From f342b83563a1e77117e9bbe1b28a23ea99406375 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sun, 25 Oct 2026 11:10:33 -0400
Subject: [PATCH] ci(intake): repin intake-triage to ci-workflows v0.65.10 and
 skip apply-verdict on a deferred triage

v0.65.10 applies nothing on a permission denial over an otherwise clean
triage and reports it in the new triage-deferred output. That run writes
no lane comment, so apply-verdict skips it instead of throwing on the
missing comment.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/actions/resolve-config/callers.test.mjs | 8 +++++++-
 .github/workflows/intake-triage.yml             | 8 +++++---
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/.github/actions/resolve-config/callers.test.mjs b/.github/actions/resolve-config/callers.test.mjs
index 2677718790..57cca294b1 100644
--- a/.github/actions/resolve-config/callers.test.mjs
+++ b/.github/actions/resolve-config/callers.test.mjs
@@ -301,10 +301,16 @@ test("intake-triage.yml: apply-verdict writes as the lanes App only after a tria
   assert.deepEqual(workflow("intake-triage.yml").permissions, {}, "no workflow-level grant");
   assert.equal(job.concurrency["cancel-in-progress"], false);
   assert.notEqual(job.concurrency.group, jobs["intake-triage"].concurrency.group, "its own concurrency group");
-  const runs = (result, failed) => evaluate(job.if, { "needs.intake-triage.result": result, "needs.intake-triage.outputs.triage-failed": failed });
+  const runs = (result, failed, deferred = "") =>
+    evaluate(job.if, {
+      "needs.intake-triage.result": result,
+      "needs.intake-triage.outputs.triage-failed": failed,
+      "needs.intake-triage.outputs.triage-deferred": deferred,
+    });
   assert.equal(runs("success", "false"), true);
   assert.equal(runs("success", ""), true);
   assert.equal(runs("success", "true"), false, "a triage that did not run writes nothing");
+  assert.equal(runs("success", "", "true"), false, "a deferred triage wrote no lane comment");
   assert.equal(runs("failure", "false"), false, "a failed apply writes nothing");
   assert.equal(runs("skipped", ""), false);
 
diff --git a/.github/workflows/intake-triage.yml b/.github/workflows/intake-triage.yml
index 8d7b01625a..192fcbdc2c 100644
--- a/.github/workflows/intake-triage.yml
+++ b/.github/workflows/intake-triage.yml
@@ -201,7 +201,7 @@ jobs:
     concurrency:
       group: intake-triage-${{ github.event.issue.number || inputs.issue-number || github.run_id }}
       cancel-in-progress: false
-    uses: melodic-software/ci-workflows/.github/workflows/intake-triage.yml@b0ecc273abe492d12f2efa98ee4741a84c219ed2 # b0ecc27 2026-10-23 v0.65.0 plus a docs-only commit
+    uses: melodic-software/ci-workflows/.github/workflows/intake-triage.yml@215cec5c362f953f8b6196effb04451696c3f970 # 215cec5 2026-10-25 v0.65.10
     with:
       runner: ubuntu-24.04
       role: intake
@@ -341,13 +341,15 @@ jobs:
   # against closed enums; on `status: ready`, admit.mjs adds agent-ready (or
   # admission-deferred over a cap) when the admission rules hold. It runs only
   # after a triage that ran and applied, and reads only a lane comment written
-  # since this run started.
+  # since this run started. A deferred triage wrote no lane comment, so
+  # apply-verdict skips it.
   apply-verdict:
     needs: [born-triaged, intake-triage]
     if: >-
       ${{ !cancelled()
       && needs.intake-triage.result == 'success'
-      && needs.intake-triage.outputs.triage-failed != 'true' }}
+      && needs.intake-triage.outputs.triage-failed != 'true'
+      && needs.intake-triage.outputs.triage-deferred != 'true' }}
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     concurrency: