[kyle-sexton]

Refs: #9436

Summary

Re-pins both review callers to ci-workflows v0.65.6 (91426458), which adds one change over v0.65.5, ci-workflows#879: the hold step's cost-decision carry refuses to carry when any comment on the pull request was deleted at or after the decided-head hold marker was posted. A deleted newer marker would otherwise make an older one the decided head, so a decision could carry to a diff the owner never saw. The rule matches deletedSince in #9569's merge-holds.mjs (owner decision Q18 d on #9436), and it fails closed when the timeline's COMMENT_DELETED_EVENT list cannot be read, lists fewer events than its filteredCount, or holds a time that does not parse.

Fix

• .github/workflows/pr-review-hosted.yml and .github/workflows/pr-review-security-hosted.yml: only the uses: pin line changes, from f1096608 (v0.65.5) to 91426458 (v0.65.6).
• scripts/ci-review-lanes.test.sh: the pin the test asserts, plus its ok and fail messages.
• Runner policy: standards#874 registers the new SHA with the same inputs and secrets as v0.65.5; it reaches this repository through the standards sync.

Verification

• bash scripts/ci-review-lanes.test.sh: PASS=55 FAIL=0.
• actionlint on both callers: clean.
• gh api repos/melodic-software/ci-workflows/compare/v0.65.5...v0.65.6: three files (hold.cjs, its test, and a comment-only pr-review-cli.yml patch), so the reusable workflow's inputs, secrets and permissions are unchanged.

Remaining

#9436 is already closed; this PR is follow-up hardening of the review-lane reader it designed. Nothing else is left in this repository for the review lanes. The merge-side readers (merge-holds.mjs behind ci-status, and babysit's merge policy) get the same deleted-comment rule in #9569, which is open and separate from this PR.

Related

• ci-workflows#879, standards#874, chore(ci): re-pin the review callers to ci-workflows v0.65.5 #9589 (the v0.65.5 re-pin), fix(pr-merge): bind a cost decision to the pull request it names #9569, fix(pr-pipeline): carry an owner-lifted claude-review cost hold forward across base-only merges #9436.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T15:37:59.785124Z	4483614	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review needs no new review of 61a7fc6b24893a0b7d05cb05c10d9750ebe9c053: no file of this pull request changed since the review of 4483614.

No findings. I read the full diff and the PR context.

• Pin change: both callers (pr-review-hosted.yml, pr-review-security-hosted.yml) move from f1096608… (v0.65.5) to 914264587c35692c15e05c965103426eec18d1f0 (v0.65.6). The SHA matches the 91426458 prefix the PR description cites.
• Test: scripts/ci-review-lanes.test.sh asserts the same new SHA and version comment, and its ok and fail messages are updated to match.
• Runner policy: I confirmed with a search that .github/standards/runner-policy/policy.json already contains the new SHA. The v0.65.5 entry is still there, which is harmless for a synced policy file this PR doesn't touch.
• Leftovers: no other references to the old SHA or v0.65.5 remain outside policy.json.
• Not verified: I did not run the test script or actionlint. The PASS=55 result and the claim that the upstream v0.65.5→v0.65.6 diff is comment-only are the author's and unverified by me.
• Closing issues: the PR says Refs: #9436 and closes nothing, so there are no acceptance criteria to check.
• Hold: none. The PR touches no trusted-actors paths, CODEOWNERS or .gitmodules. It adds no model spend, since it is a pin bump of an existing workflow with unchanged inputs and secrets.
• Manifests: none changed.

[github-actions]

claude-security-review needs no new review of 61a7fc6b24893a0b7d05cb05c10d9750ebe9c053: no file of this pull request changed since the review of 4483614.

No security issues found in this pull request.

The change moves the uses: pin for the pr-review-cli.yml reusable workflow from v0.65.5 to v0.65.6 in both review callers, pr-review-hosted.yml and pr-review-security-hosted.yml. It also updates the pin string and messages that scripts/ci-review-lanes.test.sh asserts.

• Pin form: Both callers still use a full 40-character commit SHA with a version comment. The two callers and the test all carry the same SHA, 914264587c35692c15e05c965103426eec18d1f0, and it matches the 91426458 prefix in the PR description. No pin was loosened.
• Permissions and inputs: The permissions: blocks, with: inputs (publish: comments, hold-label: needs-human, hold-paths) and secrets are untouched. The test still asserts the hold paths and hold label, so the trust-gate path list is still checked.
• Trust-gate paths: The diff does not touch .github/standards/trusted-actors/**, .github/actions/check-trusted-trigger/**, any CODEOWNERS or any .gitmodules, so there is no hold.
• Manifests and instruction surfaces: No plugin manifests, CLAUDE.md, agent or skill bodies, or hook allowlists changed.
• PR context: I found no embedded instructions in the PR description. It describes the upstream change as one that makes the hold step's cost-decision carry fail closed when a comment was deleted. That tightens a control.
• Not checked: I had no network access, so I could not confirm that the SHA is the v0.65.6 tag in ci-workflows or that the upstream diff is limited to the three files the description names. That is an ordinary pin-bump check for the reviewer.

manifest fields: none hit.
critical-findings: 0