Skip to content

feat(github-actions-conventions): mark pr unblock in use and retire update, fix-ci, address-feedback - #781

Merged
kyle-sexton merged 1 commit into
mainfrom
feat/pr-unblock-vocabulary
Oct 12, 2026
Merged

feat(github-actions-conventions): mark pr unblock in use and retire update, fix-ci, address-feedback#781
kyle-sexton merged 1 commit into
mainfrom
feat/pr-unblock-vocabulary

Conversation

@kyle-sexton

@kyle-sexton kyle-sexton commented Oct 12, 2026

Copy link
Copy Markdown
Member

Refs: melodic-software/claude-code-plugins#6989

Summary

pr-unblock is live on claude-code-plugins main
(.github/workflows/pr-unblock.yml). It replaced the planned lanes
pr-update, pr-fix-ci and pr-address-feedback. The vocabulary still
lists unblock as reserved and keeps the three replaced words reserved.

Fix

  • components/github-actions-conventions/vocabulary.json, functions.pr:
    unblock becomes { "name": "unblock", "status": "in-use" }, the
    shape of the other in-use entries. The update, fix-ci and
    address-feedback entries are removed: the schema's status enum is
    in-use or reserved only, so removal is the only way to retire one.
  • naming-lint.test.mjs: the slot-name contract test listed the three
    retired names and failed once they left the vocabulary. It now lists
    pr-unblock and asserts the three retired names no longer parse.
  • Unchanged: the verbs assess, unblock, update, fix and
    address stay in the allowlist, and unblock is not a stage word.

Verification

  • npx biome check components/github-actions-conventions: no fixes.
  • npm run test:github-actions-conventions: 14 pass, 0 fail.
  • npm run lint:github-actions-conventions: 0 findings, 0 blocking.
  • npm run lint:md: 0 issues.
  • Node check: functions.pr unblock is in-use and none of update,
    fix-ci, address-feedback is present: exit 0.

Related

🤖 Generated with Claude Code

@kyle-sexton @claude
feat(github-actions-conventions): mark pr unblock in use and retire u…
f00b1cb 
…pdate, fix-ci, address-feedback

pr-unblock is live in claude-code-plugins and replaced the planned
pr-update, pr-fix-ci and pr-address-feedback lanes. The vocabulary
schema has no retired status, so the three reserved entries are removed
and unblock moves to in-use. The slot-name test swaps the three retired
names for pr-unblock and asserts the retired names no longer parse.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@kyle-sexton
kyle-sexton marked this pull request as ready for review October 12, 2026 12:48
@claude

claude Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @kyle-sexton's task in 2m 37s —— View job

Code review complete

  • Gather context (PR diff, changed files)
  • Resolve standards index / paved-path criteria (no docs/standards/README.md index in this repo — nothing to apply)
  • Review vocabulary.json change
  • Review naming-lint.test.mjs change
  • Post findings

No blocking or high-signal findings. This is a clean, minimal retirement of three unused reserved vocabulary entries plus the in-use flip for unblock.

Verified by reading the code (not re-running the author's commands — sandbox denies npm/node execution here, so I could not independently confirm the author-claimed test/lint output in the Verification section):

  • vocabulary.json's pr.unblock entry now matches the shape of other in-use entries (no purpose field), consistent with the schema (vocabulary.schema.json only requires purpose to be absent-safe) and the other in-use rows.
  • parseSlotName (components/github-actions-conventions/naming-lint.mjs:141-159) resolves function words purely by presence in vocabulary.functions[stage], irrespective of status, so deleting the update/fix-ci/address-feedback entries is the correct (and only) way to make pr-update, pr-fix-ci, pr-address-feedback stop parsing — matches the new assertions added in naming-lint.test.mjs:255-257.
  • Confirmed no workflow file, rename-map entry, or docs page still references pr-update.yml, pr-fix-ci.yml, or pr-address-feedback.yml, and no other vocabulary stage lists those words — the retirement has no dangling references.
  • update and address remain in the verbs allowlist (vocabulary.json:158, :105) independent of the removed functions.pr entries, as the PR description states; this is consistent since verbs and functions are separate, unrelated lists in the schema.
  • One pre-existing, non-blocking mention: rename-map.json:1198's note still says "it is not pr-address-feedback" — purely explanatory prose about a different workflow's naming decision, not a vocabulary reference, so it isn't invalidated by this change. Not a finding, just noting I checked it: permalink.

No paved-path row exists in this repo (no docs/standards/README.md index), so no paved-path criteria apply. REVIEW.md's code-review-lane "always check" items (audit logging, atomicity, Actions dependency bumps) don't apply to this change — it touches only a JSON vocabulary file and its test.

@claude

claude Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @kyle-sexton's task in 51s —— View job

Security review — no issues found

  • Gather context (PR diff, repo rules)
  • Invoke /review:security-review and follow its instructions
  • Post findings / summary

Skip-gate result: this PR has no security-relevant surface.

The diff touches only two files:

This is a pure vocabulary/data update describing naming conventions for GitHub Actions workflow slot names — no executable logic, no auth/authz paths, no secrets or credential handling, no injection surface, and no workflow YAML (.github/workflows/) is touched. The "instruction-surface deletions" lens doesn't apply here either: the removed reserved entries were placeholders for never-implemented future workflow names (replaced by the already-live pr-unblock), not a guardrail, allowlist, or enforcement control — removing them doesn't open up any action that was previously blocked. Retiring them also doesn't weaken naming-lint: the updated test explicitly asserts the three retired names now fail to parse as valid slot names, so the lint remains at least as strict as before.

No security findings to report.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-12T12:52:17.376747Z f00b1cb Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@github-actions

github-actions Bot commented Oct 12, 2026

Copy link
Copy Markdown

claude-security-review has reviewed this pull request through f00b1cb; a later push is reviewed from there.

@github-actions

github-actions Bot commented Oct 12, 2026

Copy link
Copy Markdown

claude-review has reviewed this pull request through f00b1cb; a later push is reviewed from there.

@kyle-sexton
kyle-sexton merged commit 734122f into main Oct 12, 2026
24 checks passed
@kyle-sexton
kyle-sexton deleted the feat/pr-unblock-vocabulary branch October 12, 2026 13:05
@kyle-sexton kyle-sexton mentioned this pull request Oct 16, 2026
Merged
kyle-sexton added a commit that referenced this pull request Oct 16, 2026
@kyle-sexton @claude
feat(github-actions-conventions): add the work function unblock (#791)
fff4f7a 
Refs: melodic-software/claude-code-plugins#7599

## Summary

claude-code-plugins PR #7625 adds the lane `work-auto-unblock`, which
promotes issues whose last blocker closed. `resolve-config` there
rejects a lane not named `<stage>-<function>` from the vocabulary, and
the `work` stage lists no matching function word.

## Fix

In `components/github-actions-conventions/vocabulary.json`,
`functions.work` gains `unblock` with status `in-use` and the purpose
"Promote issues whose last blocker closed." The lane is named
`work-unblock` rather than `work-auto-unblock`: `naming-lint.mjs`
requires every function word to start with a listed verb, and `auto` is
not one. `unblock` is already a verb (#770).

## Verification

- `npm run test:github-actions-conventions`: 14 pass, 0 fail (exit 0).
- `npm run lint:github-actions-conventions`: 0 findings, 0 blocking
(exit 0).
- `biome check components/github-actions-conventions/vocabulary.json`:
clean (exit 0).

## Related

- melodic-software/claude-code-plugins#7599,
melodic-software/claude-code-plugins#7625 (the lane must be named
`work-unblock`)
- #770, #781 (earlier `unblock` entries)

After the merge, the standards sync lands the copy in
claude-code-plugins (`.github/standards/`).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@kyle-sexton kyle-sexton mentioned this pull request Oct 19, 2026
Merged
kyle-sexton added a commit that referenced this pull request Oct 19, 2026
@kyle-sexton @claude
feat(runner-policy): admit role-named secrets and register ci-workflo…
cb0ec4a 
…ws v0.51.0 intake (#811)

No related issue: runner-policy contract for the claude-code-plugins
intake move onto ci-workflows' run-claude-cli launcher
(melodic-software/ci-workflows#784)

Hold: a human merges this.

## Summary

claude-code-plugins' intake now calls ci-workflows `intake-triage.yml`
at v0.51.0, which runs on the `run-claude-cli` launcher funded by the
`automations` role. The caller passes the role's two secrets,
`AUTOMATIONS_CLAUDE_API_KEY` and `AUTOMATIONS_CLAUDE_CODE_OAUTH_TOKEN`.
The same-name rule for privileged contracts (from #140) refused that
mapping, so the contract could not load.

## Fix

- **Security control change, owner-approved 2026-10-19.** A contract
with `allowedCallerPermissions` may map a secret to its own name, as
before, or to its funding role's prefixed name, `NAME: ${{
secrets.<ROLE>_NAME }}`. The prefixed form is allowed only when:
  - the contract declares a literal `role` (lower kebab);
  - `role` is in its `allowedInputs`;
  - the caller passes `role:` as that exact literal.

Any other rename is still refused, as are expressions and other
prefixes. The role is a reviewed literal, never an expression. This lets
several funding roles share one repository.
- Registers `intake-triage.yml@f129f4c142d00ec3feacbf2b9102d327088504bf`
(v0.51.0) with `role: automations`. It is the v0.49.0 entry plus the
`role` input, with the one OAuth secret replaced by the role's API key
and subscription token. Permissions and routing are unchanged. The
v0.49.0 entry stays until the caller repins.
- `policy.schema.json` gains the optional `role` property, and the
README documents the rule.

## Verification

`node --test components/runner-policy/*.test.mjs`: 319/319 pass. The new
tests:
- a declared role's prefixed secret is accepted;
- another role's prefix is refused, and so is a prefix with no declared
role;
- a declared role missing from `allowedInputs` is refused;
- a caller passing another role is refused;
- the v0.51.0 entry equals the v0.49.0 entry plus the role, its input
and its secrets.

## Related

- melodic-software/ci-workflows#784 and #781: the intake move and the
launcher.
- #140: the same-name control this narrows.
- claude-code-plugins branch `feat/intake-on-run-claude-cli`: the
caller, opened after this syncs.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@kyle-sexton