Repository navigation
Runbook gotcha: any fix to squad-repo-health.yml is unverifiable in CI until it merges #1800
Description
The property
.github/workflows/squad-repo-health.yml is permanently self-blocking: a pull request that fixes this workflow is always tested against the old, unfixed copy.
Two mechanisms combine:
on: pull_request_target— GitHub takes the workflow definition from the base branch, not from the PR head. This is inherent to the trigger.- The workflow then deliberately checks out base-branch scripts as well. There is no
ref:override on any of its four checkout steps (onlyfetch-depth: 0), and there is a# SAFETY:comment explaining that this is intentional — running untrusted PR code underpull_request_target's elevated token would be a security hole.
Both choices are correct. The consequence is not a bug to fix, it is a property to know about.
Why it matters
The only pre-merge signal available for a change to this workflow is "the job didn't crash."
That is exactly the weak signal that let #1770 live undetected. A crashed github-script reporter is indistinguishable from a clean run to anyone skimming the checks list — it fails the class of finding it exists to catch, silently.
How it showed up
#1770 fixed three repo-health reporters that crashed on any finding message containing a backtick. On the PR that fixed it (#1786), Repo Health / Security Review — Permissions & Secrets was red at head with:
##[error]Unhandled error: SyntaxError: Unexpected identifier 'git'
at new AsyncFunction (<anonymous>)
at callAsyncFunction (.../github-script/dist/index.js:64949:16)
The fix was verified complete on the branch — zero remaining backtick-literal interpolation sites, all three reporters moved to the env:/process.env boundary. It simply had no effect, because dev's copy is what ran.
FIDO hit the same wall independently on #1792.
What to do when you touch this workflow
- Expect the check to be red or misleading. Do not read a green
Repo Healthon such a PR as evidence the fix works; do not read a red one as evidence it doesn't. - Verify locally instead. Run the scanner directly (
node scripts/security-review.mjs) and compile thescript:bodies out of the real YAML —test/scripts/repo-health-comment-transport.test.ts(added in fix(ci): stop splicing repo-health report content into github-script bodies #1786) does exactly this and is the intended substitute for the missing CI signal. - Satisfy the gate on its own terms. If your PR's own diff trips a repo-health rule, reword the diff. Do not add an ignore entry, lower a severity, or add a path exclusion to get green.
- Re-verify immediately after merge, since that is the first moment the fix is actually live.
Placement
Belongs in the runbook family alongside gotcha #10.
Activity
github-actions commentedon Sep 11, 2026
🔄 Ralph — Auto-Triage
Assigned to: RETRO
Reason: Matched routing keyword(s): security, security review
Source: routing-rule
github-actions commentedon Sep 13, 2026
🔄 Ralph — Auto-Triage
Assigned to: security-reviewer
Reason: Matched routing keyword(s): Security review, security, review, secrets
Source: routing-rule
github-actions commentedon Sep 24, 2026
🔄 Ralph — Auto-Triage
Assigned to: security-reviewer
Reason: Matched routing keyword(s): Security review, security, review, secrets
Source: routing-rule
github-actions commentedon Sep 24, 2026
📋 Assigned to agentic-workflows-dev (Agentic Workflows Engineer)
Issue: #1800 — Runbook gotcha: any fix to squad-repo-health.yml is unverifiable in CI until it merges
agentic-workflows-dev will pick this up in the next Copilot session.
bradygaster commentedon Sep 28, 2026
Post-merge Repo Health canary evidence
Squad File Leakagejob 109178250903 succeeded, detected exactly one file, and produced one authoritative marker comment. The diagnostic was Git's canonical C-quoted display:".squad/canary-\paired`-${-apostrophe-'-"double quote".md"`.Squad File Leakagejob 109179961928 reportedleaked: false,files: [], and removed the stale marker. Current marker count: 0.canary/repo-health-1790637198returns 404 / has ahead_ref_deletedevent, and no local canary/temp artifact remains.Acceptance verdict: FAIL (issue remains open). The reporter preserved the semantic filename via Git's canonical C-quoted representation, but the runbook requires the literal assertion
marked[0].body.includes(expected). That assertion is false because the diagnostic contains outer C-quote characters and backslash-escaped embedded double quotes. Remaining blocker: decode Git C-quoted paths before rendering, or explicitly revise the runbook's literal exact-filename contract and re-run the authoritative canary.Merge origin/dev into issue #1800 repair
bradygaster commentedon Sep 28, 2026
Reopened after #2101 merged because the documented acceptance criterion still requires a fresh authoritative post-fix detection and cleanup canary. The merge keyword closed this issue before that evidence existed. Close only after exact semantic hostile-path detection, authoritative marker verification, cleanup verification, and run URLs are recorded.
bradygaster commentedon Sep 28, 2026
Authoritative post-merge Repo Health canary — PASS
PR #2101 is present on live
origin/devat merge SHA09042a7adbdad9a7759cdd338a4deb98679a31ef(merged 2026-09-28T23:44:03Z), including commit14fad3d9ebcc2f06876a583b3e3e332a9e8eafc3(fix(repo-health): decode Git-quoted leakage paths).canary/repo-health-1790639107), closed unmerged.36499644194,pull_request_target, success).Squad File Leakagejob: https://github.com/bradygaster/squad/actions/runs/36499644194/job/109187189291 (job ID109187189291, success).5880852048). Exactly one marker was present and it contained the authoritative-evidence label.===, not substring or escaped-equivalence). Expected and sole listed semantic path were exactly:36499700281,pull_request_target, success).Squad File Leakagejob: https://github.com/bradygaster/squad/actions/runs/36499700281/job/109187362519 (job ID109187362519, success).git diff origin/dev...HEADand the staged diff were empty; the two canary commits netted to no repository change.mergedAt: null; remote and local canary branches are absent;canary-comments.jsonis absent; the original worktree branch is restored and clean. No unrelated mutation occurred.All criteria in the live
origin/dev:.github/REPO_HEALTH_RUNBOOK.mdpassed. Closing #1800.ci: add repo-health PR-head shadow harness
fix: align repo-health fixtures with git transport
fix(repo-health): decode Git-quoted leakage paths
chore(release): promote dev to main (v1.1.0) (#2241)