feat(runner-policy): review issue-triage-label.yml@c5e729c reusable contract

[kyle-sexton]

Closes #235

Summary

Registers ci-workflows' issue-triage-label reusable workflow as a
reviewed runner-input contract in components/runner-policy/policy.json,
pinned to its merged SHA c5e729c0af0e55ffed4675ec85c1b57356fef79e:

"melodic-software/ci-workflows/.github/workflows/issue-triage-label.yml@c5e729c0af0e55ffed4675ec85c1b57356fef79e": {
  "routing": "runner-input",
  "runnerInput": "runner",
  "allowedInputs": ["runner", "label", "label-prefix"],
  "allowedSecrets": {},
  "allowedCallerPermissions": { "issues": "write" }
}

• allowedInputs covers the reusable's full workflow_call.inputs surface
  (runner, label, label-prefix) — a caller may pass any subset.
• allowedSecrets: {} — the reusable takes no secrets.
• allowedCallerPermissions: { issues: write } — the reusable's job needs
  exactly issues: write to read and add labels; no contents (no checkout).
• No selectorResultInput — the reusable has no chained-selector
  (prerequisite-result-style) input.

Locally verified: npm run test:runner-policy (227/227 passing),
npm run lint:runner-policy ("Runner policy passed."), npm run lint:md,
npm run lint:hooks, plus lefthook's pre-commit gate (typos, gitleaks,
editorconfig, biome) on commit.

Related

• feat(issue-triage-label): reusable workflow to auto-apply needs-triage floor label ci-workflows#191 — the reusable workflow, merged.
• feat(issue-triage-label-self): dogfood caller pinned at merged SHA ci-workflows#195 — its dogfood self-caller, merged,
  pinned at this same merged SHA.
• Add issue-triage-label-self.yml dogfood caller pinned at merged SHA ci-workflows#192 — end-to-end proof the self-caller
  actually applies the floor label live.
• feat(workflows): add thin caller for the issue-triage-label reusable claude-code-plugins#850 — the consumer PR blocked on
  this contract (its Runner policy check fails without it).
• automation: auto-apply 'priority: needs-triage' to new issues lacking a priority label claude-code-plugins#506 — the issue driving that caller.

Test plan

• npm run test:runner-policy (227 passing)
• npm run lint:runner-policy ("Runner policy passed.")
• npm run lint:md
• npm run lint:hooks
• lefthook pre-commit gate (typos, gitleaks, editorconfig, biome)

[claude]

Claude finished @kyle-sexton's task in 1m 42s —— View job

---

PR Review

• Gather context
• Read changed files and REVIEW.md
• Analyze the policy.json entry for correctness and security
• Post review findings

---

File reviewed: components/runner-policy/policy.json

Summary: Clean, minimal addition. The new contract is structurally consistent with its peers, the permission surface is tight, and no secrets are introduced. No blocking issues found.

---

Structural correctness

The new entry conforms to every pattern established by existing runner-input contracts:

Field	Value	Assessment
routing	runner-input	Correct for a reusable that accepts a runner input
runnerInput	runner	Matches the conventional input name
allowedInputs	["runner", "label", "label-prefix"]	PR states this is the full workflow_call.inputs surface — author-attested
allowedSecrets	{}	Correct; reusable takes no secrets
allowedCallerPermissions	{ "issues": "write" }	Matches minimum needed for label operations
selectorResultInput	(absent)	Correct; no chained-selector (prerequisite-result-style) input

The SHA is a pinned, immutable commit reference (c5e729c0af0e55ffed4675ec85c1b57356fef79e), not a branch or tag — consistent with the threat model requirement that workflow identities be immutable.

---

Security (REVIEW.md "always check" criteria)

• No secrets in tracked source: allowedSecrets: {} — nothing to expose. ✓
• Permission minimality: Only issues: write is granted. No contents permission, confirming no checkout path is needed. Comparing against link-check.yml and pulumi-version-drift-check.yml which do grant contents: read alongside issues: write (because they checkout), the absence of contents here is intentional and correct. ✓
• No injection surface: This is a JSON configuration addition with no string interpolation or dynamic evaluation paths. ✓
• Other REVIEW.md "always check" criteria (object-level authorization, multi-tenancy scoping, audit logging, atomicity) are not applicable to a config-only addition.

---

Minor observation

The allowedInputs list is author-attested against the live workflow but cannot be independently verified in this review (the workflow definition lives in melodic-software/ci-workflows at that SHA). The cross-references in the PR body — ci-workflows#191 (the reusable), ci-workflows#195 (dogfood self-caller at the same SHA), and ci-workflows#192 (end-to-end proof) — provide strong corroborating evidence. This is consistent with how other contracts in this file are registered.

---

Verdict: LGTM. The entry is minimal, correctly structured, and the permission surface matches what label-only issue operations require.

[kyle-sexton]

Operator basis recorded (in-session approval, 2026-07-21 ~16:5xZ): operator approved merging this runner-policy allowlist entry via explicit in-session confirmation to the control tower. 227/227 policy tests green; the workflow it authorizes is merged and runtime-proven (ci-workflows#192 e2e). Merging under that recorded basis.

This was generated by AI (control tower, session 6).