From fec28692e76230a261455587f8da4ef1bfa5d3d7 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Thu, 27 Aug 2026 10:20:49 -0400 Subject: [PATCH] ci: bump the pr-issue-linkage pin to the four-section contract The caller pinned melodic-software/ci-workflows' pr-issue-linkage reusable at e9443874 (v0.10.2), which enforces only a closing keyword and a non-empty "## Related" section. The four-section contract (Summary/Fix/Verification/ Related) landed upstream in ci-workflows#153 between v0.12.0 and v0.14.0, so this repository's PR template and .claude/source-control.md have been declaring three sections nothing actually gated. Move the pin to 7107b348 (v0.14.2), the ref six sibling repositories already run and the ref standards' runner-policy records a contract for. The reusable's workflow file is byte-identical from v0.14.2 through ci-workflows' main. The job must now grant pull-requests: read and actions: read. The reusable at this ref declares both where v0.10.2 declared neither, a reusable cannot elevate caller permissions, and GitHub rejects it at startup when the caller grants a stricter set, so permissions: {} would make the required context never materialize rather than report red. Standards' runner-policy records the same pair as this ref's minimumCallerPermissions. Co-Authored-By: Claude Fable 5 --- .github/workflows/pr-issue-linkage.yml | 29 ++++++++++++++++++-------- 1 file changed, 20 insertions(+), 9 deletions(-) diff --git a/.github/workflows/pr-issue-linkage.yml b/.github/workflows/pr-issue-linkage.yml index 9b4e427..773e891 100644 --- a/.github/workflows/pr-issue-linkage.yml +++ b/.github/workflows/pr-issue-linkage.yml @@ -1,13 +1,14 @@ name: pr-issue-linkage # Requires the PR body to carry a native closing keyword (or a no-issue marker) -# and a non-empty "## Related" section; the reusable below is authoritative on -# the exact accepted forms. Thin caller of the -# shared pr-issue-linkage reusable; the emitted required-check context is -# `pr-issue-linkage / pr-issue-linkage`. pull_request_target runs the -# base-branch definition (the gate reads PR body metadata only — no head code -# runs); `edited` re-validates on a body edit. Public repo: runs on the -# reusable's hosted default runner. +# plus non-empty "## Summary", "## Fix", "## Verification", and "## Related" +# sections; the reusable below is authoritative on the exact accepted forms. +# Thin caller of the shared pr-issue-linkage reusable; the emitted +# required-check context is `pr-issue-linkage / pr-issue-linkage`. +# pull_request_target runs the base-branch definition (the gate reads PR body +# metadata only — no head code runs); `edited` re-validates on a body edit. +# Public repo: no runner selector here, so the reusable's `runner` input is left +# at its `ubuntu-24.04` default. on: pull_request_target: types: [opened, edited, reopened, synchronize] @@ -21,5 +22,15 @@ concurrency: jobs: pr-issue-linkage: - permissions: {} - uses: melodic-software/ci-workflows/.github/workflows/pr-issue-linkage.yml@e94438746c300b02385a7f8a2a2dcd19a7f4ad4a # v0.10.2 + # The reusable's own permissions block requests both scopes where v0.10.2 + # requested neither: pull-requests: read to read the PR body it validates, + # and actions: read for its cancelled-versus-timed_out prerequisite + # resolver. A reusable cannot elevate caller permissions, and GitHub rejects + # it at startup when the caller grants a stricter set — the required context + # then never materializes at all, rather than reporting red. Standards' + # runner-policy records the same pair as this ref's + # `minimumCallerPermissions`, so it is a floor, not surplus. + permissions: + pull-requests: read + actions: read + uses: melodic-software/ci-workflows/.github/workflows/pr-issue-linkage.yml@7107b34832a7b6db5d08d3b132621c599fbe5e50 # v0.14.2