[kyle-sexton]

No related issue: hub finding on standards-sync PR #15429, where a fix-ci lane commit (80d79d1, Lane-Activity: pr-unblock/fix-ci) broke check-managed-files.

session: GitHub Support

Summary

fix-ci adopts idle PRs of every trusted account except Dependabot, and treats any bot-authored PR as idle. A red standards-sync PR was therefore adopted, and pr-unblock-dispatch started fix-ci on #15429 twice (runs 43106351279 and 43108671886). The first run pushed a commit, and check-managed-files refuses a sync-PR commit by any other author. A sync PR gets a fresh head only by re-running maintenance-sync-standards.yml.

Fix

• fix-ci-dispatch.mjs: new adoptableOwnerIds(trustedIds) filters the trusted list through fix-docs-dispatch's excludedAuthorIds (Dependabot, melodic-release[bot], melodic-standards-sync[bot]), so the two lanes share one list of authors whose PRs get no lane commit.
• dispatch.mjs: builds the adoption owner list with it, replacing the Dependabot-only filter.
• Lanes App PRs are unaffected: they are adopted by appSenderId, not through this list.

Verification

• node --test over fix-ci-dispatch, dispatch and fix-docs-dispatch tests: 200 pass, 0 fail.
• The new test reads the real trusted-actors.json, checks that the three excluded ids are present and that the adopted list equals the trusted list minus exactly those three, and checks that the lanes App stays adoptable.
• GitHub call count: unchanged (the filter runs before any call; R461 does not apply).

Related

• chore: sync standards components #15429 (the standards sync PR; GitHub Audit is fixing its contract at the source).

🤖 Generated with Claude Code

https://claude.ai/code/session_01VQb9Q1HHi6JACp77x2ZbE7

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T22:20:19.490809Z	fd9e40a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed 798829c2fb1ed910ea123be98d5a6ecc67a5671a: read 1 of 1 changed file(s); 0 finding(s), 0 as inline comments.

Security review: PR #15447 (incremental, 4e340f7 → 798829c)

No security issues found. I read every hunk of the one file in scope, .github/actions/resolve-config/dispatch-limits.test.mjs.

What changed. Only the test changed. It now checks that fix-ci adopts a trusted Bot PR (id 209825114) at once, and that it never adopts a PR from the release App (337859524) or the standards-sync App (300666570): for those two, dispatched is ["40"]. Before this push, the test expected the release App's PR to be adopted. The new expectations match the PR's stated fix: adoptableOwnerIds filters through excludedAuthorIds. That fix was reviewed at earlier heads.

Trust-control check. The file matches the trusted-path glob .github/actions/resolve-config/**, so I read its whole incremental change. It is a resolve-config test, and the lane's rules say resolve-config's tests, fixtures and docs are not the token-broker control. It changes no code path, token scope, trusted-actor list or merge hold. The behaviour it pins is narrower than before: fewer authors' PRs get a lane commit. It widens nothing.

Not applicable here:

• No plugin manifest changes.
• No standing instruction is deleted or narrowed.
• No workflow changes.
• The PR context and settled threads contain no embedded instructions aimed at this review.
• The one settled thread (a doc-comment placement in fix-ci-dispatch.mjs) is outside this push's scope.
• The prior-findings file lists only the earlier summary, which had 0 findings, so nothing carries over.

Scope: this review was blocking only (blocking only: yes), so it would have reported only CRITICAL and IMPORTANT findings. There were none.

Spend: none.

critical-findings: 0

[github-actions]

claude-review: 1 inline finding(s) on fd9e40a8e373366861899bff2787b3420c7496ad; the summary is in this lane's pull request comment.

claude-lane: claude-review

[github-actions]

claude-review reviewed 798829c2fb1ed910ea123be98d5a6ecc67a5671a: read 1 of 1 changed file(s); 0 finding(s), 0 as inline comments.

Code review (incremental, blocking only): 4e340f7 → 798829c

What I read: every hunk of the one file this push changed, .github/actions/resolve-config/dispatch-limits.test.mjs. For context I also read lines 1–200 of that file at head, the adoption logic in fix-ci-dispatch.mjs, and the bot entries in trusted-actors.json.

What changed: the push updates the test the base config's adoption section lets fix-ci adopt an idle owner PR to match the PR's fix:

• A trusted Bot (claude[bot], 209825114) is still adopted at once (#L158-L162).
• A melodic-release[bot] (337859524) PR is no longer dispatched.
• A new case checks that a melodic-standards-sync[bot] (300666570) PR is never dispatched either (#L163-L170).

Checks I made by reading the code:

• All three ids match the entries in .github/standards/trusted-actors/trusted-actors.json (lines 7, 10 and 16).
• The sync fixture sets no updatedAt, but that does not make its assertion pass for the wrong reason. Bot authors return early in fix-ci-dispatch.mjs (#L221), before the idle check reads updatedAt. So only the adoptableOwnerIds exclusion can keep that PR from being dispatched.

I ran no tests: this lane has no shell. The author reports 200 passing tests; that claim is unverified here.

Prior findings: none open. My earlier advisory (the doc comment on the wrong function) was fixed in the previous push.

Blocking only: this lane already reviewed an earlier head, so this review reports blocking findings only. I found none.

Closing issue: none. The PR names no closing issue, so there were no acceptance criteria to check.

Trusted paths: the changed file is under .github/actions/resolve-config/**, so it got extra scrutiny. It is a test file only and changes no runtime gate.

Spend: none. The push changes tests only.

Findings (0).