[kyle-sexton]

Restores rerun-contract-only-siblings: 'true' on aggregate-results (changed to a draft-conditional in #94, 01dd20d).

ready_for_review is not in this workflow's pull_request.types and no lane is draft-gated, so a draft full run runs every lane and re-running its red contract-only siblings is safe. Skipping the re-run on a draft could leave a yielded red contract-only ci-status with nothing to re-run it after ready. This repo has no refuse-a-draft step, so the other draft change does not apply.

Tests: actionlint .github/workflows/pr-require-checks.yml clean.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-05T01:42:19.928318Z	356cb4d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 44s —— View job

---

Security review

• Gather context (PR diff, workflow file)
• Apply skip gate
• Review diff for security-relevant changes
• Post findings / conclusion

Diff reviewed (.github/workflows/pr-require-checks.yml, line 131):

-          rerun-contract-only-siblings: ${{ github.event.pull_request.draft && 'false' || 'true' }}
+          rerun-contract-only-siblings: 'true'

No security issues found.

This is a one-line behavioral toggle to an existing, pinned (@d49c4915... / v0.37.0) composite action input (rerun-contract-only-siblings). It removes a conditional that previously disabled the sibling re-run on draft PRs, so the input is now always 'true'. Relevant checks:

• No change to permissions: (job already had contents: read, pull-requests: write, statuses: write, actions: write before this PR — unchanged here).
• No new trigger type, no pull_request_target/workflow_run introduced.
• No untrusted expression newly interpolated into a run: block — the changed line is a plain boolean literal passed to a composite action input, not a shell command.
• Fork PRs are unaffected either way: per the workflow's own comments, a fork PR's token is read-only on pull_request regardless of requested permissions:, so it never takes the contract-only/sibling-rerun path this flag controls.
• The change only widens when an already-existing, already-permissioned rerun action fires (removing the draft exclusion); it does not grant new capability, accept new untrusted input, or alter who can trigger it.

No GitHub Actions hardening findings either (dangerous triggers, expression injection, permission widening, or supply-chain/pin loosening) — none apply to this diff, so there's nothing to defer to zizmor.

This is a CI logic/reliability change, not a security-relevant change.

[claude]

Claude finished @kyle-sexton's task in 1m 15s —— View job

---

CI code review complete

• Gather context (PR diff, changed file)
• Review correctness and alignment with CLAUDE.md / REVIEW.md
• Post findings (inline or summary)

No findings. This is a well-scoped, single-line revert of rerun-contract-only-siblings back to unconditional 'true' on the aggregate-results step (line 134).

Verified independently against the current file rather than taking the PR body's claims at face value:

• on.pull_request.types (line 24) is [opened, synchronize, reopened, edited, labeled, unlabeled] — confirmed ready_for_review is absent, so a draft→ready transition alone never fires a new pull_request event on this workflow.
• Neither validate-marketplace's if: (line 74) nor ci-status's if: (line 95) gates on github.event.pull_request.draft — confirmed no lane is draft-conditional, so a draft PR's full run exercises every lane exactly like a non-draft one. That makes the asymmetry the prior conditional introduced (skip the sibling re-run only on draft) unjustified here.
• grep for draft across the file after the change returns nothing, so the fix leaves no stale comment referencing the removed condition.
• The reasoning holds: without this fix, a contract-only run (e.g. from a labeled/unlabeled/edited event) that races and loses to an in-flight full run on a draft PR would yield a red ci-status, and because there's no later event that re-runs it (no ready_for_review trigger, no refuse-a-draft step in this workflow), that red check could persist until someone manually re-runs the specific contract-only run.

Not independently verified: the PR's actionlint .github/workflows/pr-require-checks.yml clean claim (author-reported, no tool access to re-run actionlint in this session). npm test / npm run validate aren't applicable here — both scripts only exercise the plugin-marketplace validator, not GitHub Actions workflow YAML, so their omission isn't a gap.

[github-actions]

PR body contract — issue linkage

This PR body does not yet satisfy the issue-linkage contract:

• Missing a "## Summary" section. Describe what this PR changes and why, in a sentence or two.
• Missing a "## Fix" section. State the concrete change and how it addresses the problem.
• Missing a "## Verification" section. Record concrete evidence the change works (commands, gates, output).
• Missing a "## Related" section. List related PRs, ADRs, or decision-log entries this PR does not close.
• Missing a native closing keyword (Closes/Fixes/Resolves #N). If this PR references an issue it must not close, put "Refs: #N" (or "Relates to: #N") on its own line. If it relates to no GitHub issue at all, state "No linked issue" (or "No related issue:") in the body instead.

Edit the body and this comment updates itself on the next run.

[github-actions]

claude-security-review has reviewed this pull request through 356cb4d; a later push is reviewed from there.

[github-actions]

claude-review has reviewed this pull request through 356cb4d; a later push is reviewed from there.