[kyle-sexton]

Refs: #8800

Summary

Moves the two intake callers from ci-workflows v0.56.0 (1bb8953) to v0.58.0 (5e18f3d6): .github/workflows/intake-triage.yml:181 and .github/workflows/intake-label-needs-triage.yml:59. #8800 left them at v0.56.0 because the synced runner policy had no reviewed contract for either at v0.58.0. standards#832 added those contracts, and #8877 synced them here.

With this, intake works the way pr-verify already does on v0.58.0:

• A rejected API key (401 or 402) hands off to the automations subscription instead of failing intake.
• A 403 stops the run.
• Intake resolves the latest Claude Code CLI.

Fix

• The only changes are the two uses: pins. No caller input, secret or permission changes.
• intake-label-needs-triage.yml is byte-identical between the two tags.
• intake-triage.yml keeps its workflow inputs, secrets, outputs and every job's permissions. Its steps gain three things:
  • the handoff gate (handoff == 'true' || credential-present == 'false');
  • fallback-reason: auth;
  • the latest CLI default.
• GitHub Security & Cost reviewed those step changes on standards#832.

Verification

• node .github/standards/runner-policy/runner-policy.mjs --root .: "Runner policy passed."
• actionlint on both changed files: no findings.

Related

• ci: repin ci-workflows to v0.58.0 #8800 (the v0.58.0 repin of the other callers)
• standards#832 (the v0.58.0 intake runner contracts)
• chore: sync standards components #8877 (the standards sync that brought them here)

This changes .github/workflows, so the owner merges it.

🤖 Generated with Claude Code

[github-actions]

claude-security-review reviewed 42ee228cb6beced472ff5d0553b961b05c27210f: 0 finding(s), 0 as inline comments.

No security issues found in PR #8892 at 42ee228.

The PR changes one line in each of .github/workflows/intake-label-needs-triage.yml and .github/workflows/intake-triage.yml. Both move the melodic-software/ci-workflows reusable-workflow pin from the v0.56.0 SHA to 5e18f3d6cebd6fa5e66b0941ee0f7ed6ba288d6c, labelled v0.58.0. It's still a full 40-character SHA pin. The diff leaves permissions:, triggers, with: inputs and secrets passing as they were. It doesn't touch any instruction surface.

Pin and supply-chain changes belong to zizmor's advisory lane, so I didn't report on them here. I tried to confirm that the SHA matches the v0.58.0 tag, but the sandbox required approval for gh api and I skipped it. The commit message says standards#832 reviewed the runner contracts at that SHA. I did not check that the SHA matches the tag or review the contents of the reusable workflows. That is outside this PR's diff.

[github-actions]

claude-review reviewed 42ee228cb6beced472ff5d0553b961b05c27210f: 0 finding(s), 0 as inline comments.

No findings. The PR changes only two uses: pins, in intake-triage.yml and intake-label-needs-triage.yml, from ci-workflows v0.56.0 to v0.58.0 (5e18f3d6).

• Runner policy: .github/standards/runner-policy/policy.json already holds reviewed contract entries for both new pins (lines 206 and 586), so the runner-policy check should accept them. I confirmed this by reading the file.
• Scope: Caller inputs, secrets and permissions are unchanged in the diff.
• Not verified: I could not check that 5e18f3d6 is the commit v0.58.0 points to, because the GitHub API call was not permitted in this session. The PR's claims that the runner-policy script and actionlint pass, and that the label workflow is byte-identical between the tags, are author-claimed and I did not run them.
• Closing issue: The PR uses Refs: #8800 and closes no issue, so there are no acceptance criteria to check.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T16:05:09.130244Z	42ee228	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.