From 3da1a3105c8f5a73c4895a1fd41da3c0a5076380 Mon Sep 17 00:00:00 2001 From: "melodic-standards-sync[bot]" <300666570+melodic-standards-sync[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 23:05:04 +0000 Subject: [PATCH] chore: sync standards components (f0e5b8a2c7287eee4b917e66a830cbf7b99b409d) --- .github/workflows/pr-check-managed-files-hosted.yml | 2 +- .github/workflows/pr-review-hosted.yml | 10 +++++++++- .github/workflows/pr-review-security-hosted.yml | 2 +- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.github/workflows/pr-check-managed-files-hosted.yml b/.github/workflows/pr-check-managed-files-hosted.yml index 311dde4..5888e0e 100644 --- a/.github/workflows/pr-check-managed-files-hosted.yml +++ b/.github/workflows/pr-check-managed-files-hosted.yml @@ -113,7 +113,7 @@ jobs: # now contains that commit, so the pin-comment takes the convention's # release-tag form rather than the short-SHA fallback # (components/managed-files-guard/README.md). - uses: melodic-software/ci-workflows/.github/actions/check-managed-files@7b362428c76085a160e28656cd2c75c3147a69ff # v0.54.0 + uses: melodic-software/ci-workflows/.github/actions/check-managed-files@3a2c748fdef9cfb9ceec5a66289e21842189689f # v0.55.0 with: # `main` for the soak, per the action's own input contract ("Pin to # a full SHA in callers once soak completes"): the guard must read diff --git a/.github/workflows/pr-review-hosted.yml b/.github/workflows/pr-review-hosted.yml index 279b136..8ed8d04 100644 --- a/.github/workflows/pr-review-hosted.yml +++ b/.github/workflows/pr-review-hosted.yml @@ -81,7 +81,7 @@ jobs: # reviewed-head marker comment id-token: write # OIDC, mints the Claude GitHub App token (required # even with an OAuth/API-key credential) - uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@7b362428c76085a160e28656cd2c75c3147a69ff # v0.54.0 + uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@3a2c748fdef9cfb9ceec5a66289e21842189689f # v0.55.0 with: runner: ubuntu-24.04 # Bot senders this lane reviews, by numeric user id: the @@ -89,6 +89,14 @@ jobs: # reviewed. Where the repository does not set this variable the value is # empty and the reusable reviews no bot. allowed-bot-sender-ids: ${{ vars.AUTOMATION_LANES_APP_SENDER_ID }} + # People whose closing issues the review reads in full, by numeric user + # id: the `human` entries of components/trusted-actors/trusted-actors.json. + # trusted-actors.test.mjs fails when this value, in either claude-review + # component or standards' own pr-review.yml, differs from them. Empty + # would replace every person's closing issue with a placeholder. The + # bot ids in allowed-bot-sender-ids above also mark issues those bots + # wrote as trusted closing-issue context. + allowed-author-ids: '153232337' # Pass only the one named secret (least privilege) rather than # `secrets: inherit`, which would forward every parent secret to the # called workflow. diff --git a/.github/workflows/pr-review-security-hosted.yml b/.github/workflows/pr-review-security-hosted.yml index f559ebe..29c220f 100644 --- a/.github/workflows/pr-review-security-hosted.yml +++ b/.github/workflows/pr-review-security-hosted.yml @@ -74,7 +74,7 @@ jobs: # the lane's reviewed-head marker comment id-token: write # OIDC, mints the Claude GitHub App token (required # even with an OAuth/API-key credential) - uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@7b362428c76085a160e28656cd2c75c3147a69ff # v0.54.0 + uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@3a2c748fdef9cfb9ceec5a66289e21842189689f # v0.55.0 with: runner: ubuntu-24.04 # Bot senders this lane reviews, by numeric user id: the