chore(ci): pin ci-workflows composites to v0.24.0

[kyle-sexton]

No related issue: this is one repository's slice of a fleet-wide pin convergence tracked in github-iac, which stays open across the other repositories.

Summary

This repository resolved melodic-software/ci-workflows at two different
commits. The fifteen composite references in .github/workflows/ci.yml sat at
5776760254f8b63cba44e896f51604cb755350d9 (v0.22.2) while
.github/workflows/managed-files-guard.yml already called
2c1de45aa0e1b1489afb8edfebc12cb3a4fa6ac3 (v0.24.0). A repository that answers
to two upstream commits cannot be reasoned about as a unit, and the convergence
target for the fleet is v0.24.0.

Fix

Moved all fifteen composite pins in .github/workflows/ci.yml to
2c1de45aa0e1b1489afb8edfebc12cb3a4fa6ac3 # v0.24.0: actionlint,
check-jsonschema (five call sites), ci-status, editorconfig,
eol-renormalize, gitleaks, lychee-offline, markdown, pr-contract,
shellcheck, and typos. The pin comment moves with the SHA.

managed-files-guard.yml is SYNC-MANAGED and already on target, so it is not
touched. The repository has no .github/standards/ tree and makes no
reusable-workflow calls, so no synced policy.json governs these references.
Historical records that name older versions (.cursor/install.sh,
.github/dependabot.yml, the pr-section-drift test fixtures) are left alone.

Verification

Every action.yml for these composites is byte-identical between v0.22.2 and
v0.24.0 except ci-status, whose only change is the description text on
carry-forward-wait-seconds; no input was added, removed, or renamed, and its
default is unchanged. Every with: key at every call site is still a declared
input at v0.24.0, and all fifteen action paths exist at that commit.

The pr-section-drift lane derives its comparison target from the pr-contract
pin, so moving the pin moves what it checks against. The gate's
section_report calls are [Summary, Fix, Verification, Related] at both tags,
so the local mirrors still match.

Run locally from the branch:

• node --test .github/scripts/pr-section-drift.test.mjs — 26 passed, 0 failed.
• node .github/scripts/pr-section-drift.mjs — reported that the local mirrors
  match the pr-contract gate at 2c1de45aa0e1b1489afb8edfebc12cb3a4fa6ac3
  with sections [Summary, Fix, Verification, Related].
• actionlint — clean.
• bash .cursor/check.sh — nine of ten lanes pass; the editorconfig lane
  reports a failure only because the ec binary is absent from this machine's
  PATH. Running editorconfig-checker -config .editorconfig-checker.json
  directly exits 0.

git diff origin/main...HEAD is fifteen insertions and fifteen deletions in one
file; every removed line ends with the old pin and comment and every added line
with the new, with no whitespace or line-ending churn.

A fresh-context reviewer independently confirmed the convergence, the governance
runs, and the blast radius.

Related

Refs: melodic-software/github-iac#378

🤖 Generated with Claude Code

https://claude.ai/code/session_01M98vWnd3jQJ19Pe6Uj7bV9

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-15T12:58:11.875478Z	05bb008	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.