From d0570903657050c8ea753e5814556d651b0ec1dc Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Mon, 2 Nov 2026 20:11:27 -0500
Subject: [PATCH] feat(lanes): pass the transcript key to the reusable review
 and intake legs

The model legs inside ci-workflows' pr-review-cli.yml and intake-triage.yml seal
and upload their transcripts only when a caller passes the key, so these three
callers kept none. A test now holds every such caller to passing it.

Refs: #7676

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQb9Q1VgLEiwGgRVshK3b7
---
 .github/actions/resolve-config/callers.test.mjs | 12 ++++++++++++
 .github/workflows/intake-triage.yml             |  1 +
 .github/workflows/pr-review-hosted.yml          |  1 +
 .github/workflows/pr-review-security-hosted.yml |  1 +
 4 files changed, 15 insertions(+)

diff --git a/.github/actions/resolve-config/callers.test.mjs b/.github/actions/resolve-config/callers.test.mjs
index 85e3b2e46d4..8e201ec5a9e 100644
--- a/.github/actions/resolve-config/callers.test.mjs
+++ b/.github/actions/resolve-config/callers.test.mjs
@@ -7499,6 +7499,18 @@ test("every model leg is followed by a sealed transcript upload of its own execu
   assert.ok(legs >= 13, `only ${legs} model legs found`);
 });
 
+test("every caller of a reusable holding model legs passes the transcript key", () => {
+  let callers = 0;
+  for (const file of workflowFiles()) {
+    for (const [jobId, job] of Object.entries(workflow(file).jobs ?? {})) {
+      if (!/\/ci-workflows\/\.github\/workflows\/(pr-review-cli|intake-triage)\.yml@/.test(String(job.uses ?? ""))) continue;
+      callers++;
+      assert.equal(job.with?.["lane-transcript-public-key"], "${{ vars.LANE_TRANSCRIPT_PUBLIC_KEY }}", `${file}#${jobId}`);
+    }
+  }
+  assert.ok(callers >= 3, `only ${callers} callers found`);
+});
+
 // request-lane-token's kill-switch-ok ends a kill-switch refusal green with no
 // token, so nothing after it may run on success() alone: every later step is
 // gated, a step that reads the token runs only when it is set, and a job that
diff --git a/.github/workflows/intake-triage.yml b/.github/workflows/intake-triage.yml
index 926e58908c6..e95ce4b02e5 100644
--- a/.github/workflows/intake-triage.yml
+++ b/.github/workflows/intake-triage.yml
@@ -260,6 +260,7 @@ jobs:
       runner: ubuntu-24.04
       role: intake
       claude-args: ${{ needs.born-triaged.outputs.claude-args }}
+      lane-transcript-public-key: ${{ vars.LANE_TRANSCRIPT_PUBLIC_KEY }}
       issue-number: ${{ inputs.issue-number }}
       allowed-author-ids: ${{ needs.born-triaged.outputs.human-ids }}
       allowed-bot-sender-ids: ${{ needs.born-triaged.outputs.bot-ids }}
diff --git a/.github/workflows/pr-review-hosted.yml b/.github/workflows/pr-review-hosted.yml
index eb060a54c05..9631785a619 100644
--- a/.github/workflows/pr-review-hosted.yml
+++ b/.github/workflows/pr-review-hosted.yml
@@ -221,6 +221,7 @@ jobs:
     with:
       lane: code
       publish: comments
+      lane-transcript-public-key: ${{ vars.LANE_TRANSCRIPT_PUBLIC_KEY }}
       # Empty unless resolve-model succeeded, so a failed job's partial output
       # never reaches the review.
       model-args: ${{ needs.resolve-model.result == 'success' && needs.resolve-model.outputs.claude-args || '' }}
diff --git a/.github/workflows/pr-review-security-hosted.yml b/.github/workflows/pr-review-security-hosted.yml
index d7e3d7a07c2..67e582cba08 100644
--- a/.github/workflows/pr-review-security-hosted.yml
+++ b/.github/workflows/pr-review-security-hosted.yml
@@ -226,6 +226,7 @@ jobs:
     with:
       lane: security
       publish: comments
+      lane-transcript-public-key: ${{ vars.LANE_TRANSCRIPT_PUBLIC_KEY }}
       # Empty unless resolve-model succeeded, so a failed job's partial output
       # never reaches the review.
       model-args: ${{ needs.resolve-model.result == 'success' && needs.resolve-model.outputs.claude-args || '' }}