Protect PR triage scans from unrelated comment traffic

.github/PR_TRIAGE.md

@@ -64,8 +64,17 @@ addresses the findings; a maintainer reviews the new head before any further clo
 
 `pr-triage.yml` runs only from exact `refs/heads/main` using a reviewed, full-SHA-pinned
 community action and the built-in short-lived token. Its only permissions are `issues: write`
-and `pull-requests: write`. It serializes comment events and periodic recovery, checks out no
-repository code, executes no contributor text, downloads no artifacts, and has no secrets,
-OIDC, contents-write, workflow approval/rerun, merge, publishing, or release authority.
+and `pull-requests: write`. Only PR comments containing `/astral-triage close ` enter the
+triage job; ordinary issue comments and unrelated PR comments are skipped before runner
+allocation. Context scans and decision jobs share one repository-wide job concurrency group.
+The controller checks out no repository code, executes no contributor text, downloads no
+artifacts, and has no secrets, OIDC, contents-write, workflow approval/rerun, merge,
+publishing, or release authority.
 Semantic quality judgments remain maintainer decisions. This policy does not replace product
 review, required checks, security policy, the owning constitution, or release qualification.
+
+Scheduled and manual-dispatch scans reconcile context only; they never replay closure
+commands. GitHub may replace a pending job even with `cancel-in-progress: false`. Confirm
+the public decision receipt and PR state after a command; if a run was cancelled without
+applying the decision, review the current head again and post a fresh command or close
+manually with the same evidence.

.github/workflows/pr-triage.yml

@@ -13,12 +13,12 @@ on:
         type: boolean
         default: true
 permissions: {}
-concurrency:
-  group: pr-triage
-  cancel-in-progress: false
 jobs:
   triage:
-    if: github.ref == 'refs/heads/main'
+    if: (github.event_name != 'workflow_dispatch' || github.ref == 'refs/heads/main') && (github.ref == 'refs/heads/main' && (github.event_name != 'issue_comment' || (github.event.issue.pull_request && contains(github.event.comment.body, '/astral-triage close '))))
+    concurrency:
+      group: pr-triage
+      cancel-in-progress: false
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     permissions:

tests/test_pr_triage.py

@@ -14,16 +14,23 @@
 def assert_contract(text):
     assert re.search(r"(?m)^permissions: \{\}$", text)
     assert re.findall(r"(?m)^  ([\w-]+):$", text.split("jobs:\n", 1)[1]) == ["triage"]
-    assert re.findall(r"(?m)^    if: (.*)$", text) == ["github.ref == 'refs/heads/main'"]
+    assert re.findall(r"(?m)^    if: (.*)$", text) == [
+        "(github.event_name != 'workflow_dispatch' || github.ref == 'refs/heads/main')"
+        " && (github.ref == 'refs/heads/main' && (github.event_name != 'issue_comment'"
+        " || (github.event.issue.pull_request && contains(github.event.comment.body,"
+        " '/astral-triage close '))))"
+    ]
     assert re.findall(r"(?m)^    timeout-minutes: (\d+)$", text) == ["5"]
     assert re.findall(r"(?m)^      (\S+): (read|write)$", text) == [
         ("issues", "write"),
         ("pull-requests", "write"),
     ]
     assert re.findall(r"(?m)^      - uses: (\S+)$", text) == [ACTION]
     assert not re.search(r"(?m)^\s*(?:- )?(?:run|secrets|env|id-token|contents|environment):", text)
-    assert "  group: pr-triage\n" in text
-    assert "  cancel-in-progress: false\n" in text
+    assert not re.search(r"(?m)^concurrency:", text)
+    assert re.findall(r"(?m)^    concurrency:$", text) == ["    concurrency:"]
+    assert re.findall(r"(?m)^      group: (.*)$", text) == ["pr-triage"]
+    assert re.findall(r"(?m)^      cancel-in-progress: (.*)$", text) == ["false"]
     triggers = text.split("on:\n", 1)[1].split("permissions:", 1)[0]
     assert re.findall(r"(?m)^  ([\w-]+):$", triggers) == [
         "issue_comment",
@@ -54,6 +61,16 @@ def test_privilege_and_execution_mutations_are_rejected(self):
             ("permissions: {}", "permissions: write-all"),
             ("cancel-in-progress: false", "cancel-in-progress: true"),
             ("group: pr-triage", "group: pr-triage-${{ github.run_id }}"),
+            ("github.event.issue.pull_request", "true"),
+            ("contains(github.event.comment.body, '/astral-triage close ')", "true"),
+            (
+                "    concurrency:\n      group: pr-triage\n      cancel-in-progress: false\n",
+                "",
+            ),
+            (
+                "jobs:\n",
+                "concurrency:\n  group: pr-triage\n  cancel-in-progress: false\njobs:\n",
+            ),
             ("types: [created]", "types: [created, edited]"),
             ("        default: true", "        default: false"),
             ("    steps:", "    env:\n      TOKEN: value\n    steps:"),