From 652b43ef782b6a80ae30413c953e5a6cbd9311d7 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Fri, 23 Oct 2026 17:22:21 -0400
Subject: [PATCH] feat(runner-policy): register the ci-workflows v0.65.0
 intake-triage and pr-review-cli contracts

v0.65.0 adds the optional costUsd field to the lane-outcome record
(ci-workflows#872). intake-triage.yml and pr-review-cli.yml are unchanged
and reach the action through $/, so both contracts copy their prior
entries forward verbatim.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 components/runner-policy/policy.json          | 47 +++++++++++++++++++
 .../runner-policy/runner-policy.test.mjs      | 20 ++++++++
 2 files changed, 67 insertions(+)

diff --git a/components/runner-policy/policy.json b/components/runner-policy/policy.json
index b708c7a9..8f7c94a6 100644
--- a/components/runner-policy/policy.json
+++ b/components/runner-policy/policy.json
@@ -307,6 +307,32 @@
         "issues": "write"
       }
     },
+    "melodic-software/ci-workflows/.github/workflows/intake-triage.yml@d02b8697e092705153f0996549b05f95a446bb52": {
+      "routing": "runner-input",
+      "runnerInput": "runner",
+      "role": "automations",
+      "allowedInputs": [
+        "runner",
+        "allowed-labels",
+        "escalation-label",
+        "floor-label",
+        "instructions",
+        "cli-version",
+        "claude-args",
+        "issue-number",
+        "allowed-author-ids",
+        "allowed-bot-sender-ids",
+        "role"
+      ],
+      "allowedSecrets": {
+        "CLAUDE_API_KEY": "${{ secrets.AUTOMATIONS_CLAUDE_API_KEY }}",
+        "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.AUTOMATIONS_CLAUDE_CODE_OAUTH_TOKEN }}"
+      },
+      "allowedCallerPermissions": {
+        "contents": "read",
+        "issues": "write"
+      }
+    },
     "melodic-software/ci-workflows/.github/workflows/pr-review.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2": {
       "routing": "runner-input",
       "runnerInput": "runner",
@@ -854,6 +880,27 @@
         "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.REVIEWS_CLAUDE_CODE_OAUTH_TOKEN }}"
       }
     },
+    "melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@d02b8697e092705153f0996549b05f95a446bb52": {
+      "routing": "hosted-only",
+      "fixedRunsOn": ["ubuntu-24.04"],
+      "allowedInputs": [
+        "lane",
+        "publish",
+        "role",
+        "model-args",
+        "allowed-bot-sender-ids",
+        "allowed-author-ids",
+        "docs-only-paths",
+        "incremental-review",
+        "cli-version",
+        "hold-label",
+        "hold-paths"
+      ],
+      "allowedSecrets": {
+        "CLAUDE_API_KEY": "${{ secrets.REVIEWS_CLAUDE_API_KEY }}",
+        "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.REVIEWS_CLAUDE_CODE_OAUTH_TOKEN }}"
+      }
+    },
     "melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2": {
       "routing": "runner-input",
       "runnerInput": "runner",
diff --git a/components/runner-policy/runner-policy.test.mjs b/components/runner-policy/runner-policy.test.mjs
index f72e672b..6ebd1985 100644
--- a/components/runner-policy/runner-policy.test.mjs
+++ b/components/runner-policy/runner-policy.test.mjs
@@ -9923,6 +9923,26 @@ test("the pr-review-cli contract at the v0.64.2 tag copies its v0.64.1 entry for
   assert.equal(Object.keys(contracts).filter((k) => k.endsWith(`@${sha}`)).length, 1);
 });
 
+// v0.65.0 changes only report-lane-outcome's classify.cjs, which adds the
+// optional costUsd field to the lane-outcome record (ci-workflows#872);
+// intake-triage.yml and pr-review-cli.yml reach it through $/ and are
+// unchanged, so both contracts copy forward verbatim.
+test("the intake-triage and pr-review-cli contracts at the v0.65.0 tag copy their prior entries forward verbatim", () => {
+  const contracts = BASE_POLICY.approvedReusableWorkflowContracts;
+  const key = (workflow, sha) =>
+    `melodic-software/ci-workflows/.github/workflows/${workflow}.yml@${sha}`;
+  const sha = "d02b8697e092705153f0996549b05f95a446bb52";
+  assert.deepEqual(
+    contracts[key("intake-triage", sha)],
+    contracts[key("intake-triage", "2fe38c031867900824c164e33a140a335ed9ecf0")],
+  );
+  assert.deepEqual(
+    contracts[key("pr-review-cli", sha)],
+    contracts[key("pr-review-cli", "6d6cb798e7cb7560a0f9327d8a22398961c23b31")],
+  );
+  assert.equal(Object.keys(contracts).filter((k) => k.endsWith(`@${sha}`)).length, 2);
+});
+
 // Convergence as a property, never as a hardcoded SHA. The daily
 // claude-lanes-repin lane rewrites these components on every ci-workflows
 // release, and a test naming one revision would go red by construction on