From dcb7e17ca1cbe594476a33da39210d4036526d99 Mon Sep 17 00:00:00 2001
From: "melodic-standards-sync[bot]"
 <300666570+melodic-standards-sync[bot]@users.noreply.github.com>
Date: Fri, 9 Oct 2026 03:37:00 +0000
Subject: [PATCH] chore: sync standards components
 (f82376a5e7210afe0ce5f750cb61b4b8d0aafd6e)

---
 .github/workflows/pr-check-managed-files-hosted.yml | 2 +-
 .github/workflows/pr-review-hosted.yml              | 2 +-
 .github/workflows/pr-review-security-hosted.yml     | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/pr-check-managed-files-hosted.yml b/.github/workflows/pr-check-managed-files-hosted.yml
index 8675d98..8c1fc3f 100644
--- a/.github/workflows/pr-check-managed-files-hosted.yml
+++ b/.github/workflows/pr-check-managed-files-hosted.yml
@@ -103,7 +103,7 @@ jobs:
         # now contains that commit, so the pin-comment takes the convention's
         # release-tag form rather than the short-SHA fallback
         # (components/managed-files-guard/README.md).
-        uses: melodic-software/ci-workflows/.github/actions/check-managed-files@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
+        uses: melodic-software/ci-workflows/.github/actions/check-managed-files@ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3
         with:
           # `main` for the soak, per the action's own input contract ("Pin to
           # a full SHA in callers once soak completes"): the guard must read
diff --git a/.github/workflows/pr-review-hosted.yml b/.github/workflows/pr-review-hosted.yml
index ffd120b..2210977 100644
--- a/.github/workflows/pr-review-hosted.yml
+++ b/.github/workflows/pr-review-hosted.yml
@@ -80,7 +80,7 @@ jobs:
                              # reviewed-head marker comment
       id-token: write        # OIDC, mints the Claude GitHub App token (required
                              # even with an OAuth/API-key credential)
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3
     with:
       runner: ubuntu-24.04
     # Pass only the one named secret (least privilege) rather than
diff --git a/.github/workflows/pr-review-security-hosted.yml b/.github/workflows/pr-review-security-hosted.yml
index 2d3f979..d49727e 100644
--- a/.github/workflows/pr-review-security-hosted.yml
+++ b/.github/workflows/pr-review-security-hosted.yml
@@ -81,7 +81,7 @@ jobs:
     concurrency:
       group: pr-review-security-${{ github.event.pull_request.number || github.run_id }}
       cancel-in-progress: false
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3
     with:
       runner: ubuntu-24.04
     # Pass only the one named secret (least privilege) rather than