ci: pin ci-workflows composites to v0.39.8 - #85

PR body contract — issue linkage

This PR body does not yet satisfy the issue-linkage contract:

• Missing a "## Summary" section. Describe what this PR changes and why, in a sentence or two.
• Missing a "## Verification" section. Record concrete evidence the change works (commands, gates, output).

Edit the body and this comment updates itself on the next run.

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Claude Code is working…

I'll analyze this and get back to you.

View job run

Claude finished @kyle-sexton's task in 42s —— View job

Security review (/review:security-review)

• Gather context (diff, workflow file, skill instructions)
• Apply skip-gate / criteria from /review:security-review
• Report result

Scope: .github/workflows/pr-require-checks.yml (+2/-2) — repins the check-contract and aggregate-results composite actions from melodic-software/ci-workflows from v0.39.3 to v0.39.8.

Finding: none.

Both references stay fully pinned to a 40-character commit SHA with a version-tag comment (ab83b01...a2 # v0.39.3 → 594987a...48 # v0.39.8); this is a version bump, not a loosening of the pin (unpinned tag/branch, shortened SHA, etc.), so it doesn't raise the supply-chain concern that lane would flag, and that class is zizmor's advisory lane regardless. No other logic, auth, injection, or secret-handling surface is touched in this diff. This is not a CLAUDE.md/AGENTS.md/rules-file change, so the instruction-surface-deletion lens doesn't apply.

No security issues found in this PR.

Claude finished @kyle-sexton's task in 1m 50s —— View job

Claude finished reviewing this PR

• Gather context (diff, CLAUDE.md/AGENTS.md, REVIEW.md)
• Review changed file for correctness/maintainability
• Post findings

No findings.

This PR changes exactly two lines in .github/workflows/pr-require-checks.yml: the pinned SHA (and matching # v0.39.8 comment) for the check-contract and aggregate-results composite actions, bumped from v0.39.3. Both lines were updated together and consistently — same new SHA, same new version comment, no drift between the two.

Checked for related risk and found none:

• Both pins point at the same melodic-software/ci-workflows commit, which is expected since both composites live in that one repo — consistent with the pre-existing pattern.
• The third ci-workflows reference in the repo, pr-check-managed-files-hosted.yml:106, is still pinned to the old v0.39.3 SHA. That's not a gap: its adjacent comment documents it's deliberately pinned to the specific release that closed ci-workflows#530, independent of this PR's aggregate-results race fix — not something expected to track the other composites' version.
• No logic in this repo changes; this is purely an upstream dependency pin bump with no other diff surface.

Unverified (no network access to the melodic-software/ci-workflows repo from this sandbox — gh api repos/melodic-software/ci-workflows/... required approval that wasn't available): that the new SHA 594987abe8657a40bccc13d301f1f0d5cccb5348 is in fact what the v0.39.8 tag in ci-workflows points to. This is author-claimed via the PR description and commit message, not something I independently confirmed.
·

claude-security-review has reviewed this pull request through bec3772; a later push is reviewed from there.

claude-review has reviewed this pull request through bec3772; a later push is reviewed from there.