[hivecommons-hive]

Closes #14611

Problem

gh is installed in the CI runner image from the cli.github.com apt repo, which only serves the latest version. The pinned 2.103.2 is gone (Packages lists only 2.103.3), so Build (PR gate, no push) fails with E: Version '2.103.2' for 'gh' was not found (run https://github.com/hivecommons/hive/actions/runs/40542991463). Second occurrence after #14341.

Fix

• Bump GITHUB_CLI_VERSION to 2.103.3 in src/deploy/ci-runners/Dockerfile (keyring sha unchanged).
• cli-pin-bump.sh apply gh now also rewrites that ARG (HIVE_PIN_RUNNER_DOCKERFILE override); test case, docs row, and workflow paths:/git add updated.
• Changelog fragment added.

Unblocks the Build (PR gate, no push) check on #14399 once merged into that branch.

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign danathar for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

No conflicting open PRs or same-file overlaps were found.

[hivecommons-hive]

hive/awaiting-ci: CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Decision needed: @clubanderson should confirm the two-line edit to .github/workflows/cli-pin-bump.yml (a pull_request paths: entry and a git add path for src/deploy/ci-runners/Dockerfile) is acceptable from a bot-authored PR; the code change itself looks correct.

Code looks correct to me; routing only because the diff edits a workflow file, which is a trust surface I do not approve.

What I verified on v5

• src/deploy/ci-runners/Dockerfile:120 installs "gh=${GITHUB_CLI_VERSION}", so the ARG at :51 is the pin that failed; bumping it to 2.103.3 matches the stated apt-repo failure.
• set_arg (src/scripts/cli-pin-bump.sh:155-166) rewrites exactly the ARG GITHUB_CLI_VERSION= line via index($0, "ARG " name "=") == 1; the keyring ARG on the next line is untouched, which the new test asserts (grep -q '^ARG GITHUB_CLI_KEYRING_SHA256=6084d5d7').
• read_arg inside set_arg fails if the ARG is absent; the test fixture runner.Dockerfile provides it, and the real file has it, so apply gh will not trip on it.
• Workflow: permissions: stays contents: read (.github/workflows/cli-pin-bump.yml:73-74); the two hunks add a paths: trigger entry and a git add path. No permission, secret, or step changes.

One thing worth knowing, not a defect: the hub image pins GH_VERSION=2.103.0 (src/Dockerfile:248) while the runner now pins 2.103.3. cli-pin-bump apply gh drives both from the latest cli/cli release, so they converge on the next scheduled run; until then they differ, which was already the case (2.103.0 vs 2.103.2).

Body matches the diff. Closes #14611.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

The immediate bump is right and the plumbing works — set_arg matches the ARG GITHUB_CLI_VERSION= line by prefix (src/scripts/cli-pin-bump.sh:set_arg, index($0,"ARG " name "=")==1), the Dockerfile consumes it at src/deploy/ci-runners/Dockerfile:120 ("gh=${GITHUB_CLI_VERSION}"), and the workflow edit is only a pull_request.paths entry plus the git add list; permissions: contents: read at .github/workflows/cli-pin-bump.yml:74-75 is unchanged.

One gap that undercuts the second half of the title ("let cli-pin-bump keep the runner pin current"), medium:

The daily run skips patch-only releases unless the CLI is patch-eligible — src/scripts/cli-pin-bump.sh:515:

if [ "${HIVE_PIN_INCLUDE_PATCH:-}" != "1" ] && ! is_patch_eligible "$cli" && is_patch_only_bump "$old_report" "$new_report"; then
  … log "$cli: $old_report -> $new_report is a patch release; pins move on major/minor only"; return 0

and HIVE_PIN_PATCH_ELIGIBLE defaults to "claude" only (:46-49). The workflow's cron run passes HIVE_PIN_INCLUDE_PATCH empty (cli-pin-bump.yml:155). So the next gh patch release — 2.103.3 → 2.103.4, the same shape as the 2.103.2 → 2.103.3 break this PR and #14341 both fixed — is resolved, logged as skipped, and never applied. The runner build breaks again until someone dispatches with include_patch=true.

The apt repo only serving the latest is precisely why gh is different from the npm-installed CLIs: for gh a stale patch pin is a build failure, not a missed feature. Suggested fix, one line: make gh patch-eligible by default (HIVE_PIN_PATCH_ELIGIBLE default "claude gh"), or set HIVE_PIN_PATCH_ELIGIBLE: claude gh in the workflow env alongside HIVE_PIN_INCLUDE_PATCH. Either way test-cli-pin-bump.sh should get a case where a gh patch bump is applied without HIVE_PIN_INCLUDE_PATCH=1.

Not a blocker for unblocking #14399 today; it is a blocker for the claim that the daily job now keeps this pin current.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

4cae37e

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head 4cae37e71dcb) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/cli-pin-bump.yml
  • src/deploy/ci-runners/Dockerfile

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

hive/awaiting-ci: addressed the review gap — gh is now patch-eligible by default (HIVE_PIN_PATCH_ELIGIBLE="claude gh") with a test that a gh patch bump applies without HIVE_PIN_INCLUDE_PATCH=1. CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Shared CI baseline: relative links and anchors resolve fails identically on the v5 tip (c6d82d0, run 40584586337) — DRIFT src/docs/scale-envelope.md:37 from #14657, not this PR's diff. Tracked in #14711 with a fix PR; this PR needs no change and should go green on its next run once the base is repaired. Deferring.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Decision needed: @clubanderson should confirm the .github/workflows/cli-pin-bump.yml edit (one added paths: entry and one added git add path, no permission or trigger-type change) is acceptable to land from a bot-authored branch; the rest of the PR is verified correct.

Routing to a human only because the diff edits a workflow file; the code itself checks out.

What I verified on 886c5a2:

• src/deploy/ci-runners/Dockerfile:51 GITHUB_CLI_VERSION=2.103.3, consumed as an exact apt pin at :120 ("gh=${GITHUB_CLI_VERSION}"). Keyring sha untouched.
• src/scripts/cli-pin-bump.sh:466 now calls set_arg "$RUNNER" GITHUB_CLI_VERSION "$v" in the gh) arm; set_arg (:157-168) rewrites exactly one ARG NAME= line and fails loudly via read_arg if the file lacks it, so a missing runner Dockerfile cannot silently no-op.
• PATCH_ELIGIBLE default claude gh (:65) is what makes the daily job pick up 2.103.x releases; the HIVE_PIN_PATCH_ELIGIBLE override still disables it.
• .github/workflows/cli-pin-bump.yml: + 'src/deploy/ci-runners/Dockerfile' in paths: (line 71) and the same path added to the git add list (line 254). permissions: block and on: event types are unchanged.
• Ran src/scripts/test-cli-pin-bump.sh on the PR tree locally: passed: 32 failed: 0, including the two new gh patch eligibility cases and the runner-ARG rewrite check.
• The red Docs Link Check / relative links and anchors resolve fails identically on v5 HEAD c6d82d0 (scale-envelope.md:37 drift) — pre-existing.

Body matches the diff. Looks correct to me; the only open item is the workflow-file sign-off above.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Read the change against the tree at pr14614 (head 886c5a2). The fix is correct and the mechanics hold up; one thing the body leaves out that a maintainer should know about.

Verified

• src/deploy/ci-runners/Dockerfile:51,120 — gh=${GITHUB_CLI_VERSION} is an exact apt pin, so the staleness failure in the body is real and bumping to 2.103.3 is the right immediate fix. GITHUB_CLI_KEYRING_SHA256 is untouched, as claimed.
• src/scripts/cli-pin-bump.sh:456-462 — the gh case now also calls set_arg "$RUNNER" GITHUB_CLI_VERSION. set_arg (:157-168) calls read_arg first, so it fails loudly rather than silently if the runner Dockerfile or ARG is missing — good, no "wrote nothing and reported success".
• src/scripts/test-cli-pin-bump.sh is offline and passes on this head: 32/32 (the base suite, 29/29, also passes against the new script, so nothing existing regressed). The new cases cover the runner ARG being rewritten, the keyring sha surviving, and the patch-eligibility toggle.
• .github/workflows/cli-pin-bump.yml — trust-surface check: the diff adds one paths: entry (:71) and one path to git add (:254). permissions: (:74-75, contents: read) and the job set are unchanged. Author is the hive bot. Nothing here widens access.

Not in the body — intent note, not a defect

The PR also makes gh patch-eligible by default: cli-pin-bump.sh:65 changes PATCH_ELIGIBLE from claude to claude gh, and src/docs/cli-pins.md:91 documents it. That is a behaviour change to the scheduled job (cron 23 5 * * *): every gh patch release will now open a bump PR touching src/Dockerfile, the runner image, and the SHA pins, where before only minor/major did. It is necessary for the fix to actually work — apt serves only the latest patch, so a patch-skipping bumper would leave the runner broken until the next minor — but the body describes it only as "also rewrites that ARG". The rationale comment at :62-64 still explains patch eligibility purely in terms of Claude shipping models in patches; worth a one-line addition saying gh is there because the runner's apt repo serves only the latest release.

Observation, low: "current" for gh is read from src/Dockerfile GH_VERSION (:393), which sits at 2.103.0 — behind the runner's 2.103.3 after this PR. That is fine for the next scheduled run (latest ≥ 2.103.3 > 2.103.0, both files move together), but the runner's pin is never checked independently, so a hand-edit that leaves the hub at latest while the runner lags would not be caught. Pre-existing shape, not introduced here.

The failing relative links and anchors resolve check also fails on #14670, so it looks like a base-branch issue rather than this PR's doc edits.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

886c5a2

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head 886c5a212883) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/cli-pin-bump.yml
  • src/deploy/ci-runners/Dockerfile

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Evidence bundle `#14614886c5a2` sha256:b2abb83181254c736b35521d41f715e024f43801153fa21ba5700ce3d97be5cc — download from the dashboard or `hivectl review evidence #14614`.

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback