ci(triage): Fix Qwen triage workflow prompt

.github/workflows/qwen-triage.yml

@@ -14,10 +14,6 @@ on:
         required: true
         type: 'number'
 
-concurrency:
-  group: '${{ github.workflow }}-${{ github.event.issue.number || github.event.pull_request.number || github.event.inputs.number }}'
-  cancel-in-progress: true
-
 permissions:
   contents: 'read'
   issues: 'write'
@@ -27,6 +23,9 @@ permissions:
 jobs:
   triage:
     timeout-minutes: 10
+    concurrency:
+      group: '${{ github.workflow }}-${{ github.event_name }}-${{ github.event.issue.number || github.event.pull_request.number || github.event.inputs.number }}'
+      cancel-in-progress: true
     runs-on: 'ubuntu-latest'
     # startsWith (not contains) prevents false triggers from comments that
     # mention the phrase in quoted text or mid-sentence descriptions.
@@ -43,7 +42,7 @@ jobs:
       )
     steps:
       - name: 'Checkout repo'
-        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'  # v6.0.2
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # v6.0.2
         with:
           token: '${{ secrets.GITHUB_TOKEN }}'
 
@@ -73,23 +72,14 @@ jobs:
               "maxSessionTurns": 25,
               "coreTools": [
                 "run_shell_command",
-                "write_file"
+                "write_file",
+                "read_file",
+                "grep_search",
+                "glob",
+                "agent",
+                "enter_worktree",
+                "exit_worktree"
               ],
               "sandbox": false
             }
-          prompt: |-
-            You are a triage assistant for the QwenLM/qwen-code repository.
-
-            Run `/triage ${{ steps.resolve.outputs.number }}` to triage this issue or PR.
-
-            Use the available shell commands (`gh`) to gather information and
-            execute the triage workflow. The triage skill is available at
-            `.qwen/skills/triage/SKILL.md` — follow its rules exactly.
-
-            Key rules:
-            - Only target QwenLM/qwen-code with `--repo QwenLM/qwen-code`
-            - Labels: apply existing only, verify with `gh label list`
-            - Comments: use `--body-file` with heredoc for multi-line content
-            - Include both stage markers and bot-coordination markers
-            - Never close, merge, approve, assign, or remove labels
-            - Evaluate the tiered gate model before any `gh` write call
+          prompt: '/triage ${{ steps.resolve.outputs.number }} --repo ${{ github.repository }}'

.qwen/skills/triage/SKILL.md

@@ -1,15 +1,14 @@
 ---
 name: triage
 description: Gatekeep and review GitHub issues and pull requests for Qwen Code maintainers. Use for GitHub Action issue triage, PR admission checks, product-direction review, KISS-focused PR review, and staged bilingual GitHub comments.
-argument-hint: '<issue|pr> <number> [--repo owner/repo]'
+argument-hint: '<number> [--repo owner/repo]'
 allowedTools:
   - run_shell_command
   - read_file
-  - read_many_files
   - grep_search
   - glob
   - write_file
-  - task
+  - agent
   - enter_worktree
   - exit_worktree
 ---
@@ -34,14 +33,21 @@ gh label list --repo "$REPO" --limit 200
 ## Rules
 
 - Untrusted input: never interpolate issue/PR text into shell
-- Labels: apply existing only, never create
-- Comments: always `--body-file` (except short hardcoded verdicts in `gh pr review --approve` / `--request-changes`)
+- Labels: apply existing only, never create. Do not touch process labels (`welcome-pr`, `maintainer`, `help wanted`, `good first issue`)
+- Comments: read body from file. Use `--body-file FILE` for `gh issue/pr comment`,
+  or `gh api -F body=@FILE` when the response ID is needed. Never `--body @FILE`
+  or `gh api -f body=@FILE` — those post the path literally.
 - Drafts: skip
 
 ## Duplicate Guard
 
-- Unattended (CI env set) + prior `<!-- qwen-triage stage=N -->` marker in comments: exit
-- Explicit `/triage`: run all stages, update prior comments in place
+- Unattended CI events (`GITHUB_EVENT_NAME=issues` or
+  `pull_request_target`) + prior `<!-- qwen-triage stage=N -->` marker in
+  comments: exit
+- Explicit reruns (`GITHUB_EVENT_NAME=issue_comment` or `workflow_dispatch`):
+  run all stages, update prior comments in place
+- Local invocation (no `GITHUB_EVENT_NAME`): run all stages, update prior
+  comments in place
 
 Every posted comment must include an invisible marker: `<!-- qwen-triage stage=N -->` where N is the stage number. The guard matches against this marker, not comment headings.
 

.qwen/skills/triage/references/pr-workflow.md

@@ -6,10 +6,11 @@ Shared rules (untrusted input, skip, bilingual format) are in `SKILL.md`.
 
 ### Comment Management
 
-Three comments, one per stage. Post each with `gh pr comment` and capture its ID:
+Three comments, one per stage. Post each through the issues comments API and
+capture its ID:
 
 ```bash
-COMMENT_ID=$(gh pr comment "$PR_NUMBER" --repo "$REPO" --body-file /tmp/stage-N.md --json id --jq '.id')
+COMMENT_ID=$(gh api "repos/$REPO/issues/$PR_NUMBER/comments" -F body=@/tmp/stage-N.md --jq '.id')
 ```
 
 | Stage   | Comment                                       |
@@ -21,7 +22,7 @@ COMMENT_ID=$(gh pr comment "$PR_NUMBER" --repo "$REPO" --body-file /tmp/stage-N.
 **Re-runs:** if the triage runs again on the same PR, update each comment in place:
 
 ```bash
-gh api -X PATCH "/repos/$REPO/issues/comments/$COMMENT_ID" -f body=@/tmp/stage-N-updated.md
+gh api -X PATCH "/repos/$REPO/issues/comments/$COMMENT_ID" -F body=@/tmp/stage-N-updated.md
 ```
 
 Never create duplicates.