ci: cut Actions burn — scope push triggers + concurrency-cancel - #9
Merged
Conversation
…push + concurrency-cancel)
…push + concurrency-cancel)
…+ concurrency-cancel)
|
hyperpolymath
added a commit
to metadatastician/metadatastician-governance
that referenced
this pull request
Aug 18, 2026
## What changed - moves allow-list detection/remediation to the centrally enforced organization policy endpoint - fails closed on API and response-shape errors instead of converting them into healthy results - inspects the latest run of every active workflow for startup and billing health - normalizes/deduplicates the canonical allow-list before compare/write - makes D-BURN detection order-independent and remediation default-branch-aware/idempotent - makes dry-run reporting non-mutating and closes the rolling issue only after a complete finding-free live sweep - SHA-pins and lock-records the sweep's own checkout dependency - updates operator documentation and the issue #14 remediation record ## Root cause The original system tried to mutate repository allow-lists even though GitHub centrally enforced the setting at organization scope; those writes return HTTP 409. It also suppressed API errors and treated a capped historical run page as current health. Separately, the sweep itself used a mutable checkout ref under an organization policy requiring SHA pins, so all seven scheduled runs ended in zero-job startup failure. ## Live estate work completed - enumerated 34 non-archived, non-fork source repositories (the issue's historical horizon was 28) - reconciled the inherited 20-pattern setting against 118 unique canonical patterns - applied and read back all 118 patterns at the organization endpoint - opened metadatastician/_pathroot#9 for the three current D-BURN findings ## Validation - `bash -n scripts/ci-health/*.sh` - `shellcheck scripts/ci-health/*.sh` - `actionlint .github/workflows/ci-health-sweep.yml` - `git diff --check` - `gh actions-lock .github/workflows/ci-health-sweep.yml --no-fix --json=valid,findings,dependencies` → `valid: true` - fail-closed negative probe → exit 2 + `E-INSTRUMENT` - live organization detector after update → exit 0, no allow-list finding Closes #14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated by metadatastician-governance ci-health-sweep. Scopes
pushto the default branch (kills push+PR double-runs) and addsconcurrency: cancel-in-progressto read-only PR checks. No SPDX/logic changes.