[cpitzi]

Part of lentago/.github#289.

This adds a caller for shared-workflows' agent-pr-gate.yml, pinned at v1.6.0, and moves the docs-check.yml caller from v1.4.0 to v1.6.0.

agent-pr-gate. A pull request the bullpen's runner App (lentago-claude-runner[bot]) authored passes this check only when a person with write access has approved its current head commit, or when cr-automerge armed it under a routine rule (lentago/.github ADR-0014). Every other pull request passes at once, without an API call, so human-authored pull requests merge as before.

• The caller is the shared-workflows README snippet, with a header comment added. It has no paths: filter, and its job id is agent-pr-gate, so the context reports as agent-pr-gate / agent-pr-gate.
• It is not required yet. Require the agent-pr-gate context on every operating repo (claytonia#117 option A) .github#289 makes it required in a separate pull request, after this repository is seen reporting it, so no pull request here is held on a check that has never run.
• Its known limit until agent-pr-gate, part 2: a verdict check posted by a dedicated GitHub App and required by its integration ID shared-workflows#97: the runner App can add a workflow that reports a passing check under the same name. Until then the gate stops a merge the App attempts by mistake, not one it is trying to force.

docs-check. Callers pinned to tags before v1.6.0 ran main's link resolver whatever tag they pinned (lentago/shared-workflows#95). v1.6.0 checks out the resolver at the reusable workflow's own commit and verifies it, so this pull request's docs-check log names ci/check_docs_links.py at 36d432c. No input or job name changes.

🤖 Generated with Claude Code

[github-actions]

Review (haiku, claude-review.yml)

1. major · .github/workflows/agent-pr-gate.yml (PR body) · Fleet rule 1 is not met. The body says "Part of Require the agent-pr-gate context on every operating repo (claytonia#117 option A) .github#289" but has no Closes, Fixes, or Resolves reference, so merging will not close any linked issue. The author should state the intended linkage explicitly, including whether #289 should close on this merge, since the body says the required-check change lands in a separate PR.

2. minor · .github/workflows/docs-check.yml:24 · The v1.4.0 → v1.6.0 pin move is a separate fix (shared-workflows#95, per the PR body) bundled into a PR titled for the agent-pr-gate caller. The body discloses it, but the title does not cover it. Splitting it into its own PR would keep the scope and the issue link clean.

3. minor · .github/workflows/agent-pr-gate.yml (job permissions) · I could not confirm that contents: read and pull-requests: read are sufficient for the reusable workflow at v1.6.0. The gh api lookup of shared-workflows/.github/workflows/agent-pr-gate.yml@v1.6.0 was blocked by the sandbox, so the permission block and input list are unchecked against the callee. The author or a reviewer with access should confirm before this becomes required.

4. minor · PR body, docs-check claim · The body says this PR's docs-check log will name ci/check_docs_links.py at 36d432c. I could not verify that commit or the tag's resolution from this environment. The claim should be checked against the actual run log after the workflow executes.

The rest of the caller looks consistent with the header comments: no paths: filter (intentional, so the check cannot sit at "Expected"), the trigger types are valid, the tag pin is semver rather than @main, and no secrets or Fluent Bit, Terraform, or cron files are touched.

[cpitzi]

Triage of the Haiku review above. No code changes. Each finding is declined or answered:

1. No closing keyword. Declined, on purpose. This is one of 16 caller pull requests for Require the agent-pr-gate context on every operating repo (claytonia#117 option A) .github#289. That issue closes with the separate lentago/.github pull request that makes the context required, and a Closes here would close it early.
2. docs-check bump bundled. Declined. Both changes come from the same shared-workflows release. The v1.6.0 notes ask each caller to bump in a pull request that runs the new verify step, and bundling saves a second pull request in 15 repos. The scope is recorded on Require the agent-pr-gate context on every operating repo (claytonia#117 option A) .github#289 (comment).
3. The pinned reusable workflow is unverified. Answered; I checked it outside the review's sandbox.
   • v1.6.0 is 36d432c.
   • The reusable job is named agent-pr-gate. It declares only contents: read and pull-requests: read, reads with GITHUB_TOKEN, and takes no secrets. A reusable workflow can narrow the caller's permissions but cannot widen them.
   • This pull request's own run reports agent-pr-gate / agent-pr-gate green (run).
   • docs-check logged Resolver: ci/check_docs_links.py at 36d432c2530a5880a464050a6b74ccb217266f1e, the commit of lentago/shared-workflows/.github/workflows/docs-check.yml@refs/tags/v1.6.0.
4. The pinned reusable workflow is unverified. Answered; I checked it outside the review's sandbox.
   • v1.6.0 is 36d432c.
   • The reusable job is named agent-pr-gate. It declares only contents: read and pull-requests: read, reads with GITHUB_TOKEN, and takes no secrets. A reusable workflow can narrow the caller's permissions but cannot widen them.
   • This pull request's own run reports agent-pr-gate / agent-pr-gate green (run).
   • docs-check logged Resolver: ci/check_docs_links.py at 36d432c2530a5880a464050a6b74ccb217266f1e, the commit of lentago/shared-workflows/.github/workflows/docs-check.yml@refs/tags/v1.6.0.