[kyle-sexton]

No related issue: repin to ci-workflows v0.62.0, which fixes the hosted security-review install timeouts seen on this repository.

Summary

Repins the intake-triage caller and the two AI review lane callers from ci-workflows v0.60.0 (82ca5ca9) to v0.62.0 (2fe38c031867900824c164e33a140a335ed9ecf0). v0.62.0 carries ci-workflows#858, which bounds the subprocess isolation install that hit its 1-minute step limit in hosted security-review runs here (run 39786002588, run 39788017796).

Depends on standards#846 and its sync here: until the v0.62.0 contracts land in .github/standards/runner-policy/policy.json, runner-policy fails this PR on all three callers.

Fix

• .github/workflows/intake-triage.yml: intake-triage.yml@82ca5ca… (v0.60.0) to @2fe38c0… (v0.62.0).
• .github/workflows/pr-review-hosted.yml: pr-review.yml@82ca5ca… (v0.60.0) to @2fe38c0… (v0.62.0).
• .github/workflows/pr-review-security-hosted.yml: pr-review-security.yml@82ca5ca… (v0.60.0) to @2fe38c0… (v0.62.0).

What the reusables change between v0.60.0 and v0.62.0 (v0.61.0 plus #858):

• intake-triage.yml: no change to workflow_call inputs, secrets, permissions or runs-on. Each leg writes its own lane-outcome record, a key handoff included, and the status line names the credential (ci-workflows#856); both "Isolate the runner" steps get the bounded install (docs(adr): record Phase II step 3 applied — required check live, skip-actor exception #858).
• pr-review.yml and pr-review-security.yml: two new optional inputs, credential-name (default CLAUDE_CODE_OAUTH_TOKEN, the secret these callers map) and fallback-credential-name (default empty); the callers pass neither, so with:, secrets: and grants stay as they are. The report step names the credential in the lane-outcome record (knowledge/youtube-digest: centralize .work/<epic>/<slug> sub-path shape + binary-retention landing — deferred from #558 #856), and the install step skips apt when bwrap and socat exist and bounds every apt-get call by one 50 s deadline (docs(adr): record Phase II step 3 applied — required check live, skip-actor exception #858).
• ci-workflows#857 adds only a test.

Not changed here: the other pins (intake-label-needs-triage at v0.58.0, maintenance-check-links-online at v0.59.0), which do not use these reusables. No changelog fragment: #9066 repinned these callers without one.

Verification

• actionlint on the three workflow files: no findings.
• runner-policy against this worktree: the vendored policy gives three runner-target-contract failures, auto-approval declined for each caller; standards#846's runner-policy.mjs and policy.json give Runner policy passed.
• Left out: nothing.

Related

• ci-workflows#858, released in v0.62.0.
• standards#846: the v0.62.0 runner-policy contracts.
• Prior repin of these callers: #9066 (v0.60.0).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T18:24:21.386658Z	3bae723	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[kyle-sexton]

Review lanes: substitute review on 3bae723

Neither lane reviewed this head. Both ended failure-class=skipped-validation (pr-review-hosted run 39830913931, pr-review-security-hosted run 39830913717). claude-code-action skips itself when the PR's copy of its caller workflow differs from main's, and this PR changes exactly those callers, so re-running cannot help. The previous repins, #9074 and #9066, failed in the same way.

In their place, a fresh-context security reviewer read the code the repin actually changes: ci-workflows 164c2809...2fe38c03, one commit (ci-workflows#858).

Verdict: no blocking findings.

• Unchanged surface: no change to permissions, runs-on, secrets or workflow_call inputs, and no new ${{ }} interpolation in run: steps.
• Planted bwrap cannot skip the install: the apt install is skipped when bwrap and socat are present, but no earlier step runs PR code or writes GITHUB_PATH, so PR content cannot plant them.
• Install deadline: every apt-get call shares one deadline (timeout -k 2 "$left"), so the step cannot hang, and it stays inside the step limit.
• Fails closed: the final check fails the job when either bwrap or socat is missing. Before this commit, a runner with bwrap but no socat passed.
• P5, informational: the first install attempt skips apt-get update, so a stale image's package lists could install an older bubblewrap build. That build is still signature-verified. No action needed.

The caller diff against main is the three uses: pin lines. v0.62.0 is v0.61.0 plus that one commit, so every input #9074 passes still exists. CI: ci-status passed, and runner policy printed Runner policy passed. (run 39830912911).