From e90c6f4f69ad3bd49c18d8a0dd62798781b9ccea Mon Sep 17 00:00:00 2001
From: "melodic-standards-sync[bot]"
 <300666570+melodic-standards-sync[bot]@users.noreply.github.com>
Date: Mon, 19 Oct 2026 03:24:58 +0000
Subject: [PATCH] chore: sync standards components
 (aba2c5be5e77a5995265bcc39ebe503aa5672be8)

---
 .github/workflows/pr-review-hosted.yml        | 96 +++++++++++++++++++
 .../workflows/pr-review-security-hosted.yml   | 89 +++++++++++++++++
 2 files changed, 185 insertions(+)
 create mode 100644 .github/workflows/pr-review-hosted.yml
 create mode 100644 .github/workflows/pr-review-security-hosted.yml

diff --git a/.github/workflows/pr-review-hosted.yml b/.github/workflows/pr-review-hosted.yml
new file mode 100644
index 0000000..3ef8815
--- /dev/null
+++ b/.github/workflows/pr-review-hosted.yml
@@ -0,0 +1,96 @@
+name: pr-review-hosted
+
+# SYNC-MANAGED FILE: DO NOT EDIT IN THE CONSUMING REPOSITORY.
+# Source of truth: melodic-software/standards,
+# components/claude-lanes-hosted/claude-review.yml (the
+# `claude-review-hosted-caller` component in distribution/sync-manifest.yml).
+# Downstream edits are overwritten by the next sync PR; change the component
+# upstream, or move the component to `locally-owned` in the manifest to
+# customize.
+#
+# Thin caller for the org's reusable code-review lane. The reusable workflow
+# owns the action pin, model, and the secret-handling model; per its header,
+# this caller owns the triggers, concurrency, and the GITHUB_TOKEN permission
+# grant (a called workflow can only downgrade the caller's grant, never
+# elevate it).
+#
+# The reusable skips fork PRs (they receive no secrets and a read-only token)
+# and every `[bot]` actor whose sender id is not in `allowed-bot-sender-ids`
+# (below), so neither is reviewed by design. On a public repository that means
+# the lane reviews only pull requests from branches of this repository: fork
+# and Dependabot pull requests get no secrets.
+#
+# RUNNER PLACEMENT: hosted shape. This file runs the lane on the GitHub-hosted
+# `ubuntu-24.04` runner, which the standards `runner-policy` component admits
+# on a public repository. It is the hosted sibling of
+# components/claude-lanes/claude-review.yml, which names the private fleet
+# review label, and differs from it only in these comments, `runner` and the
+# workflow `name:`, which equals each file's stem. The job id is the same, so
+# the check context is the same on every target. A target manages one of the
+# two, never both.
+#
+# INTERIM: this per-visibility pair is removed when the runner choice moves
+# inside the ci-workflows reusable and runner-policy gains a cross-repo
+# routing kind, so one caller serves both visibilities
+# (distribution/sync-manifest.yml, the claude lane caller note).
+#
+# This lane is advisory (github-iac ADR 0011: no organization ruleset may make
+# an agentic review a merge prerequisite).
+
+on:
+  pull_request:
+    # `synchronize` re-reviews every push, including the push that resolves a
+    # merge conflict: GitHub runs no pull_request workflow while a PR
+    # conflicts with its base, so a once-per-PR trigger set silently skipped
+    # any PR that conflicted when it opened. The reusable narrows a push's
+    # review to the files changed since the lane's last completed review and
+    # skips a push that changed none of the PR's files; opened, reopened and
+    # ready_for_review review the whole PR.
+    #
+    # Re-running the job does NOT review a newer head: a re-run replays the
+    # ORIGINAL event payload. Push to review the current head.
+    types: [opened, synchronize, ready_for_review, reopened]
+
+permissions:
+  contents: read
+
+# Per-PR supersede group: a newer event for the same PR, a push included,
+# cancels the older run, so per-push reviews do not stack. A skipped actor's
+# same-PR event can cancel an in-flight review through this group; that is
+# accepted: with `synchronize`, the cancelled review was of a head the new
+# event has already superseded. The security caller cancels superseded runs
+# the same way.
+#
+# The group is the `${{ github.workflow }}`-prefixed canonical form the
+# standards `concurrency-policy` component requires, so a target enforcing
+# that policy passes without an exemption. A file whose header says
+# downstream edits are overwritten cannot ask its consumers to normalize it
+# themselves.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  pr-review:
+    # A draft is work in progress and does not spend a review; the
+    # ready_for_review trigger above is what delivers one when it is ready.
+    if: github.event.pull_request.draft == false
+    permissions:
+      contents: read         # checkout + read the diff
+      pull-requests: write   # post review, tracking comment and the lane's
+                             # reviewed-head marker comment
+      id-token: write        # OIDC, mints the Claude GitHub App token (required
+                             # even with an OAuth/API-key credential)
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@96b50d451c4483c476f2f963674e0a3ba9d50fe3 # v0.48.0
+    with:
+      runner: ubuntu-24.04
+      # Bot senders this lane reviews, by numeric user id: the
+      # automation-lanes App, so a commit it pushes to a pull request is
+      # reviewed. Where the repository does not set this variable the value is
+      # empty and the reusable reviews no bot.
+      allowed-bot-sender-ids: ${{ vars.AUTOMATION_LANES_APP_SENDER_ID }}
+    # Pass only the one named secret (least privilege) rather than
+    # `secrets: inherit`, which would forward every parent secret to the
+    # called workflow.
+    secrets:
+      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
diff --git a/.github/workflows/pr-review-security-hosted.yml b/.github/workflows/pr-review-security-hosted.yml
new file mode 100644
index 0000000..92ef858
--- /dev/null
+++ b/.github/workflows/pr-review-security-hosted.yml
@@ -0,0 +1,89 @@
+name: pr-review-security-hosted
+
+# SYNC-MANAGED FILE: DO NOT EDIT IN THE CONSUMING REPOSITORY.
+# Source of truth: melodic-software/standards,
+# components/claude-lanes-hosted/claude-security-review.yml (the
+# `claude-security-review-hosted-caller` component in
+# distribution/sync-manifest.yml).
+# Downstream edits are overwritten by the next sync PR; change the component
+# upstream, or move the component to `locally-owned` in the manifest to
+# customize.
+#
+# Thin caller for the org's reusable security-review lane (advisory verdict,
+# fail-closed execution check). The reusable workflow owns the action pin,
+# model, and the secret-handling model; per its header, this caller owns the
+# triggers, concurrency, and the GITHUB_TOKEN permission grant.
+#
+# There is no workflow-level path gating. The reusable skips, with a green
+# check, a review whose files in scope are all documentation (its
+# `docs-only-paths` default: `docs/**/*.md`, READMEs and changelogs). A
+# `.github/claude-security-paths` file is no longer read.
+#
+# NEVER add workflow-level `paths:`/`paths-ignore:` to this caller: a check
+# whose workflow never triggers is missing, not green, so a required check
+# would stay Pending forever, and the babysit merge gate, which waits for
+# `pr-review-security / security-review`, never arms.
+#
+# The reusable skips fork PRs (they receive no secrets and a read-only token)
+# and every `[bot]` actor whose sender id is not in `allowed-bot-sender-ids`
+# (below); a required check does NOT prove a fork PR was reviewed (see the
+# reusable's header). On a public repository the lane reviews only pull
+# requests from branches of this repository: fork and Dependabot pull requests
+# get no secrets.
+#
+# RUNNER PLACEMENT: hosted shape, the sibling of
+# components/claude-lanes/claude-security-review.yml, differing from it only
+# in these comments, `runner` and the workflow `name:`. It is an interim with
+# the same removal trigger as the code-review caller. See that file's header.
+
+on:
+  pull_request:
+    # `synchronize`, matching the code-review lane: every push is re-reviewed,
+    # including the push that resolves a merge conflict (GitHub runs no
+    # pull_request workflow while a PR conflicts with its base), narrowed by
+    # the reusable to the files changed since the last completed review. The check
+    # stays advisory: github-iac ADR 0011 forbids any organization ruleset
+    # from making an agentic review a merge or deployment prerequisite. With
+    # the per-PR group below cancelling, a push supersedes the in-flight review.
+    #
+    # NO `merge_group:`: the pinned action cannot serve that event; see
+    # melodic-software/ci-workflows#272 before enabling a merge queue.
+    types: [opened, synchronize, ready_for_review, reopened]
+
+permissions:
+  contents: read
+
+# Per-PR supersede group: a newer event for the same PR, a push included,
+# cancels the older run, so reviews of superseded heads do not stack. The
+# merge guard judges only the newest run of each check, so a cancelled run on
+# a superseded head does not block merge. The group is the
+# `${{ github.workflow }}`-prefixed canonical form the standards
+# `concurrency-policy` component requires.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  pr-review-security:
+    # A draft is work in progress and does not spend a review; the
+    # ready_for_review trigger above is what delivers one when it is ready.
+    if: github.event.pull_request.draft == false
+    permissions:
+      contents: read         # checkout + read the diff
+      pull-requests: write   # post the security review, tracking comment and
+                             # the lane's reviewed-head marker comment
+      id-token: write        # OIDC, mints the Claude GitHub App token (required
+                             # even with an OAuth/API-key credential)
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@96b50d451c4483c476f2f963674e0a3ba9d50fe3 # v0.48.0
+    with:
+      runner: ubuntu-24.04
+      # Bot senders this lane reviews, by numeric user id: the
+      # automation-lanes App, so a commit it pushes to a pull request is
+      # reviewed. Where the repository does not set this variable the value is
+      # empty and the reusable reviews no bot.
+      allowed-bot-sender-ids: ${{ vars.AUTOMATION_LANES_APP_SENDER_ID }}
+    # Pass only the one named secret (least privilege) rather than
+    # `secrets: inherit`, which would forward every parent secret to the
+    # called workflow.
+    secrets:
+      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}