[kyle-sexton]

No related issue: follow-up to ci-workflows#875, which claude-code-plugins' two review callers will pin to.

Summary

Registers pr-review-cli.yml@e7f935fc799fc9c78f1dc52646e8bbd54823502a, which is ci-workflows v0.65.2.

Fix

v0.65.2 changes only how pr-review-cli.yml works inside its jobs:

• Each job now writes the job token's api-budget notice.
• The hold step no longer adds the cost hold again once the owner has recorded a cost decision for the pull request.

The on.workflow_call inputs, secrets and runner are the same. git diff b49ac366..e7f935fc -- .github/workflows/pr-review-cli.yml changes the header comment, the allowed-author-ids description and the jobs only. That input's name and type are unchanged, and only its description now also covers whose cost decision counts. The contract lists input names, so it copies its v0.65.1 entry forward verbatim.

Verification

• node --test runner-policy.test.mjs in components/runner-policy: 344 pass, 0 fail. This includes the new copy-forward test. It checks that the new entry deep-equals the v0.65.1 entry and that exactly one contract names the new SHA.
• biome check on both changed files: clean.

Related

• Same shape as #864 (v0.65.1).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T04:30:52.131866Z	0898ead	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed 0898eade0797cf246150361071a470a3259e8a76: 0 finding(s), 0 as inline comments.

No security findings in PR #866 at head 0898ead.

The PR adds one approvedReusableWorkflowContracts entry to components/runner-policy/policy.json and one test in runner-policy.test.mjs. The entry is for pr-review-cli.yml pinned at e7f935fc…, the v0.65.2 SHA.

• The new entry matches the v0.65.1 entry (b49ac366…) field for field. Routing is hosted-only on ubuntu-24.04, the same 11 allowed inputs, and the same two secrets, REVIEWS_CLAUDE_API_KEY and REVIEWS_CLAUDE_CODE_OAUTH_TOKEN. It adds no input, secret, or runner, so nothing is widened.
• The pin is a full 40-character commit SHA, not a tag or branch ref.
• The new test asserts the copy is verbatim and that the SHA appears exactly once.
• I did not confirm that e7f935fc… is the commit behind the v0.65.2 tag. The check needed a gh api call to ci-workflows that the sandbox did not allow. The repo's repin lane and convergence tests should catch a wrong SHA.
• Diff-hit manifest items: none. The change touches no plugin manifest, instruction surface, or trust-gate path.

critical-findings: 0

[github-actions]

claude-review reviewed 0898eade0797cf246150361071a470a3259e8a76: 0 finding(s), 0 as inline comments.

No findings.

What I checked

• The new pr-review-cli.yml@e7f935fc… entry in components/runner-policy/policy.json (lines 951–971) matches the v0.65.1 entry (@b49ac366…, lines 930–950) line for line. I compared them by reading the file. Routing, fixed runner, the 11 allowed inputs and both secret mappings are the same.
• The new test in runner-policy.test.mjs copies the existing v0.65.1 copy-forward test. It checks two things: the new entry deep-equals the v0.65.1 entry, and exactly one contract key ends in the new SHA.
• The PR body follows the contract in .claude/rules/pr-body-contract.md: a No related issue: line with a reason, then Summary, Fix, Verification and Related sections. No body line starts with "committer".
• The PR has no closing issue and no manifest changes, so those criteria don't apply.

Not verified

• I did not run the test suite or biome. The "344 pass" and "biome clean" results in the PR body are the author's claims and I haven't confirmed them.
• I did not diff the upstream ci-workflows pr-review-cli.yml between the two tags. So "inputs, secrets and runner are unchanged in v0.65.2" is also the author's claim. The entry is internally consistent with v0.65.1, but I can't confirm the upstream contract didn't change.

Hold: none. Registering a contract adds no model call, trigger or spend, and the diff touches none of the trust-gate paths.