From a01c1b1a78da27b2b90d3357895f4c38cf155631 Mon Sep 17 00:00:00 2001
From: "melodic-standards-sync[bot]"
 <300666570+melodic-standards-sync[bot]@users.noreply.github.com>
Date: Mon, 26 Oct 2026 15:32:48 +0000
Subject: [PATCH] chore: sync standards components
 (de51bae1f394c1b4687e81987608f2e66bc03255)

---
 .github/workflows/pr-review-hosted.yml          | 9 +++++++--
 .github/workflows/pr-review-security-hosted.yml | 9 +++++++--
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/pr-review-hosted.yml b/.github/workflows/pr-review-hosted.yml
index 7d4471d..7a50cb6 100644
--- a/.github/workflows/pr-review-hosted.yml
+++ b/.github/workflows/pr-review-hosted.yml
@@ -81,8 +81,10 @@ jobs:
                              # reviewed-head marker comment
       id-token: write        # OIDC, mints the Claude GitHub App token (required
                              # even with an OAuth/API-key credential)
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@3180217076b19bbdfccc43026c7f91c604da673d # v0.65.14
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@b26e355fe98c372f02a13d74c10a785ad8c9ce2d # v0.65.16
     with:
+      # Names (never the value) the fallback secret in the lane-outcome record.
+      fallback-credential-name: FALLBACK_CLAUDE_CODE_OAUTH_TOKEN
       runner: ubuntu-24.04
       # Bot senders this lane reviews, by numeric user id: the
       # automation-lanes App, so a commit it pushes to a pull request is
@@ -97,8 +99,11 @@ jobs:
       # bot ids in allowed-bot-sender-ids above also mark issues those bots
       # wrote as trusted closing-issue context.
       allowed-author-ids: '153232337'
-    # Pass only the one named secret (least privilege) rather than
+    # Pass only the named secrets (least privilege) rather than
     # `secrets: inherit`, which would forward every parent secret to the
     # called workflow.
     secrets:
       CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+      # The central fallback subscription: the review retries once on it after
+      # a usage limit on the token above.
+      FALLBACK_CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.FALLBACK_CLAUDE_CODE_OAUTH_TOKEN }}
diff --git a/.github/workflows/pr-review-security-hosted.yml b/.github/workflows/pr-review-security-hosted.yml
index 36475de..dd0ea28 100644
--- a/.github/workflows/pr-review-security-hosted.yml
+++ b/.github/workflows/pr-review-security-hosted.yml
@@ -74,16 +74,21 @@ jobs:
                              # the lane's reviewed-head marker comment
       id-token: write        # OIDC, mints the Claude GitHub App token (required
                              # even with an OAuth/API-key credential)
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@3180217076b19bbdfccc43026c7f91c604da673d # v0.65.14
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@b26e355fe98c372f02a13d74c10a785ad8c9ce2d # v0.65.16
     with:
+      # Names (never the value) the fallback secret in the lane-outcome record.
+      fallback-credential-name: FALLBACK_CLAUDE_CODE_OAUTH_TOKEN
       runner: ubuntu-24.04
       # Bot senders this lane reviews, by numeric user id: the
       # automation-lanes App, so a commit it pushes to a pull request is
       # reviewed. Where the repository does not set this variable the value is
       # empty and the reusable reviews no bot.
       allowed-bot-sender-ids: ${{ vars.AUTOMATION_LANES_APP_SENDER_ID }}
-    # Pass only the one named secret (least privilege) rather than
+    # Pass only the named secrets (least privilege) rather than
     # `secrets: inherit`, which would forward every parent secret to the
     # called workflow.
     secrets:
       CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+      # The central fallback subscription: the review retries once on it after
+      # a usage limit on the token above.
+      FALLBACK_CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.FALLBACK_CLAUDE_CODE_OAUTH_TOKEN }}