From d94c1248d4d2d893eb1f6cf48e85145f7e9f533c Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sat, 24 Oct 2026 20:57:38 -0400
Subject: [PATCH] chore(ci): re-pin the review callers to ci-workflows v0.65.9

v0.65.9 (ci-workflows#884) writes the review's full diff with git diff
--text, so a head .gitattributes or a NUL byte cannot hide a file's text
from the review model. The code and security callers and the lane test
move to the new pin; inputs, secrets and permissions are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/pr-review-hosted.yml          | 2 +-
 .github/workflows/pr-review-security-hosted.yml | 2 +-
 scripts/ci-review-lanes.test.sh                 | 6 +++---
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/pr-review-hosted.yml b/.github/workflows/pr-review-hosted.yml
index eb34eae2d0..18841a24fe 100644
--- a/.github/workflows/pr-review-hosted.yml
+++ b/.github/workflows/pr-review-hosted.yml
@@ -168,7 +168,7 @@ jobs:
       contents: read
       pull-requests: write   # the review, its inline comments and the lane's
                              # reviewed-head marker comment
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@4f79cc9244498ae856504cf74aeeb05dcc9c6b43 # v0.65.8
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@4fbceb4b75ffd568dfa5db31de0d0e753c0c64e6 # v0.65.9
     with:
       lane: code
       publish: comments
diff --git a/.github/workflows/pr-review-security-hosted.yml b/.github/workflows/pr-review-security-hosted.yml
index 7c184c2422..db1b6a3aa5 100644
--- a/.github/workflows/pr-review-security-hosted.yml
+++ b/.github/workflows/pr-review-security-hosted.yml
@@ -173,7 +173,7 @@ jobs:
       contents: read
       pull-requests: write   # the review, its inline comments and the lane's
                              # reviewed-head marker comment
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@4f79cc9244498ae856504cf74aeeb05dcc9c6b43 # v0.65.8
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@4fbceb4b75ffd568dfa5db31de0d0e753c0c64e6 # v0.65.9
     with:
       lane: security
       publish: comments
diff --git a/scripts/ci-review-lanes.test.sh b/scripts/ci-review-lanes.test.sh
index 0eeec688ab..904a422ca7 100755
--- a/scripts/ci-review-lanes.test.sh
+++ b/scripts/ci-review-lanes.test.sh
@@ -76,10 +76,10 @@ for pair in 'pr-review-hosted.yml pr-review:' 'pr-review-security-hosted.yml pr-
   caller="$ROOT/.github/workflows/$file"
   if grep -qxF "  $job" "$caller" && grep -qxF '      publish: comments' "$caller" &&
     grep -qxF '      hold-label: needs-human' "$caller" &&
-    grep -qE '^    uses: melodic-software/ci-workflows/\.github/workflows/pr-review-cli\.yml@4f79cc9244498ae856504cf74aeeb05dcc9c6b43 # v0\.65\.8$' "$caller"; then
-    ok "$file calls pr-review-cli v0.65.8 as job ${job%:} with publish: comments and hold-label: needs-human"
+    grep -qE '^    uses: melodic-software/ci-workflows/\.github/workflows/pr-review-cli\.yml@4fbceb4b75ffd568dfa5db31de0d0e753c0c64e6 # v0\.65\.9$' "$caller"; then
+    ok "$file calls pr-review-cli v0.65.9 as job ${job%:} with publish: comments and hold-label: needs-human"
   else
-    fail "$file lost its job id, publish: comments, hold-label or v0.65.8 pin"
+    fail "$file lost its job id, publish: comments, hold-label or v0.65.9 pin"
   fi
   # pr-review-cli's check-key-credit job requests actions: read; a caller that
   # does not grant it fails at startup.