[kyle-sexton]

No related issue: follow-up to ci-workflows#874, which fixed a review-lane failure on claude-code-plugins#9545.

Summary

Registers pr-review-cli.yml@b49ac366bb3426039363a6927c41512e44533808 (ci-workflows v0.65.1), so claude-code-plugins' two review callers can re-pin to the release that passes the review between jobs as an artifact.

Fix

v0.65.1 changes only pr-review-cli.yml's jobs and its tests: the review and the last marker's summary now travel as a checked artifact instead of a job output, which the runner dropped whenever the text contained a registered secret's value. The workflow's on.workflow_call inputs, secrets and runner did not change (git diff d02b8697..b49ac366 -- .github/workflows/pr-review-cli.yml touches the header comment and jobs: only), so the contract copies its v0.65.0 entry forward verbatim.

Verification

• node --test runner-policy.test.mjs in components/runner-policy: 343 pass, 0 fail. That includes the new copy-forward test, which checks the new entry deep-equals the v0.65.0 entry and that exactly one contract names the new SHA.
• npx --no-install @biomejs/biome check (2.5.15) on both changed files: clean.

Related

• Same shape as #856 (v0.65.0) and #853 (v0.64.2).
• Next: the standards sync into claude-code-plugins, then that repository's review-caller re-pin.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T03:06:39.110889Z	743e237	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed 743e237e0e7d1b2a9c1772067b4e3f2f7f0a9b3c: 0 finding(s), 0 as inline comments.

Security review: PR #864 at 743e237

critical-findings: 0

No security issues found.

What the PR changes

• It adds one approvedReusableWorkflowContracts entry to components/runner-policy/policy.json. The entry is for pr-review-cli.yml@b49ac366… (the v0.65.1 pin).
• It adds a test in components/runner-policy/runner-policy.test.mjs. The test asserts the new entry deep-equals the v0.65.0 entry (@d02b8697…) and that exactly one entry exists for the new SHA.

What I checked

• I compared the new entry with the @d02b8697… entry in the file. They are identical:
  • routing is hosted-only, and fixedRunsOn is ubuntu-24.04.
  • the 11 allowedInputs are the same.
  • allowedSecrets is the same: CLAUDE_API_KEY and CLAUDE_CODE_OAUTH_TOKEN, mapped to the same REVIEWS_* secrets.
• The new entry grants no new input, secret, or runner, and it is pinned to a full 40-character SHA, not a tag or branch.
• The older pins stay approved, so the PR widens nothing for them. It only allows the new revision to be called with the same grants.
• The new test pins the copy-forward claim, so a later edit to the entry would fail it.

What I could not check

• I could not confirm that b49ac366… is the commit the v0.65.1 tag points to. The gh api call against melodic-software/ci-workflows needed approval that this lane did not have, and I did not work around that.
• I could not confirm the PR's claim that v0.65.1 changes only pr-review-cli.yml's internals (artifact instead of job output) and leaves its inputs, secrets and runner unchanged. That needs the upstream workflow file.
• Both checks are a one-time maintainer step on the ci-workflows release. Neither is a defect in this diff.

Other lenses

• This is not a trust-gate path, so no hold applies.
• No instruction-surface deletions or plugin manifests are touched, so the register lookup did not apply.
• No hold is returned.

[github-actions]

claude-review reviewed 743e237e0e7d1b2a9c1772067b4e3f2f7f0a9b3c: 0 finding(s), 0 as inline comments.

No findings.

The PR adds a pr-review-cli.yml@b49ac366… contract to components/runner-policy/policy.json. It also adds a copy-forward test in runner-policy.test.mjs.

What I checked myself:

• Copy-forward claim: the new entry at policy.json lines 930–949 is identical to the v0.65.0 entry at d02b8697… (lines 909–928). Routing, fixedRunsOn, all 11 allowedInputs and both allowedSecrets match.
• Test: the new test asserts deep equality with the v0.65.0 entry and that exactly one contract names the new SHA. It follows the same shape as the neighbouring tests at lines 9934 and 9954.

What I could not check:

• Workflow contents: I did not fetch ci-workflows at either SHA. The claim that v0.65.1 changes only the header comment and jobs: of pr-review-cli.yml is the author's and is unverified here.
• Test and lint results: I did not run the author's test and biome results (343 pass, biome clean), so they are author-claimed.

The PR body matches the contract in .claude/rules/pr-body-contract.md. It opens with No related issue: <reason>, has all four sections, and has no line starting with committer. There is no closing issue to check criteria against. There are no plugin manifests in the diff, and nothing holds the PR for a person: it adds no cost and touches no trust-gate files.