ci: converge ci-workflows composite pins on v0.24.0

[kyle-sexton]

No related issue: fleet-wide pin convergence sweep; the tracking issue lives in melodic-software/github-iac and is referenced below rather than closed by this repository's slice.

Summary

This repository referenced melodic-software/ci-workflows at two different
commits. .github/workflows/ci.yml pinned the pr-contract and ci-status
composites at 541ee4e (v0.23.0), while .github/workflows/managed-files-guard.yml
already resolved 2c1de45 (v0.24.0). The "two halves" pin rule for
ci-workflows requires every composite reference in a repository to resolve to
ONE commit, so the split had to close.

Fix

Both composite references in .github/workflows/ci.yml now resolve to
2c1de45aa0e1b1489afb8edfebc12cb3a4fa6ac3 (v0.24.0), with the pin comment moved
alongside each SHA. Two lines, one file.

managed-files-guard.yml is SYNC-MANAGED and was already on target; it is
untouched. .github/dependabot.yml mentions ci-workflows only in a prose
comment about grouped updates, carries no SHA, and is untouched.

The reusable-workflow half of the rule imposes nothing here: this repository has
no .github/standards/ tree, so runner-policy does not govern it, and it
references no ci-workflows reusable workflow — both off-target references were
composites.

Verification

• git diff v0.23.0 v0.24.0 -- .github/actions/pr-contract/ .github/actions/ci-status/
  in the ci-workflows clone is EMPTY. Neither composite changed between the two
  tags, so this is a pin move with no behaviour change.
• Every with: key at both call sites is a declared input of its composite's
  action.yml at 2c1de45: token for pr-contract; results,
  treat-skipped-as, carry-forward-wait-seconds and token for ci-status.
  results is the only required: true input and is supplied.
• Repository-wide grep for 541ee4e90d12d77a90a3ddd72a3af9bc78634ea7, for
  v0.23.0 and for ci-workflows finds no remaining live pin off target; the
  only other hits are the already-converged managed-files-guard.yml and prose
  comments carrying no SHA.
• Local lanes run against the change, all green: actionlint on both workflow
  files (one pre-existing SC2016 info on the links job, byte-identical on
  origin/main and untouched by this diff); shellcheck and bash -n on
  scripts/*.sh and .cursor/install.sh; jq empty on
  .cursor-plugin/marketplace.json and every plugins/*/.cursor-plugin/plugin.json;
  the SKILL.md frontmatter check; and the internal markdown link-integrity check.
  scripts/test-sync-local.sh passes 64 assertions; its 9 twin-parity assertions
  fail on this Windows box only because the pwsh twin emits native C:\...
  paths where the POSIX <HOME>/... redaction expects forward slashes — an
  environment artifact of running a Linux CI lane locally, not a regression, and
  unaffected by a change confined to .github/workflows/ci.yml.
• There is no repository-local pin test. Pin governance for this repository lives
  upstream: the standards sync, the managed-files-guard action, and Dependabot.
  Stated plainly rather than claimed.
• An independent fresh-context agent re-derived every item above from the branch
  without access to this reasoning.

Related

• Refs: melodic-software/github-iac#378

🤖 Generated with Claude Code

https://claude.ai/code/session_01M98vWnd3jQJ19Pe6Uj7bV9

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-15T13:26:39.598271Z	821006b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.