[kyle-sexton]

Refs: melodic-software/ci-workflows#879

Summary

Registers the pr-review-cli.yml reusable-workflow contract at ci-workflows v0.65.6 (914264587c35692c15e05c965103426eec18d1f0), so callers pinned to that release pass runner-policy.

Fix

Copies the v0.65.5 entry (@f1096608192c54cfb3dc252e36670e6f86700b9b) forward in components/runner-policy/policy.json and adds the matching copy-forward test in runner-policy.test.mjs, as #870 and #871 did. Earlier pins stay as history. gh api compare v0.65.5...v0.65.6 on ci-workflows lists three changed files; the pr-review-cli.yml patch is comment-only (ci-workflows#879: a cost decision carries no further once a pull request comment was deleted since its hold marker), so inputs, secrets and permissions are unchanged.

Verification

• node components/runner-policy/runner-policy.mjs --root <worktree>: Runner policy passed.
• node --test components/runner-policy/runner-policy.test.mjs: 348 tests, 348 pass, 0 fail.

Related

• fix(apply-review-hold): carry no cost decision past a deleted comment ci-workflows#879 (the fix released as v0.65.6)
• feat(runner-policy): register the ci-workflows v0.65.5 pr-review-cli contract #871 (the v0.65.5 contract)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T15:15:33.174790Z	e1c7463	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed e1c7463e86d72af2ee51fd59485ab500074dfe25: 0 finding(s), 0 as inline comments.

No security issues found in PR #874 (head e1c7463).

Scope: The PR changes two files, components/runner-policy/policy.json and components/runner-policy/runner-policy.test.mjs. It adds an approved-reusable-workflow contract for pr-review-cli.yml at ci-workflows v0.65.6 (914264587c35692c15e05c965103426eec18d1f0).

Checks:

• The new entry is a verbatim copy of the v0.65.5 entry (f1096608…), which I compared line by line. It has the same hosted-only routing, the same fixedRunsOn of ubuntu-24.04, the same 11 allowed inputs and the same two REVIEWS_* secret mappings.
• It adds no input, no secret and no runner. The allowlists stay as narrow as before, and the entry is keyed by a full 40-character commit SHA, so it is pinned.
• The added test asserts that the new entry deep-equals the v0.65.5 entry and that exactly one key exists for the new SHA. That guards against drift.
• The diff touches no trust-gate path (trusted-actors, check-trusted-trigger, CODEOWNERS, .gitmodules). It also touches no plugin manifest and removes or softens no standing instruction.

Not verified: I could not confirm that 914264587c35… is the commit the v0.65.6 tag points to. The tag lookup against ci-workflows needed approval that wasn't available. The claude-lanes-repin lane or the convergence tests in this repo are the places that check pin provenance.

critical-findings: 0

[github-actions]

claude-review reviewed e1c7463e86d72af2ee51fd59485ab500074dfe25: 0 finding(s), 0 as inline comments.

No findings.

The PR adds a pr-review-cli.yml@914264587c35… (v0.65.6) contract to components/runner-policy/policy.json. I compared it with the v0.65.5 entry (@f1096608…) and the routing, fixedRunsOn, 11 allowedInputs and both allowedSecrets match. The new runner-policy.test.mjs test asserts exactly this and checks that only one entry exists for the new SHA. It follows the existing copy-forward tests.

I did not run the test suite or the runner-policy check. The Verification section's results are author-claimed and unverified by me. I did not check ci-workflows v0.65.6's actual workflow inputs, so the claim that its changes are comment-only is also author-claimed.

The PR body follows the contract: a Refs: line plus Summary, Fix, Verification and Related sections. It names no closing issue, so there are no acceptance criteria to check. No hold class applies. The change adds no model spend, doesn't touch trusted-actors, CODEOWNERS or .gitmodules, and has no critical security issue.