Describe the feature or problem you’d like to solve

Follow on from #14739

Currently, the hourly Dependabot triage workflow starts its generated agent job even when its deterministic worklist is empty.

The pre-flight step correctly found that #14716 had already been assessed, produced an empty worklist, and caused zero model invocations.

$ tmp=$(mktemp -d); gh aw audit 39137237820 --repo cli/cli --artifacts usage,agent -o "$tmp" >/dev/null; run_dir=$(find "$tmp" -type f -name audit.json -exec dirname {} \; | head -1); grep -E 'PR #[0-9]+: (already assessed|needs assessment)|Work list:' "$run_dir/workflow-logs/3_agent.txt" | sed -E 's/^.*Z //' | tail -2; jq '{working_set:.working_set}' "$run_dir/usage/activity/summary.json"; rm -rf "$tmp"

PR #14716: already assessed at 35c2bf381bb42655fb40ec8ebf2e0a0548ef7543, skipping
Work list: 0 PR(s) -> /tmp/gh-aw/dependabot-worklist.json
{
  "working_set": {
    "cumulative_input_tokens": 0,
    "peak_input_tokens": 0,
    "invocations": 0
  }
}

However, gh-aw records the job as started before its harness observes the noop. The daily guardrail then treats the empty accounting file as unknown and applies the max-ai-credits fallback.

Five consecutive no-work runs were each counted as 1000 AIC, which exhausted the 5000 daily guardrail.

$ gh run view 39141727797 --repo cli/cli --log | grep -E 'Computed run AIC.*(39137237820|39132745345|39128819878|39124342426|39120364428)|Completed AIC inspection window' | sed -E 's/^activation[[:space:]]+UNKNOWN STEP[[:space:]]+//'

[daily-workflow-aic] Computed run AIC: {"runId":39137237820,"aic":1000,"reason":"max_ai_credits_fallback"}
[daily-workflow-aic] Computed run AIC: {"runId":39132745345,"aic":1000,"reason":"scan_cache"}
[daily-workflow-aic] Computed run AIC: {"runId":39128819878,"aic":1000,"reason":"scan_cache"}
[daily-workflow-aic] Computed run AIC: {"runId":39124342426,"aic":1000,"reason":"scan_cache"}
[daily-workflow-aic] Computed run AIC: {"runId":39120364428,"aic":1000,"reason":"scan_cache"}
[daily-workflow-aic] Completed AIC inspection window: {"currentAIC":5000,"threshold":5000,"exceeded":true}

The generated workflow marks execution as started immediately before entering the harness here. The harness can then exit without invoking the model.

Proposed solution

Split scheduling and agent execution into separate workflows.

An ordinary GitHub Actions workflow should run hourly and perform the existing PR listing, CI readiness, and assessed-head checks. It should dispatch dependabot-triage with its existing pr_number input only when a PR needs assessment.

The expected output for this issue is:

• No agentic workflow run is created when no Dependabot PR needs assessment.
• Each ready, unassessed Dependabot PR is dispatched for triage.
• The existing once-per-head-SHA behaviour remains unchanged.
• The max-daily-ai-credits guardrail remains enabled for genuine agent runs.

Additional context

Lowering max-ai-credits, reducing the schedule frequency, or raising the daily limit would reduce the impact, but none fixes the false accounting path.

The underlying gh-aw behaviour should still be reported upstream. This repository-side split prevents that behaviour from blocking Dependabot triage while preserving the guardrail.