ci: bump the pr-issue-linkage pin to the four-section contract - #25
Open
kyle-sexton wants to merge 1 commit into
Open
ci: bump the pr-issue-linkage pin to the four-section contract#25kyle-sexton wants to merge 1 commit into
kyle-sexton wants to merge 1 commit into
Conversation
The caller pinned melodic-software/ci-workflows' pr-issue-linkage reusable at c136b27f (v0.9.1), the oldest pin of the nine callers in the organization. That ref enforces only a closing keyword and a non-empty "## Related" section, so the "## Summary", "## Fix", and "## Verification" headings the inherited org pull request template asks for were never gated here. Move the pin to 7107b348 (v0.14.2), the ref six sibling repositories already run and the ref standards' runner-policy records a contract for. The reusable's workflow file is byte-identical from v0.14.2 through ci-workflows' main. The runner input is unchanged and still accepted at this ref. The job must now grant actions: read alongside pull-requests: read. The reusable at this ref declares both where v0.9.1 declared neither, a reusable cannot elevate caller permissions, and GitHub rejects it at startup when the caller grants a stricter set, so the required context would never materialize rather than report red. Standards' runner-policy records the same pair as this ref's minimumCallerPermissions. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
kyle-sexton
added a commit
to melodic-software/.github
that referenced
this pull request
Aug 30, 2026
No related issue: prerequisite pin bump. The drift check #58 specifies lands separately. ## Summary `.github/workflows/pr-issue-linkage.yml` pinned `melodic-software/ci-workflows`'s `pr-issue-linkage` reusable at `e9443874` (v0.10.2). At that ref the gate enforces exactly two things: a native closing keyword (or a no-issue marker) and a non-empty `## Related` section. The four-section contract — `## Summary`, `## Fix`, `## Verification`, `## Related` — landed upstream in `ci-workflows#153`, between v0.12.0 and v0.14.0, which is after this pin. So [`.github/PULL_REQUEST_TEMPLATE.md`](.github/PULL_REQUEST_TEMPLATE.md) and [`.claude/source-control.md`](.claude/source-control.md) have both been declaring three sections that nothing actually gated on this repository's pull requests. The two local declarations were not mirrors of an enforced contract; they were ahead of it. This repository was one of two callers out of nine in the organization still short of that contract (the other, `codex-plugins`, is bumped in melodic-software/codex-plugins#25). ## Fix Move the pin to `7107b34832a7b6db5d08d3b132621c599fbe5e50` (v0.14.2) and update the workflow's header comment to describe the contract that ref actually enforces. - **Why v0.14.2.** It is the ref six sibling repositories already run (`claude-code-plugins`, `dotfiles`, `github-iac`, `medley`, `provisioning`, `standards`), and the reusable's workflow file is byte-identical from v0.14.2 through `ci-workflows`' `main`, so v0.14.0-and-later is one contract rather than several. Standards' runner-policy records an `approvedReusableWorkflowContracts` entry for this exact path-and-SHA. - **Why the job now grants permissions.** The reusable at this ref declares `pull-requests: read` (to read the PR body it validates) and `actions: read` (for its cancelled-versus-timed_out prerequisite resolver); v0.10.2 declared neither. A reusable cannot elevate caller permissions, and GitHub rejects it at startup when the caller grants a stricter set — leaving `permissions: {}` would mean the required check context never materializes at all, rather than reporting red. Standards' runner-policy records the same pair as this ref's `minimumCallerPermissions`, so this is a floor and not a surplus grant. - **No `select-runner` job added.** This repository vendors no runner-policy component and `ci.yml` has no selector-conformance lane; every lane runs on hosted runners. The reusable's `runner` input defaults to `ubuntu-24.04`, so the thin caller shape is preserved. - **No `exempt-authors` added.** It is optional at this ref and defaults to exempting no one. Adding a bypass is a separate policy decision — see Related for the pre-existing condition it would address. ### Behavior change this lands, on purpose Once merged, `## Summary`, `## Fix`, and `## Verification` become gating on this repository's pull requests, matching what both local declarations already say and what six sibling repos already enforce. Because the gate runs on `pull_request_target`, it evaluates the **base-branch** definition. So open pull requests that lack the three sections go red on their next `synchronize`, `edited`, or `reopened` event after this merges, without any change of their own. The queue is empty right now (zero open PRs), so nothing is affected today. `melodic-standards-sync[bot]` already writes all four sections, verified against #100, so the recurring sync PRs stay green. This pull request itself is validated by the v0.10.2 definition on `main`, not the one it introduces. ## Verification - Resolved the tag to a full SHA rather than trusting the short form: `gh api repos/melodic-software/ci-workflows/git/ref/tags/v0.14.2` returns `7107b34832a7b6db5d08d3b132621c599fbe5e50`, `type: commit` (a lightweight tag, so no dereference step), committed 2026-08-13. - Read the reusable's `workflow_call` contract at that exact SHA. Inputs are `runner` (default `ubuntu-24.04`), `prerequisite-result` (default `success`), and `exempt-authors` (default `""`) — all optional, so a caller passing no `with:` block is valid. Its top-level `permissions` block is `pull-requests: read` + `actions: read`. - Confirmed standards' `components/runner-policy/policy.json` carries `approvedReusableWorkflowContracts["melodic-software/ci-workflows/.github/workflows/pr-issue-linkage.yml@7107b34832a7b6db5d08d3b132621c599fbe5e50"]` with `allowedInputs: ["runner", "prerequisite-result", "exempt-authors"]` and `minimumCallerPermissions: {pull-requests: read, actions: read}`. The same SHA is also in `approvedSelectorReferencesByRepositoryOwner`, but that array governs `select-runner.yml` only. - Confirmed `standards`' `repin-policy-lockstep.mjs` operates on standards-owned caller files (`components/claude-lanes/*`, its own `.github/workflows/claude-review.yml`) for the claude-review / claude-security-review / standards-sync reusables. It does not sweep this repository, and does not cover `pr-issue-linkage`. - Confirmed `.github/PULL_REQUEST_TEMPLATE.md` already carries all four `##` headings and `.claude/source-control.md` already lists all four under `pr_body_required_sections`, so no local declaration needs to change alongside the bump. - `actionlint .github/workflows/pr-issue-linkage.yml` — clean. - `typos --config _typos.toml .github/workflows/pr-issue-linkage.yml` — clean. - Diffed the caller against `dotfiles` and `provisioning`, both already on `7107b348`, to confirm the permissions pair is what those callers grant. ## Related - Refs #58 — this bump is the prerequisite that issue's escalation comment identified ("Prerequisite (separate reviewed PR)... Then #58 executes mechanically"). #58's own acceptance criteria are a local drift check comparing both mirrors against the pinned reusable, which this pull request deliberately does not implement; #58 stays open and is now unblocked. - Refs melodic-software/ci-workflows#153 — the upstream change that introduced the four-section `requiredSections` array. - Refs melodic-software/codex-plugins#25 — the same bump for the other stale caller, taking that repository from v0.9.1 to v0.14.2. - Pre-existing, untouched here: Dependabot pull requests already fail `pr-issue-linkage` at the current pin (verified on #37, which failed the check and was merged anyway). `provisioning` and `dotfiles` set `exempt-authors: 'dependabot[bot],melodic-standards-sync[bot]'`; this repository sets nothing. The bump neither creates nor worsens that, so fixing it belongs in its own change. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/workflows/pr-issue-linkage.ymlpinnedmelodic-software/ci-workflows'spr-issue-linkagereusable atc136b27f(v0.9.1) — the oldest of the ninepr-issue-linkagecaller pins in the organization. At that ref the gate enforcesexactly two things: a native closing keyword (or a no-issue marker) and a
non-empty
## Relatedsection.The four-section contract —
## Summary,## Fix,## Verification,## Related— landed upstream inci-workflows#153, between v0.12.0 andv0.14.0, which is well after this pin. This repository has no
.github/PULL_REQUEST_TEMPLATE.mdof its own, so it inherits the org-wide onefrom
melodic-software/.github,which asks for all four
##sections. Three of the four have never actually beengated here.
No linked issue — a stale dependency pin found while resolving
melodic-software/.github#58,which surfaced this repository as the second of the two callers behind the
contract. Not itself a tracked change.
Fix
Move the pin to
7107b34832a7b6db5d08d3b132621c599fbe5e50(v0.14.2).(
claude-code-plugins,dotfiles,github-iac,medley,provisioning,standards), and the reusable's workflow file is byte-identical from v0.14.2through
ci-workflows'main, so v0.14.0-and-later is one contract ratherthan several. Standards' runner-policy records an
approvedReusableWorkflowContractsentry for this exact path-and-SHA.actions: read. The reusable at this ref declarespull-requests: read(to read the PR body it validates) andactions: read(for its cancelled-versus-timed_out prerequisite resolver); v0.9.1 declared
neither. A reusable cannot elevate caller permissions, and GitHub rejects it at
startup when the caller grants a stricter set — the required check context
would then never materialize at all, rather than reporting red. Standards'
runner-policy records the same pair as this ref's
minimumCallerPermissions,so this is a floor and not a surplus grant.
permissionsreplaces the workflow-level block outright, so bothscopes are listed on the job. The workflow-level
permissions: pull-requests: readis deliberately left alone to keep the diff minimal; a job block maygrant scopes the workflow block omits, so this is not a mismatch.
runner: ubuntu-24.04is unchanged.runneris still an accepted input atthis ref and is still in the policy's
allowedInputs.(
# 7107b34 2026-08-13 v0.14.2), matching the two sibling pins inpr-title.ymlanddo-not-merge.yml.Behavior change this lands, on purpose
Once merged,
## Summary,## Fix, and## Verificationbecome gating on thisrepository's pull requests, matching the inherited org template and the six
sibling repos already on this ref.
Because the gate runs on
pull_request_target, it evaluates the base-branchdefinition. So open pull requests that lack the three sections go red on their
next
synchronize,edited, orreopenedevent after this merges, without anychange of their own. The queue is empty right now (zero open PRs), so nothing is
affected today. This pull request itself is validated by the v0.9.1 definition on
main, not the one it introduces.Verification
gh api repos/melodic-software/ci-workflows/git/ref/tags/v0.14.2returns7107b34832a7b6db5d08d3b132621c599fbe5e50,type: commit(a lightweight tag,so no dereference step), committed 2026-08-13.
workflow_callcontract at that exact SHA. Inputs arerunner(defaultubuntu-24.04),prerequisite-result(defaultsuccess),and
exempt-authors(default""). No input this caller passes was renamed orremoved, and none of the added ones is required. Its top-level
permissionsblock is
pull-requests: read+actions: read.components/runner-policy/policy.jsoncarriesapprovedReusableWorkflowContracts["melodic-software/ci-workflows/.github/workflows/pr-issue-linkage.yml@7107b34832a7b6db5d08d3b132621c599fbe5e50"]with
allowedInputs: ["runner", "prerequisite-result", "exempt-authors"]andminimumCallerPermissions: {pull-requests: read, actions: read}.dotfilesandprovisioning, both already on7107b348, to confirm the permissions pair is what those callers grant.actionlint .github/workflows/pr-issue-linkage.yml— clean.typos --config _typos.toml .github/workflows/pr-issue-linkage.yml— clean.npm run validate—PASS: marketplace D:\worktrees\codex-plugins-pin-lane; 0 error(s), 0 warning(s).Not changed and worth naming: this repository has no
.claude/source-control.md, so there is no localpr_body_required_sectionsdeclaration to keep in step with the bump.
Related
melodic-software/.github#58— the investigation that surfaced this pin as stale; its addendum is where the
nine-caller comparison table comes from.
melodic-software/.github#105— the same bump for the other stale caller, taking that repository from
v0.10.2 to v0.14.2.
melodic-software/ci-workflows#153— the upstream change that introduced the four-section
requiredSectionsarray.
melodic-software/.github— the org-wide pull request template this repository inherits, which already
carries all four
##sections.