[kyle-sexton]

No related issue: owner decision D3 (rename the required gate to CI Status), step A for this repository.

Summary

The ci-status job now displays as CI Status. A new report-ci-status job, named ci-status, reports its conclusion under the old name. Until the ci-gate org ruleset requires CI Status, both contexts are on every head.

Fix

• name: CI Status on the ci-status job. The job id does not change.
• aggregate-results is pinned to melodic-software/ci-workflows@ac4d878 (feat(pr-require-checks): ignore gate alias jobs in run-shape reads ci-workflows#1072) with alias-jobs: ci-status. The run-shape reads ignore the mirror, so a contract-only run still reads as contract-only. Between the old pin and ac4d878 the action only gained inputs, and the new ones default to the old behavior.
• report-ci-status runs on the gate job's own runner with permissions: {}, and fails unless CI Status succeeded.

Verification

• actionlint is clean.
• This PR's own checks report both CI Status and ci-status.

Related

• ci: display the gate job as CI Status with a ci-status alias claude-code-plugins#15397 (same change)
• feat(pr-require-checks): ignore gate alias jobs in run-shape reads ci-workflows#1072 (alias-jobs)

🤖 Generated with Claude Code

https://claude.ai/code/session_01VQb9Q2ceZLXhTR4d1vkTCe

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-12T06:17:41.517995Z	53e5f6b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed 53e5f6b2bea331d4ebf273fd4b85f7a9afc88ffd: 0 finding(s), 0 as inline comments.

Review of #177: CI Status rename and ci-status mirror

Findings: 0. The diff touches one file, .github/workflows/pr-require-checks.yml.

What I checked (read the diff and the surrounding workflow myself):

• The job id ci-status is unchanged and only name: CI Status is added. report-ci-status is named ci-status, so both check contexts appear on each head, as the PR describes.
• report-ci-status uses needs: [ci-status], if: always() and needs.ci-status.result. It fails on any result except success, including cancelled and skipped. permissions: {} is the least privilege it needs.
• The alias-jobs: ci-status input sits beside the existing yield-to-full-run and rerun-contract-only-siblings inputs. That fits the stated purpose of keeping the mirror out of the run-shape reads.
• Other references to ci-status in REVIEW.md, docs/ and the other workflows' comments name the gate generically. Nothing breaks while both contexts exist. A later doc rename can follow once the ruleset requires CI Status.
• There is no closing issue: the body says No related issue: owner decision D3. So there are no acceptance criteria to check.
• The one rule file, .claude/rules/pr-body-contract.md, is satisfied. The body has Summary, Fix, Verification and Related sections plus the no-issue line.

Not independently verified (author-claimed): the actionlint result and the claim that the PR's own checks show both contexts. I did not run actionlint or confirm the check runs.

Advisory, not counted: the new aggregate-results pin carries # ac4d878 2026-11-11 instead of the # vX.Y.Z tag the other pins use. The commit is not a tagged release, so a pin-comment convention or Dependabot grouping could treat it differently. I found no check in the repository that enforces it, and the PR explains the pin.

Skip gate: the PR is open and not a draft, and nothing excused the review. The security lane is out of scope here. The workflow change adds no new permissions.

[github-actions]

claude-security-review reviewed 53e5f6b2bea331d4ebf273fd4b85f7a9afc88ffd: 0 finding(s), 0 as inline comments.

Security review: PR #177 (head 53e5f6b)

No security findings. Nothing held.

The only file changed is .github/workflows/pr-require-checks.yml.

• name: CI Status on the ci-status job: only the display name changes. No control moves.
• New report-ci-status job (check name ci-status):
  • It runs with permissions: {}, so it holds no token scope.
  • The only input is needs.ci-status.result, which reaches the shell through env: RESULT, not through ${{ }} inside run:, so there is no expression injection.
  • [ "$RESULT" = success ] fails closed. A failure, skipped or cancelled result all make the mirror check fail, so it cannot pass a PR the gate stopped.
  • if: always() only ensures a result is always reported.
• alias-jobs: ci-status input: it tells the aggregator to ignore the mirror job when reading run shape. It adds no new trust.
• aggregate-results pin: it moves from the v0.39.8 tag to the full 40-hex commit ac4d8780… in the same org's ci-workflows, so it is still pinned by SHA. I could not inspect that commit's contents (the sandbox blocked the lookup), so whether the gate's semantics changed in the newer action is unverified here. Pin hygiene is zizmor's lane, so I did not report it.
  • The bump moves the pin to an untagged commit instead of a release tag.
  • The reviewer should confirm that the new commit still fails closed and that treat-skipped-as: fail is still honored.

Manifest lines: none. The diff touches no plugin or marketplace manifests, and it deletes or softens no standing instructions.

critical-findings: 0