[kyle-sexton]

Refs: melodic-software/ci-workflows#741

Summary

Repins both intake lane callers to ci-workflows v0.42.0, where the triage lane sets the Issue Type and clears the needs-triage floor.

Fix

• .github/workflows/intake-triage.yml and .github/workflows/intake-label-needs-triage.yml: uses: moves from ab83b01 (v0.39.3) to 182aca3ad32b79fd002def94e58eb498ac49e7af # v0.42.0.
• Neither new input is passed: floor-label defaults to needs-triage and human-label to needs-human, the labels this repo uses.
• Secrets (literal ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}) and job permissions (contents: read, issues: write; issues: write) are unchanged and equal the v0.42.0 contracts.

Stays draft: ci-status fails runner-policy until melodic-software/standards#783 merges and the standards sync brings the v0.42.0 contracts into .github/standards/runner-policy/policy.json.

Verification

• Read on.workflow_call and job permissions of both reusables at 182aca3: inputs, defaults, secrets and permissions match what these callers pass.
• Diff is two uses: lines.

Related

• feat(intake-triage): set the Issue Type and clear the triage floor ci-workflows#741
• feat(runner-policy): add ci-workflows v0.42.0 intake contracts standards#783 (contracts; must land and sync first)

🤖 Generated with Claude Code

https://claude.ai/code/session_01W6SjPvY7DmXBGzboeCq8nj

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T22:35:44.923886Z	697cbaa	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 47s —— View job

---

Security review complete ✅

• Gather context (PR diff, changed files)
• Review diff for security-relevant changes
• Report findings

Scope: .github/workflows/intake-triage.yml and .github/workflows/intake-label-needs-triage.yml — each changes only the uses: pin on its reusable-workflow call, from ab83b01 (v0.39.3) to 182aca3 (v0.42.0). No other lines changed.

Findings: none.

• Both callers still use full-length commit-SHA pins (not a tag or branch ref), so this isn't a loosened/unpinned supply-chain pin — and SHA-pin tightness/looseness is zizmor's advisory lane regardless, not this lane's.
• Job permissions: (contents: read, issues: write for intake-triage; issues: write for intake-label-needs-triage) and the secrets: CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} pass-through are unchanged by this diff — matches the PR description's claim that they equal the v0.42.0 reusable contracts.
• Neither caller passes the new floor-label/human-label inputs the v0.42.0 reusable adds; both default to the labels this repo already uses (needs-triage, needs-human), so no behavior change, no new trust boundary.
• No CLAUDE.md/AGENTS.md/rules-file edits in this diff, so the instruction-surface-deletion check doesn't apply.

No logic, authorization, injection, or secret-handling issues in this diff.

claude-lane-summary: lane=claude-security-review sha=697cbaac7e125233e308bda653d1b387b2d7043e run=38317333342

[claude]

Claude finished @kyle-sexton's task in 51s —— View job

---

Code review

• Gather context (PR body, both changed workflow files, full diff)
• Apply skip gate
• Report result

Skip gate: trivial/automated change, no meaningful review surface. The diff is two uses: pin bumps (ab83b01… v0.39.3 → 182aca3… v0.42.0) in .github/workflows/intake-label-needs-triage.yml and .github/workflows/intake-triage.yml — no logic, inputs, secrets, or permissions change in this repo. The author's verification notes (contract match against the reusable's v0.42.0 inputs/permissions) are author-claimed and unverified by me.

One thing I could not independently check: whether 182aca3ad32b79fd002def94e58eb498ac49e7af is actually the commit tagged v0.42.0 in melodic-software/ci-workflows. Cross-repo gh api calls are not available to this lane, so I can't confirm the pin-to-tag mapping myself — flagging as unverified rather than asserting it's correct.

No findings to report.
· branch chore/repin-intake-ci-workflows-v042

claude-lane-summary: lane=claude-review sha=697cbaac7e125233e308bda653d1b387b2d7043e run=38317333413

[github-actions]

claude-security-review has reviewed this pull request through 697cbaa; a later push is reviewed from there.

[github-actions]

claude-review has reviewed this pull request through 697cbaa; a later push is reviewed from there.