ci: converge ci-workflows references on v0.24.0

[kyle-sexton]

Summary

This repository converges its melodic-software/ci-workflows references on the
program's single target SHA 2c1de45aa0e1b1489afb8edfebc12cb3a4fa6ac3
(v0.24.0). It is the last consumer repository still carrying v0.22.2 pins; every
other consumer is already there. Twenty-two references move, and with
managed-files-guard.yml already at the target, all twenty-three references in
the repository now sit on one SHA.

Fix

Nineteen of the twenty-two are composite actions in .github/workflows/ci.yml:
change-detection, markdown, typos, gitleaks, editorconfig,
shellcheck (twice), actionlint, check-jsonschema (five call sites),
exec-bit, machine-specific-paths, eol-renormalize, comment-hygiene,
pr-contract and ci-status. The other three are reusable workflows:
claude-review.yml, claude-security-review.yml and issue-triage-label.yml.

Every # vX.Y.Z comment moves with the pin it annotates, so each of the
twenty-two now reads # v0.24.0. Nothing in this repository checks that a
version comment resolves to the SHA beside it, so the comment is only as good as
the change that writes it; the pin and the comment were replaced as one string,
which makes a mismatch structurally impossible rather than merely unobserved.

No input, secret or permission this repository passes changed. Between v0.22.2
and v0.24.0 the only edits to the paths consumed here are the ci-status
composite's input documentation (the sizing guidance for
carry-forward-wait-seconds, whose name and 240 default are unchanged) and the
inner anthropics/claude-code-action pin inside the two Claude reusables
(v1.0.215 to v1.0.216). The remaining ci-workflows edits in that range are to
scripts and paths this repository does not call, or to workflows it never
referenced.

issue-triage-label.yml moves for the first time here: it was held back on
v0.22.2 because the standards-managed runner policy carried no reviewed contract
for it at the new pin. melodic-software/standards#571 registered that contract,
and the sync landed it in this repository's
.github/standards/runner-policy/policy.json in #4179, which merged before this
branch was cut. This branch does not touch .github/standards/**.

Verification

Run from the branch worktree at head 547d43bc:

• node .github/standards/runner-policy/runner-policy.mjs --root . (after
  npm ci --prefix .github/standards/runner-policy) prints
  Runner policy passed., exit 0. The check is not vacuous: replacing the
  issue-triage-label.yml pin with an unregistered SHA makes it exit 1, naming
  the reusable workflow and reporting that its path@SHA has no reviewed
  runner-input contract. The branch was restored to its committed state
  afterwards.
• actionlint -config-file .github/actionlint.yaml .github/workflows/*.yml —
  exit 0, no output.
• bash scripts/check-lane-coverage.test.sh — PASS=40 FAIL=0.
• bash scripts/check-lane-coverage.sh --check — all 4 lanes reachable from
  ci-status.needs; all 60 gate steps fed to the aggregator, 2 opted out.
• bash scripts/check-docs-only-gate.sh --check — scope resolved once in
  changes; 130 references across 4 consumer jobs, all in the sanctioned form.
• python scripts/check-manifest-duplicate-keys.py — no duplicate keys in 78
  manifests.

The target SHA is the tag: git tag --points-at 2c1de45aa0e1b1489afb8edfebc12cb3a4fa6ac3
in the ci-workflows clone returns v0.24.0, and nothing else.

Counts, on the branch: zero occurrences of 5776760254f8b63cba44e896f51604cb755350d9
anywhere under .github/workflows/, and twenty-three of
@2c1de45aa0e1b1489afb8edfebc12cb3a4fa6ac3 # v0.24.0. The diff is 22 insertions
and 22 deletions across the four files, and every changed line is a
melodic-software/ci-workflows reference.

Three occurrences of the old SHA remain in the tree and are deliberately left
alone: plugins/source-control/hooks/pr-body-linkage-gate.test.sh,
pr-linkage-mcp-gate.test.sh and pr-linkage-spawn-budget.test.sh each embed a
synthetic jobs.ci-status.steps fragment in a printf string, written into a
temp directory as a fixture. The hooks under test key on the presence of a
pr-contract@ step, never on the SHA, so those strings are fixture data and not
pins; bumping them would widen the diff without changing what is exercised. The
truncated 5776760… in .claude/unhobble/** is a historical evidence record of
what was true when it was written.

Related

Refs: melodic-software/github-iac#378
Refs: melodic-software/standards#571

🤖 Generated with Claude Code

https://claude.ai/code/session_01M98vWnd3jQJ19Pe6Uj7bV9

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-15T14:09:09.581963Z	547d43b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.