build: fix the stale ci-workflows Dependabot ignore comment

[kyle-sexton]

Summary

No linked issue — D5 adjacent hygiene observation from the ci-runner-alignment audit walkthrough, direction reversed by Codex review evidence on the dotfiles sibling.

Originally narrowed the ignore pattern to match the comment. History shows the broad ignore is deliberate: #189 widened it because ungoverned composite-action bumps drift adjacent pin-provenance comments (melodic-software/github-iac#89); the comment was simply never updated. The comment was the stale artifact, not the pattern.

Final state: pattern unchanged from main (melodic-software/ci-workflows/*); comment rewritten to medley's self-consistent wording documenting that both reusable-workflow and composite-action refs are ignored on purpose.

Related

• docs: record walkthrough dispositions and adopted doc items ci-runner#99 — walkthrough dispositions record (erratum for this item follows there)
• melodic-software/dotfiles#224 — sibling comment fix
• build: govern every ci-workflows ref and repair pin provenance #189 — the deliberate widening this preserves

🤖 Generated with Claude Code

https://claude.ai/code/session_01PDxVbV5HvMA7pji43USWcQ

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 51da65e6d7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 2m 16s —— View job

---

PR Review

• Gather context
• Read changed file and analyze the Dependabot pattern change
• Evaluate Codex P1 concern about provenance drift
• Post review findings

---

Summary

The intent is right — the comment above the ignore block has always documented composite actions as "Dependabot-managed," and the prior broad pattern melodic-software/ci-workflows/* contradicted it. The narrowed pattern correctly scopes the ignore to reusable-workflow refs. However, the Codex P1 concern is confirmed valid after reading the runner-policy source, and it needs to be addressed before or alongside this change.

---

Confirmed: Provenance drift will break Dependabot composite-action PRs

The pinProvenanceFindings function in runner-policy.mjs inspects all SHA-pinned uses: fields — both jobs.<id>.uses (reusable workflows) and jobs.<id>.steps[*].uses (composite actions). For every such pin that has a trailing comment containing a hex token, it checks that the token is a prefix of the actual SHA.

The composite actions in ci.yml are pinned with exactly this format:

uses: melodic-software/ci-workflows/.github/actions/markdown@c2654182bc2d78f7909795df78304d482aa69226 # c265418 2026-07-13

When Dependabot bumps the SHA, it updates the @<sha> portion but leaves # c265418 2026-07-13 stale. The drift check at line 3010 will then find c265418 no longer prefixes the new SHA and emit a pin-provenance-drift finding, failing the required CI lane on every composite-action Dependabot PR.

This is not a merge blocker for the repo itself — Dependabot PRs are human-reviewed with no auto-merge. But every composite-action bump PR would require a manual provenance-comment fixup before it could pass CI, which is high friction and likely means the bumps pile up unmerged.

---

Paths forward

Three options, in ascending order of follow-on effort:

Option A — Accept the friction (smallest diff, but poor UX). Merge as-is. Document that composite-action Dependabot PRs require a manual one-liner fixup (# <first-7-of-new-sha> <new-date>) before CI passes. This is self-consistent if the team prefers explicit human review of every pin.

Option B — Drop provenance comments from composite-action uses: lines (recommended). The provenance comment exists so the allowlist review can verify which commit is pinned. Composite actions aren't allowlisted — so the comment serves no audit function there; it just drifts. Removing the inline # <sha> <date> from the ~15 composite-action uses: lines in ci.yml means there is no token for pinProvenanceFindings to check, and Dependabot PRs pass CI cleanly. The SHA itself still pins the exact commit; provenance is still legible from the SHA.

Option C — Scope pinProvenanceFindings to reusable-workflow paths only. At line 2979, pinnedUsesEntries builds paths for both jobs.<id>.uses and jobs.<id>.steps[*].uses. Filtering out the steps-level paths (or filtering by whether the action path is a reusable workflow) would stop the check from applying to composite actions. This is a more surgical fix but touches runner-policy, which has its own review pipeline.

Option B is the cleanest given that this repo's policy design already treats composite actions as not subject to allowlist-gating. It unblocks the intent of this PR without touching runner-policy.

---

The change itself

The pattern narrowing on line 41 is semantically correct for Dependabot's dependency-name matching:

• Reusable workflows: uses: melodic-software/ci-workflows/.github/workflows/<name>.yml@<sha> → matched and ignored ✅
• Composite actions: uses: melodic-software/ci-workflows/.github/actions/<name>@<sha> → no longer matched, will receive Dependabot bumps ✅

The melodic-software/* cooldown exclusion at lines 28–29 still applies, so composite bumps propagate without the 7-day cooldown delay. No issues there.

---

Verdict

Not yet ready to merge without addressing the provenance drift problem. The narrowed pattern is correct and the intent is sound. The gap is that the repo's own CI will fail every composite-action Dependabot PR as authored. Recommend resolving with Option B (strip inline SHA comments from composite-action uses: lines) in this PR or a companion PR merged first.

[claude]

Claude finished @kyle-sexton's task in 1m 6s —— View job

---

PR Review

• Gather context and fetch current file state
• Diff current HEAD against prior Claude review commit
• Verify the Codex P1 provenance-drift concern is addressed
• Review comment accuracy and pattern correctness
• Post findings

---

Summary

The PR has been revised since the prior Claude review. The original commit (51da65e6d7) narrowed the Dependabot ignore pattern from melodic-software/ci-workflows/* to only reusable workflows, which would have triggered the Codex P1 concern (provenance drift on composite-action Dependabot PRs). The current HEAD (215a612) reverts that narrowing and instead fixes only the stale comment — which is the correct call.

Current state of .github/dependabot.yml:

# Every melodic-software/ci-workflows ref (reusable workflows AND composite
# actions) moves only through deliberate reviewed PRs per the standards
# runner-policy selector-revision lockstep. Reusable-workflow bumps to
# unreviewed commits fail the Runner policy lane; ungoverned composite-action
# bumps drifted pin-provenance comments org-wide
# (melodic-software/github-iac#89), so both are ignored here.
ignore:
  - dependency-name: "melodic-software/ci-workflows/*"

---

Codex P1 concern: resolved

The broad melodic-software/ci-workflows/* pattern is preserved, so Dependabot will not generate composite-action bump PRs. There is no path to provenance drift via Dependabot, and the runner-policy pin-provenance-drift check will not be triggered by bot PRs. The P1 finding no longer applies to this diff.

---

Comment quality

The rewritten comment at lines 34–39 is accurate and complete:

• Names both ref types (reusable workflows and composite actions) as intentionally ignored
• States the distinct reason for each: policy-lane failure for reusable-workflow bumps; pin-provenance comment drift for composite-action bumps
• Cross-references the incident (melodic-software/github-iac#89) that motivated the wider ignore

The comment now truthfully documents the pattern. No ambiguity remains between what the comment says and what the ignore block does.

---

Pattern verification

• dependency-name: "melodic-software/ci-workflows/*" covers both melodic-software/ci-workflows/.github/workflows/<name>.yml@<sha> (reusable workflows) and melodic-software/ci-workflows/.github/actions/<name>@<sha> (composite actions) — Dependabot matches the org/repo prefix glob against the full uses: path. ✅
• The cooldown.exclude: ["melodic-software/*"] exemption on lines 28–29 is a separate clause that only applies to Dependabot-managed updates — it does not affect the ignore. No conflict. ✅
• No other changes in the file. ✅

---

Verdict

Ready to merge. This is a comment-only fix: the pattern is unchanged from main, and the comment now accurately describes the deliberate broader scope. The Codex P1 concern and the prior Claude review's "not ready" verdict were both predicated on the narrowed pattern, which has been reverted. No functional risk introduced.

[kyle-sexton]

Parked pending the public-posture CI migration — see the migration issue. Merge order once it lands: #345 → #332 → #344.

[claude]

Claude finished @kyle-sexton's task in 1m 4s —— View job

---

PR Review

• Gather context from prior reviews and PR state
• Diff current HEAD against origin/main
• Verify changed file matches stated intent
• Post review findings

---

Summary

The current HEAD (3a903bf) is a merge-from-main on top of 215a612. The merge commit brings in recent activity from main but does not touch .github/dependabot.yml — the dependabot change is identical to what the prior Claude review at 215a612 already cleared.

---

Change verification

The diff against origin/main is comment-only:

	Old (stale)	New (accurate)
Pattern	melodic-software/ci-workflows/*	melodic-software/ci-workflows/* (unchanged)
Comment	Described composite actions as "not SHA-allowlisted and Dependabot-managed" — contradicting the ignore block that actually suppresses them	States both reusable-workflow and composite-action refs are intentionally ignored, with separate rationale for each

Pattern: dependency-name: "melodic-software/ci-workflows/*" — unchanged from main. This glob covers both ci-workflows/.github/workflows/*.yml (reusable workflows) and ci-workflows/.github/actions/* (composite actions). ✅

Comment accuracy (lines 34–39):

• Names both ref types as intentionally ignored ✅
• Gives the distinct reason for each: runner-policy lane failure (reusable workflows) and pin-provenance comment drift (composite actions) ✅
• Cross-references incident melodic-software/github-iac#89 that motivated the broader ignore ✅

Codex P1 concern: No longer applicable. The concern was that narrowing the pattern would expose composite-action Dependabot PRs to pin-provenance-drift failures. The broad pattern is preserved, so Dependabot generates no composite-action PRs and the drift check is never triggered. ✅

---

No issues found

This is a clean hygiene fix. Comment now truthfully documents the ignore block it sits above. No functional changes, no logic to break, no risk introduced.

Parked status noted — per kyle-sexton's comment, this is waiting on the public-posture CI migration with merge order: #345 → #332 → #344. The change itself is ready.

[claude]

Claude finished @kyle-sexton's task in 1m 3s —— View job

---

PR Review

• Gather context from prior reviews and PR state
• Verify merge-from-main didn't alter .github/dependabot.yml
• Confirm change is still correct and comment is accurate
• Post review findings

---

Summary

Current HEAD (abb131c) is a merge-from-main on top of 3a903bf. The merge did not touch .github/dependabot.yml — the only change in this PR against origin/main is the comment rewrite, identical to what the prior review at 3a903bf already cleared.

---

Change verification

Pattern: dependency-name: "melodic-software/ci-workflows/*" — unchanged from main. The glob covers both ci-workflows/.github/workflows/*.yml (reusable workflows) and ci-workflows/.github/actions/* (composite actions). ✅

Comment accuracy (lines 34–39):

Claim	Accurate?
Both reusable workflows AND composite actions are intentionally ignored	✅ — the ci-workflows/* glob matches both path forms
Reusable-workflow bumps fail the Runner policy lane	✅ — runner-policy checks uses: jobs-level fields against the SHA allowlist
Composite-action bumps drifted pin-provenance comments org-wide	✅ — cross-referenced melodic-software/github-iac#89 documents the incident
"so both are ignored here"	✅ — self-consistent with the single broad glob below

Old comment problem: The stale text said composite actions "stay Dependabot-managed," directly contradicting the ignore block that suppresses them. The rewrite removes that contradiction. ✅

Codex P1 concern: No longer applicable. That finding was against 51da65e (narrowed pattern). The narrowing was reverted at 215a612 and the broad pattern has been preserved ever since. No Dependabot composite-action PRs are generated; the pin-provenance-drift check is never triggered by a bot bump. ✅

---

No issues found

This is a clean hygiene fix. The ignore pattern is unchanged; only the comment above it is corrected to truthfully describe what the block does and why. No functional changes, no logic risk, no CLAUDE.md design-rule concerns (comment-only; no plugin code, no PII, no hardcoded paths).

Parked status noted — per kyle-sexton's comment, merge order is #345 → #332 → #344. The change itself is ready when the migration sequencing clears.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: abb131c870

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".