[kyle-sexton]

No related issue: Phase 8 step 3 of the org GitHub Actions conventions migration (one ci-workflows version everywhere).

Summary

Repins this repository's repo-owned ci-workflows references to v0.36.0 (fb56986), so every repo converges on one ci-workflows release. Sync-managed callers move separately through the standards repin and sync.

Fix

Repo-owned uses: melodic-software/ci-workflows/... pins move from v0.34.0 (7446b51) or v0.35.0 (69e506b) to fb56986808750d6856c27de78df15e150027b8dc # v0.36.0. Composite paths moved since v0.34.0 are mapped (comment-hygiene to check-comment-markers, machine-specific-paths to check-machine-paths) where pinned.

Verification

• Every pinned path exists at fb56986 in ci-workflows.
• actionlint on the changed workflows; the repo's own pin checks where it has them.
• Runner-policy contracts for every reusable at fb56986 merged in chore(runner-policy): approve ci-workflows v0.36.0 contracts standards#697.

Related

• chore(runner-policy): approve ci-workflows v0.36.0 contracts standards#697 (v0.36.0 contracts).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-04T22:19:00.100773Z	25ae3f8	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 48s —— View job

---

Security review — no issues found

• Gather context (PR diff, changed files)
• Apply skip gate
• Review changed files for security-relevant surface
• Check instruction-surface deletion lens on .claude/rules/pr-body-contract.md
• Post findings

Skip gate applied: this PR has no security-relevant surface requiring logic/trust-boundary review.

• .github/workflows/pr-automerge-dependabot.yml and .github/workflows/pr-require-checks.yml: only the pinned commit SHA (and its trailing version comment) changes for existing melodic-software/ci-workflows references. All refs remain full-length commit SHA pins — no pin is loosened to a branch/tag, no new trigger is introduced, and the permissions: blocks are unchanged. SHA-pin provenance/correctness (does fb56986... really correspond to v0.36.0) is exactly the kind of supply-chain verification zizmor and this repo's own pin checks cover, per this lane's charter — not re-reported here.
• .claude/rules/pr-body-contract.md: a version-number correction in prose (v0.34.0 → v0.36.0) describing which ci-workflows release renamed a composite path. This doesn't delete, narrow, or soften any rule — the contract and enforcement statement are unchanged — so the instruction-surface-deletion lens doesn't apply here.

No CRITICAL, IMPORTANT, or SUGGESTION findings.

[claude]

Claude finished @kyle-sexton's task in 2m 36s —— View job

---

Code review complete

• Gather context (PR diff, changed files, repo instructions)
• Invoke /review:code-review for PR ci: repin ci-workflows to v0.36.0 #91
• Post findings (inline comments for changed lines, summary for cross-file issues)
• Final summary

Summary

Reviewed the 3 changed files (.claude/rules/pr-body-contract.md, .github/workflows/pr-automerge-dependabot.yml, .github/workflows/pr-require-checks.yml) against origin/main via git show HEAD.

1 finding posted inline, on .claude/rules/pr-body-contract.md line 28:

.claude/rules/pr-body-contract.md is a sync-managed file (listed in .github/workflows/pr-check-managed-files-hosted.yml's managed-destination-paths list, distributed from melodic-software/standards per commit 3842583). This PR hand-edits its v0.34.0 → v0.36.0 text directly in this repo, which per this repo's own ADR-0007 ("a managed file is byte-exact with its standards source; the fix path is a standards change, never a downstream edit") means the edit isn't durable — the next standards-sync PR overwrites it regardless of what this PR does here. The fix belongs in the standards component source, not this repo. This check is advisory-only during soak, so it won't block CI, but it's worth correcting before merge.

The two genuinely repo-owned files — pr-automerge-dependabot.yml and pr-require-checks.yml — are correctly scoped (no SYNC-MANAGED FILE banner, not on the guard's path list) and the repin itself is mechanically consistent: both move to the single new SHA fb56986808750d6856c27de78df15e150027b8dc # v0.36.0, matching the old pins they replace (69e506b7... v0.35.0 and 7446b516... v0.34.0 respectively). I also confirmed the three sync-managed callers still pinned at v0.34.0 (pr-review-hosted.yml, pr-review-security-hosted.yml, pr-check-managed-files-hosted.yml) are correctly left out of this PR's scope, consistent with the PR body's claim that those move through the standards repin/sync instead.

Not independently verified (no network access in this session): that fb56986808750d6856c27de78df15e150027b8dc actually corresponds to ci-workflows v0.36.0, or that every pinned path exists at that SHA. The PR body's verification claims on those points are author-claimed, not confirmed here.

[github-actions]

claude-security-review has reviewed this pull request through 25ae3f8; a later push is reviewed from there.

[claude]

This file is sync-managed; this edit will be silently reverted and shouldn't be hand-made here.

.claude/rules/pr-body-contract.md is listed as a managed destination path in this same repo's .github/workflows/pr-check-managed-files-hosted.yml (line 41), which watches exactly "the sorted union of every sync target's managed destinations" for hand-edits. Per that workflow's own header (lines 3–18), this file is distributed from melodic-software/standards (components/.../pr-body-contract-rule per the chore: sync standards components (#88) commit, 3842583, that introduced the v0.34.0 wording this PR is now editing), and per ADR-0007: "a managed file is byte-exact with its standards source; the fix path is a standards change, never a downstream edit."

Concretely: this PR's edit here isn't durable. The next standards-sync PR will overwrite this line back to whatever melodic-software/standards currently has — if that source still says v0.34.0, this repin is reverted on the next sync; if the source has already moved on, this hand-edit is redundant. Either way, the three other files this PR correctly updates (pr-automerge-dependabot.yml, pr-require-checks.yml) are genuinely repo-owned (no SYNC-MANAGED FILE banner, not on the guard's path list), so the PR's own claim that "sync-managed callers move separately through the standards repin and sync" is true for those but inconsistently applied here — this file should have been excluded from this PR and the version bump made in the melodic-software/standards component instead.

Note: pr-check-managed-files-hosted is advisory during soak (not aggregated into ci-status), so this won't block the merge, but it is a real process violation worth fixing before merge rather than after a sync silently clobbers it.

[github-actions]

claude-review has reviewed this pull request through 25ae3f8; a later push is reviewed from there.