[kyle-sexton]

Refs: melodic-software/claude-code-plugins#9326

Summary

Registers pr-review-cli.yml@9aca743c4ed9aaf7870288a36586c3994e9321e4 (ci-workflows v0.64.1), so claude-code-plugins callers can re-pin to it.

Fix

v0.64.1 changes only pr-review-cli's extract and publish steps and its continue-on-error wiring (ci-workflows#868). A malformed review comment no longer drops the whole review, and the status job now goes red in comments mode when no review happened. The contract copies the v0.64.0 entry forward verbatim: same routing, inputs (including hold-label and hold-paths) and secrets.

Verification

• node --test runner-policy.test.mjs in components/runner-policy: 339 pass, including the new copy-forward test.

Related

• Same shape as #849 (v0.63.1).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T06:56:50.579586Z	84dc670	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed 84dc670e69ea41d341a09f64fef54fc816ef79ba: 0 finding(s), 0 as inline comments.

No findings. The PR registers the pr-review-cli.yml@9aca743c… contract in components/runner-policy/policy.json.

• I compared the new entry with the v0.64.0 (4edeccd8…) entry in the checked-out policy.json. Routing, fixedRunsOn, the 11 allowed inputs (including hold-label and hold-paths) and both secrets are identical. This matches the PR's "copied forward verbatim" claim.
• The README paragraph follows the style of the v0.63.1 and v0.64.0 paragraphs.
• The new test asserts that the entry deep-equals the v0.64.0 entry and that exactly one key ends in the new SHA.
• I did not run the test suite. The PR's "339 pass" figure is author-claimed.
• I could not check that 9aca743c… is the commit the v0.64.1 tag points to. The gh api call needed approval and was not run. The README and PR body assert it, so confirm it before merge.
• The PR context file has no closing issue (Refs: only), so there are no acceptance criteria to check.
• No .claude/rules/ file has a paths: glob matching these files. The PR body contract rule in AGENTS.md is advisory and the body follows it.
• Hold classes (cost, trust-gate, critical-security): none apply. The change adds no spend, touches no trusted-actors, CODEOWNERS or .gitmodules files, and has no security finding.

[github-actions]

claude-security-review reviewed 84dc670e69ea41d341a09f64fef54fc816ef79ba: 0 finding(s), 0 as inline comments.

Security review: PR #851 (head 84dc670)

No security findings.

The PR touches three files:

• components/runner-policy/policy.json
• components/runner-policy/README.md
• components/runner-policy/runner-policy.test.mjs

It adds one entry to approvedReusableWorkflowContracts, for melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@9aca743c4ed9aaf7870288a36586c3994e9321e4 (v0.64.1). I compared it against the existing v0.64.0 entry (@4edeccd8…, policy.json lines 794-814) and the two are identical:

• Routing: hosted-only, with fixedRunsOn: ["ubuntu-24.04"].
• Inputs: the same 11 allowedInputs.
• Secrets: the same two entries, REVIEWS_CLAUDE_API_KEY and REVIEWS_CLAUDE_CODE_OAUTH_TOKEN.

The PR therefore adds no input, secret, permission or routing capability. The new entry is a pinned 40-character SHA of an org-owned workflow, not a floating ref. The README text and the new test, which asserts the entry matches v0.64.0 and appears once, are consistent with the policy change.

Limits: I could not confirm that the new SHA is the actual v0.64.1 tag commit. The gh api tag lookup needed approval, so I did not run it. Pin-provenance checking is also zizmor and runner-policy's lane.

Skipped checks:

• Trust gate: the PR touches no trusted-actors, check-trusted-trigger, CODEOWNERS or .gitmodules path, so no trust-gate hold applies.
• Instruction surfaces and manifests: it removes or softens no instruction-surface rule and touches no plugin manifest, so those checks don't apply.

critical-findings: 0