bf54005c4 100644 --- a/.github/workflows/pr-review-hosted.yml +++ b/.github/workflows/pr-review-hosted.yml @@ -166,7 +166,7 @@ jobs: contents: read pull-requests: write # the review, its inline comments and the lane's # reviewed-head marker comment - uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@e7f935fc799fc9c78f1dc52646e8bbd54823502a # v0.65.2 + uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@f133c6651f866845e18595d26cf59d4043b5b642 # v0.65.3 with: lane: code publish: comments diff --git a/.github/workflows/pr-review-security-hosted.yml b/.github/workflows/pr-review-security-hosted.yml index 8966fcce0d..d89535a329 100644 --- a/.github/workflows/pr-review-security-hosted.yml +++ b/.github/workflows/pr-review-security-hosted.yml @@ -172,7 +172,7 @@ jobs: contents: read pull-requests: write # the review, its inline comments and the lane's # reviewed-head marker comment - uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@e7f935fc799fc9c78f1dc52646e8bbd54823502a # v0.65.2 + uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@f133c6651f866845e18595d26cf59d4043b5b642 # v0.65.3 with: lane: security publish: comments diff --git a/scripts/ci-review-lanes.test.sh b/scripts/ci-review-lanes.test.sh index 748cb32939..6984b3005c 100755 --- a/scripts/ci-review-lanes.test.sh +++ b/scripts/ci-review-lanes.test.sh @@ -76,10 +76,10 @@ for pair in 'pr-review-hosted.yml pr-review:' 'pr-review-security-hosted.yml pr- caller="$ROOT/.github/workflows/$file" if grep -qxF " $job" "$caller" && grep -qxF ' publish: comments' "$caller" && grep -qxF ' hold-label: needs-human' "$caller" && - grep -qE '^ uses: melodic-software/ci-workflows/\.github/workflows/pr-review-cli\.yml@e7f935fc799fc9c78f1dc52646e8bbd54823502a # v0\.65\.2$' "$caller"; then - ok "$file calls pr-review-cli v0.65.2 as job ${job%:} with publish: comments and hold-label: needs-human" + grep -qE '^ uses: melodic-software/ci-workflows/\.github/workflows/pr-review-cli\.yml@f133c6651f866845e18595d26cf59d4043b5b642 # v0\.65\.3$' "$caller"; then + ok "$file calls pr-review-cli v0.65.3 as job ${job%:} with publish: comments and hold-label: needs-human" else - fail "$file lost its job id, publish: comments, hold-label or v0.65.2 pin" + fail "$file lost its job id, publish: comments, hold-label or v0.65.3 pin" fi paths="$(awk '/^ hold-paths: \|$/ { on = 1; next } on && /^ / { sub(/^ +/, ""); print; next } on { exit }' "$caller")" if [[ "$paths" == $'.github/standards/trusted-actors/**\n.github/actions/check-trusted-trigger/**\n**/CODEOWNERS\n**/.gitmodules' ]]; then From 5d32b27ac52e3e4a7c00e8b741fc987f90fdb029 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Sat, 24 Oct 2026 02:37:20 -0400 Subject: [PATCH 3/4] chore(ci): re-pin the review callers to ci-workflows v0.65.4 A recorded cost decision now carries only while the pull request's net diff against its base is unchanged (ci-workflows#877). Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/pr-review-hosted.yml | 2 +- .github/workflows/pr-review-security-hosted.yml | 2 +- scripts/ci-review-lanes.test.sh | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/pr-review-hosted.yml b/.github/workflows/pr-review-hosted.yml index 0bf54005c4..14478c13fd 100644 --- a/.github/workflows/pr-review-hosted.yml +++ b/.github/workflows/pr-review-hosted.yml @@ -166,7 +166,7 @@ jobs: contents: read pull-requests: write # the review, its inline comments and the lane's # reviewed-head marker comment - uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@f133c6651f866845e18595d26cf59d4043b5b642 # v0.65.3 + uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@31b44f3ffc7f208fb281dd2b64decce67c53d316 # v0.65.4 with: lane: code publish: comments diff --git a/.github/workflows/pr-review-security-hosted.yml b/.github/workflows/pr-review-security-hosted.yml index ac14c082f2..845a25c809 100644 --- a/.github/workflows/pr-review-security-hosted.yml +++ b/.github/workflows/pr-review-security-hosted.yml @@ -171,7 +171,7 @@ jobs: contents: read pull-requests: write # the review, its inline comments and the lane's # reviewed-head marker comment - uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@f133c6651f866845e18595d26cf59d4043b5b642 # v0.65.3 + uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@31b44f3ffc7f208fb281dd2b64decce67c53d316 # v0.65.4 with: lane: security publish: comments diff --git a/scripts/ci-review-lanes.test.sh b/scripts/ci-review-lanes.test.sh index 6984b3005c..65aed17dc7 100755 --- a/scripts/ci-review-lanes.test.sh +++ b/scripts/ci-review-lanes.test.sh @@ -76,10 +76,10 @@ for pair in 'pr-review-hosted.yml pr-review:' 'pr-review-security-hosted.yml pr- caller="$ROOT/.github/workflows/$file" if grep -qxF " $job" "$caller" && grep -qxF ' publish: comments' "$caller" && grep -qxF ' hold-label: needs-human' "$caller" && - grep -qE '^ uses: melodic-software/ci-workflows/\.github/workflows/pr-review-cli\.yml@f133c6651f866845e18595d26cf59d4043b5b642 # v0\.65\.3$' "$caller"; then - ok "$file calls pr-review-cli v0.65.3 as job ${job%:} with publish: comments and hold-label: needs-human" + grep -qE '^ uses: melodic-software/ci-workflows/\.github/workflows/pr-review-cli\.yml@31b44f3ffc7f208fb281dd2b64decce67c53d316 # v0\.65\.4$' "$caller"; then + ok "$file calls pr-review-cli v0.65.4 as job ${job%:} with publish: comments and hold-label: needs-human" else - fail "$file lost its job id, publish: comments, hold-label or v0.65.3 pin" + fail "$file lost its job id, publish: comments, hold-label or v0.65.4 pin" fi paths="$(awk '/^ hold-paths: \|$/ { on = 1; next } on && /^ / { sub(/^ +/, ""); print; next } on { exit }' "$caller")" if [[ "$paths" == $'.github/standards/trusted-actors/**\n.github/actions/check-trusted-trigger/**\n**/CODEOWNERS\n**/.gitmodules' ]]; then From 7e90de2d769285130cd5489579ef31c3227b5922 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Sat, 24 Oct 2026 03:05:57 -0400 Subject: [PATCH 4/4] chore(ci): re-pin the review callers to ci-workflows v0.65.5 Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/pr-review-hosted.yml | 2 +- .github/workflows/pr-review-security-hosted.yml | 2 +- scripts/ci-review-lanes.test.sh | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/pr-review-hosted.yml b/.github/workflows/pr-review-hosted.yml index 14478c13fd..1c17d1c060 100644 --- a/.github/workflows/pr-review-hosted.yml +++ b/.github/workflows/pr-review-hosted.yml @@ -166,7 +166,7 @@ jobs: contents: read pull-requests: write # the review, its inline comments and the lane's # reviewed-head marker comment - uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@31b44f3ffc7f208fb281dd2b64decce67c53d316 # v0.65.4 + uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@f1096608192c54cfb3dc252e36670e6f86700b9b # v0.65.5 with: lane: code publish: comments diff --git a/.github/workflows/pr-review-security-hosted.yml b/.github/workflows/pr-review-security-hosted.yml index 845a25c809..f482d04de4 100644 --- a/.github/workflows/pr-review-security-hosted.yml +++ b/.github/workflows/pr-review-security-hosted.yml @@ -171,7 +171,7 @@ jobs: contents: read pull-requests: write # the review, its inline comments and the lane's # reviewed-head marker comment - uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@31b44f3ffc7f208fb281dd2b64decce67c53d316 # v0.65.4 + uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@f1096608192c54cfb3dc252e36670e6f86700b9b # v0.65.5 with: lane: security publish: comments diff --git a/scripts/ci-review-lanes.test.sh b/scripts/ci-review-lanes.test.sh index 65aed17dc7..39d9a88c96 100755 --- a/scripts/ci-review-lanes.test.sh +++ b/scripts/ci-review-lanes.test.sh @@ -76,10 +76,10 @@ for pair in 'pr-review-hosted.yml pr-review:' 'pr-review-security-hosted.yml pr- caller="$ROOT/.github/workflows/$file" if grep -qxF " $job" "$caller" && grep -qxF ' publish: comments' "$caller" && grep -qxF ' hold-label: needs-human' "$caller" && - grep -qE '^ uses: melodic-software/ci-workflows/\.github/workflows/pr-review-cli\.yml@31b44f3ffc7f208fb281dd2b64decce67c53d316 # v0\.65\.4$' "$caller"; then - ok "$file calls pr-review-cli v0.65.4 as job ${job%:} with publish: comments and hold-label: needs-human" + grep -qE '^ uses: melodic-software/ci-workflows/\.github/workflows/pr-review-cli\.yml@f1096608192c54cfb3dc252e36670e6f86700b9b # v0\.65\.5$' "$caller"; then + ok "$file calls pr-review-cli v0.65.5 as job ${job%:} with publish: comments and hold-label: needs-human" else - fail "$file lost its job id, publish: comments, hold-label or v0.65.4 pin" + fail "$file lost its job id, publish: comments, hold-label or v0.65.5 pin" fi paths="$(awk '/^ hold-paths: \|$/ { on = 1; next } on && /^ / { sub(/^ +/, ""); print; next } on { exit }' "$caller")" if [[ "$paths" == $'.github/standards/trusted-actors/**\n.github/actions/check-trusted-trigger/**\n**/CODEOWNERS\n**/.gitmodules' ]]; then