ci: move every ci-workflows pin to v0.50.0

[kyle-sexton]

No related issue: org rollout of package auto-merge after melodic-software/ci-workflows#783

Summary

Moves every canonical ci-workflows reference in this repository to v0.50.0, which adds npm, pip and NuGet patch and minor auto-merge to the shared Dependabot caller. Product policy requires all canonical references to share one pin, so the auto-merge caller cannot move alone.

Fix

@594987abe8657a40bccc13d301f1f0d5cccb5348 # v0.39.8 becomes @d223a6446680fb261e264d1dea9efba46f20ead2 # v0.50.0 in:

• .github/workflows/pr-automerge-dependabot.yml (1 reference)
• .github/workflows/pr-require-checks.yml (all 19 composite and reusable references)
• release/dependencies.json (repositoryPins commit and source)

No caller changes. Between the two releases, pr-require-checks/check-contract gained an optional issue-ref-pattern input whose default is the old GitHub grammar; pr-audit-workflows.yml only bumped codeql-action/upload-sarif; pr-automerge-dependabot.yml gained optional package-auto-merge (default true) and review-only-dependencies inputs. Its package path covers npm, pip and NuGet; this repository's Dependabot config updates only gomod, docker and github-actions, so it changes nothing here. The other changed actions and workflows are not called by this repository. The SYNC-MANAGED callers (pr-check-managed-files-hosted.yml, pr-review-hosted.yml, pr-review-security-hosted.yml) stay on their standards-sync pins.

Verification

• node --test .github/scripts/*.test.cjs: 23 pass, 0 fail, including the three pin tests that failed before.
• actionlint on both changed workflows: clean.
• scripts/Test-ReleasePins.ps1: "Release and workflow pins are internally consistent."
• git grep finds no remaining 594987a or v0.39.8.

Related

• feat(automerge): arm npm, pip and NuGet patch and minor Dependabot bumps ci-workflows#783
• https://github.com/melodic-software/ci-workflows/releases/tag/v0.50.0
• feat(policy): admit ci-workflows v0.50.0 and auto-merge npm/pip/nuget standards#809

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T01:23:21.738876Z	8b3e08c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed d0d8ecd46ed9a099eb7bc3127fa0e1d44f0a0844: 0 finding(s), 0 as inline comments.

Incremental review of .github/workflows/pr-require-checks.yml and release/dependencies.json since 8b3e08c: no findings.

The change moves each melodic-software/ci-workflows reference from 594987a… (v0.39.8) to d223a64… (v0.50.0), and updates the repositoryPins commit and source URL in release/dependencies.json to match.

• Old pin gone: git grep finds no 594987a or v0.39.8 left in the repo.
• One pin everywhere: git grep -c shows d223a64… in pr-require-checks.yml (18 lines), pr-automerge-dependabot.yml (1) and release/dependencies.json (2, the commit and the source URL). Every SHA carries the # v0.50.0 comment, which is the format workflow-pin-metadata.test.cjs expects.
• PR description: it cites 19 references in pr-require-checks.yml. The grep shows 18 lines there, so the count may be off by one, though this does not affect correctness.
• Dependabot: .github/dependabot.yml ignores melodic-software/ci-workflows/*, so the pins still move only in the org-wide repin wave.
• Closing issue: there is none; the PR states "No related issue" with a reason. The body has the sections the PR-body contract rule asks for.

I did not run the Node pin tests, actionlint or Test-ReleasePins.ps1. The PR body's claims that they pass are the author's and unverified by me.

[github-actions]

claude-security-review reviewed d0d8ecd46ed9a099eb7bc3127fa0e1d44f0a0844: 0 finding(s), 0 as inline comments.

Security review (incremental, 8b3e08c..d0d8ecd): no findings.

The change since the last review is a pin bump of melodic-software/ci-workflows from 594987a (v0.39.8) to d223a64 (v0.50.0). It touches .github/workflows/pr-require-checks.yml and the matching repositoryPins entry in release/dependencies.json.

• Pin form: Every uses: reference is still a full 40-character commit SHA with a version comment. No pin was loosened to a tag or branch.
• Consistency: The release/dependencies.json commit and source URL match the workflow pins. No 594987a references remain in the tree.
• Permissions, triggers and inputs: The diff changes none of these. The Zizmor lane's security-events: write grant, the pr-run-checks-go contents: read, and the ci-status statuses: write are unchanged. The with: inputs and the if: conditions are untouched.
• Instruction surfaces: The diff deletes or softens no CLAUDE.md, AGENTS.md, rules file, skill or hook. I did not need the instruction exception register.
• Out of scope: Three other workflows (pr-check-managed-files-hosted.yml, pr-review-hosted.yml, pr-review-security-hosted.yml) are pinned to v0.48.0, not v0.50.0. They are outside this diff, and the mixed versions are not a security issue.
• Not verified: I did not check that d223a64 is really the v0.50.0 tag of the first-party ci-workflows repo. Pin-integrity checks belong to zizmor and the repo's pin-metadata test, so I deferred to them.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8b3e08c9fb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".