[kyle-sexton]

Refs: #8491

Summary

Repins the intake-triage caller from ci-workflows v0.58.0 (5e18f3d6) and the two AI review lane callers from v0.59.1 (8bd4d7f9) to v0.60.0 (82ca5ca9be6e18a1addb7986eae15689339aedbc). v0.60.0 carries ci-workflows#854: intake triage gives the model each trusted comment's html_url, which #8491 needs.

Depends on standards#842 and its sync here: until the v0.60.0 contracts land in .github/standards/runner-policy/policy.json, runner-policy fails this PR on all three callers.

Fix

• .github/workflows/intake-triage.yml: intake-triage.yml@5e18f3d… (v0.58.0) to @82ca5ca… (v0.60.0).
• .github/workflows/pr-review-hosted.yml: pr-review.yml@8bd4d7f… (v0.59.1) to @82ca5ca… (v0.60.0).
• .github/workflows/pr-review-security-hosted.yml: pr-review-security.yml@8bd4d7f… (v0.59.1) to @82ca5ca… (v0.60.0).

What the reusables change between the tags:

• No change to on.workflow_call inputs, secrets, workflow or job permissions, or runs-on, so the callers' with:, secrets: and grants stay as they are.
• intake-triage.yml: the issue file lists each comment's link and the prompt tells the model so (ci-workflows#854); its report step passes lane-id: intake-triage.
• pr-review.yml and pr-review-security.yml are byte-identical to v0.59.1. Their commit-relative actions change: report-lane-outcome can write a lane-outcome record (ci-workflows#853), and the sandbox probe error names Docker's seccomp profile (ci-workflows#849).

Not changed here: the other v0.58.0 and older pins (pr-require-checks actions, pr-verify, intake-label-needs-triage and others), which do not use these reusables. No changelog fragment: #8938 repinned the review callers without one.

Verification

• actionlint on the three workflow files: no findings.
• node .github/standards/runner-policy/runner-policy.mjs --root .: with the vendored policy (identical to standards main), three runner-target-contract failures, auto-approval declined for each caller; with standards#842's policy.json copied in, Runner policy passed. (file restored afterwards).

Related

• ci-workflows#854, released in v0.60.0.
• standards#842: the v0.60.0 runner-policy contracts.
• Prior repin of the review callers: ci: repin the review lanes to ci-workflows v0.59.1 #8938 (v0.55.0 to v0.59.1).

🤖 Generated with Claude Code

[kyle-sexton]

#9074 pins the same three callers to ci-workflows v0.61.0 (164c280). v0.61.0 is v0.60.0 plus ci-workflows#856 and #857, so it still carries ci-workflows#854, which #8491 needs. Its runner-policy contracts are in standards#843. Once #9074 merges, this PR is redundant. I've left it open for its author to close.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T15:05:42.264202Z	a94d2d2	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.