[kyle-sexton]

Refs: melodic-software/ci-workflows#887

Summary

Repins the intake caller to ci-workflows
v0.65.10
(215cec5c362f953f8b6196effb04451696c3f970) and stops apply-verdict from
running after a triage the reusable deferred.

Fix

• .github/workflows/intake-triage.yml: uses: moves from @b0ecc273… to
  @215cec5c362f953f8b6196effb04451696c3f970 # 215cec5 2026-10-25 v0.65.10.
  v0.65.10 keeps an existing Issue Type, applies nothing when a permission
  denial lands on an otherwise clean triage, and reports that in the new
  triage-deferred output. No input, secret or job permission changed.
• apply-verdict now also requires needs.intake-triage.outputs.triage-deferred != 'true'.
  A deferred triage writes no lane comment, so without this
  .github/scripts/intake-triage/apply-verdict.mjs throws on finding zero
  lane comments.
• callers.test.mjs: the apply-verdict condition test covers the deferred case.

Verification

• node --test .github/actions/resolve-config/callers.test.mjs: 182 pass, 0 fail.
  With the old if: the new deferred assertion fails.
• bash scripts/check-affected.sh: 8 passed, 5 skipped over 2 changed files.
• node .github/standards/runner-policy/runner-policy.mjs --root .: Runner policy passed.
• bash scripts/check-changelog-fragments.sh --check-required origin/main: no fragment-mode plugin changed, so none is required.
• The runner-policy contract for this SHA landed in standards and synced here
  first (see Related).

Related

• melodic-software/ci-workflows#887
• melodic-software/standards#879 registers the v0.65.10 intake-triage contract
• #10032 synced it here

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-25T15:26:02.110897Z	f342b83	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed f342b83563a1e77117e9bbe1b28a23ea99406375: 0 finding(s), 0 as inline comments.

No security issues found in this pull request. critical-findings: 0

What changed (2 files, both read in full):

• .github/workflows/intake-triage.yml
  • It repins the reusable intake-triage.yml from b0ecc27… to the full 40-character SHA 215cec5c362f953f8b6196effb04451696c3f970 (v0.65.10). The pin is a commit SHA from the same org's ci-workflows, so it is not loosened or unpinned.
  • It adds && needs.intake-triage.outputs.triage-deferred != 'true' to the apply-verdict job's if:.
• .github/actions/resolve-config/callers.test.mjs adds an assertion for the deferred case.

Analysis:

• The new condition only makes apply-verdict run in fewer cases. That job is the one that writes labels as the lane's App, such as agent-ready and admission-deferred. The change narrows a write path and removes no gate, so no control is softened.
• The only unchecked point is that triage-deferred is read from a reusable workflow output declared at the new pin. If a caller read an output that did not exist, the != 'true' comparison would be true and the old behavior would remain. That is a functional concern, not an exploitable one, and the PR text says v0.65.10 provides the output.
• The PR text names no input, secret or permission change. The diff matches that: the workflow-level permissions: {} and job permissions are untouched.
• The PR context file holds no embedded instructions aimed at the review lane.
• No changed file matches a trusted path glob, and no plugin manifest changed, so there are no manifest <field> lines.
• I did not read the contents of ci-workflows at the new SHA. It is an external repository outside this diff, so the pinned reusable's behavior is taken from the PR description.
• No spend change: no billing or paid-plan setting is touched.

[github-actions]

claude-review reviewed f342b83563a1e77117e9bbe1b28a23ea99406375: 0 finding(s), 0 as inline comments.

No findings.

I reviewed the whole diff (2 files) against the PR context. There are no closing issues. The PR only refs ci-workflows#887.

• apply-verdict condition (.github/workflows/intake-triage.yml:352): the added triage-deferred != 'true' clause is correct. If the reusable workflow does not declare the output, it reads as empty and the job still runs, so the gate fails open. That matches the existing triage-failed clause.
• Test (.github/actions/resolve-config/callers.test.mjs): the helper now passes triage-deferred with a default of "", so the existing assertions keep their meaning. The new assertion covers the deferred case. I did not run the tests; the "182 pass" figure is the author's claim and I haven't verified it.
• Repin: the uses: line moves to 215cec5…, and .github/standards/runner-policy/policy.json:362 already registers that SHA, so the runner-policy contract is in place. The old b0ecc27… entry at policy.json:336 is still there. That is a retained pin on an untouched line, not a defect.
• Not checked: I could not read ci-workflows v0.65.10, so I did not confirm that it exposes triage-deferred or that a deferred triage writes no lane comment. Both come from the PR description.
• Trusted paths: no changed file matches a trusted-path glob.
• Cost: none. No billing or paid-plan change.