[kyle-sexton]

Refs: melodic-software/claude-code-plugins#9307

Summary

Registers pr-review-cli.yml@83b739f625b501ad40c65dee7168d836883195e1 (ci-workflows v0.63.1) so claude-code-plugins#9307 can re-pin its security lane to it.

Fix

v0.63.1 changes only the publish step (ci-workflows#865: titled completion notice, demoted CRITICAL findings counted). The contract copies the v0.63.0 entry forward verbatim: same routing, inputs and secrets.

Verification

• node --test runner-policy.test.mjs in components/runner-policy: 337 pass, including the new copy-forward test.

Related

• Same shape as feat(runner-policy): register the ci-workflows v0.63.0 pr-review-cli contract #848 (v0.63.0).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T05:03:37.308100Z	9651290	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed 96512905b0ed3cf14d26042819df90d8ade49076: 0 finding(s), 0 as inline comments.

Security review: PR #849 at 9651290

No security findings.

critical-findings: 0

What changed: The PR touches three files in components/runner-policy/: the README, policy.json and the test file. It adds one entry to approvedReusableWorkflowContracts for pr-review-cli.yml at the ci-workflows v0.63.1 tag 83b739f625b501ad40c65dee7168d836883195e1.

Checks:

• Entry matches v0.63.0. The new entry is identical to the existing v0.63.0 entry at line 756 of policy.json. Both are hosted-only on ubuntu-24.04 with the same nine allowedInputs and the same two allowedSecrets mappings. The new test asserts this with deepEqual. It also asserts exactly one key ends with the new SHA.
• Pin is a full 40-character SHA. It is not a mutable ref, and the entry grants nothing wider than the existing allowlist.
• No permission, routing or secret widening. The routing is unchanged, there are no new inputs or secrets, and the secret mappings reference only the existing REVIEWS_* secrets.
• Older entries stay. The v0.63.0 entry was not removed, so this adds a trusted ref and narrows nothing.
• Not applicable. The PR has no plugin.json or marketplace.json change, so the manifest lines don't apply. It deletes or softens no standing instruction, so the instruction-surface lens doesn't apply either.

What I could not check: The README says v0.63.1 changes only the publish step, with no input, secret, permission or routing change. I could not verify that against the workflow file at the two ci-workflows tags. Reading another repository's contents needed approval that was not available in this session. A reviewer with access should confirm that pr-review-cli.yml at 83b739f has the same on.workflow_call inputs and secrets and the same permissions: as at 8778094. The protected-class register at docs/conventions/instruction-exception-register/README.md was not consulted. It was not needed, since the diff removes no instruction.

[github-actions]

claude-review reviewed 96512905b0ed3cf14d26042819df90d8ade49076: 0 finding(s), 0 as inline comments.

No findings. I read the full diff and the PR context, and compared the new policy entry with the existing one.

• Policy entry (components/runner-policy/policy.json): the new pr-review-cli.yml@83b739f6… entry matches the v0.63.0 entry (@87780947…) field for field. Routing, fixedRunsOn, the nine allowed inputs and both secret mappings are the same. I compared them by reading both blocks, not by running the new test.
• Test (runner-policy.test.mjs): the copy-forward test asserts deepEqual against the v0.63.0 entry and that exactly one key ends with the new SHA. It would fail if the entry drifted, and it matches the neighbouring v0.63.0 test.
• README: the new paragraph follows the existing per-tag pattern. One cosmetic point: its first line runs past the 80-column wrap the surrounding text uses. I did not report it as a finding.
• Not verified: I did not run the test suite, so the PR's "337 pass" is author-claimed. I did not check that 83b739f625b501ad40c65dee7168d836883195e1 is the v0.63.1 tag in ci-workflows, or that v0.63.1 changes only the publish step (ci-workflows#865). Both are author-stated.
• Closing issue: the PR uses Refs: melodic-software/claude-code-plugins#9307, so no issue closes and there are no acceptance criteria to check.
• Embedded instructions: the PR text has none.
• Rules: .claude/rules/pr-body-contract.md has no paths: scope. The PR body follows it: a Refs: line, then Summary, Fix, Verification and Related.