Uh oh!
There was an error while loading. Please reload this page.
refactor: Consolidate metrics collection and reporting workflows (Phase 1B.ii) - #1282
Conversation
ashleyshaw
commented
Jul 24, 2026
Linked Issues:
DoD Checklist Progress:
See LS-1827 for complete DoD details. |
🚫 This PR description is missing required template content. Missing required section(s): Linked issues Please update the PR body using one of the repository PR templates:
Empty placeholders, unchecked checklist boxes, and stub issue references do not count. |
⏱️ Aging and SLA annotation
Maintained by project-meta-sync workflow. |
Warning Review limit reached
Next review available in:39 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (9)
📝 WalkthroughWalkthroughAdds an expanded documentation plan, consolidates changelog and metrics workflows, gates releases on changelog validation, and introduces scenario-based Node.js tests for both automation pipelines. ChangesDocumentation planning
Changelog automation
Metrics reporting
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Scheduler
participant MetricsReporting
participant MetricsScripts
participant GitHub
Scheduler->>MetricsReporting: start scheduled or selected stage
MetricsReporting->>MetricsScripts: collect and aggregate metrics
MetricsScripts->>MetricsReporting: return artefacts and weekly summary
MetricsReporting->>GitHub: update issue and publish successful summary
Possibly related issues
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:5937f530d0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # Job 2: Sync changelog on merge to develop | ||
| sync-changelog: | ||
| name: Auto-sync merged changelog entries | ||
| if: github.event_name == 'pull_request' && github.event.action == 'closed' && github.event.pull_request.merged == true && contains(github.event.pull_request.files.*.filename, 'CHANGELOG.md') |
There was a problem hiding this comment.
For every merged pull_request event inspected in this consolidated workflow, the webhook's pull_request object does not contain a files collection, so github.event.pull_request.files.*.filename is empty and this condition prevents sync-changelog from ever running. Query the pull request files through the API or restore an event-level path filter before checking for CHANGELOG.md.
Useful? React with 👍 / 👎.
| #!/usr/bin/env node | ||
| /** | ||
| * Test suite for changelog-management.yml workflow consolidation |
There was a problem hiding this comment.
When CI runs npm test, .jest.config.cjs only discovers .test.js and .test.ts, and no package script invokes either newly added .test.cjs file, so these suites never run. Moreover, they construct local constants and fixtures without reading either workflow YAML, meaning registration alone would still not catch defects such as the broken merge condition; connect them to the test runner and assert against the actual workflows.
AGENTS.md reference: AGENTS.md:L20-L20
Useful? React with 👍 / 👎.
Metadata governance
|
There was a problem hiding this comment.
Actionable comments posted: 9
🧹 Nitpick comments (9)
.github/workflows/changelog-management.yml (3)
35-37: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winDrop persisted git credentials on read-only checkouts.
zizmor flags credential persistence (artipacked) on these
actions/checkoutsteps. Neithervalidate-changelognorpre-release-checkpushes anything, so there's no reason to keep the token in the on-disk git config for the rest of the job — setpersist-credentials: falseto shrink the exposure window. (Thesync-changelogcheckout at lines 116-120 legitimately needs the persisted token for its latergit push origin develop, so leave that one as-is.)🔒️ Suggested fix
- uses: actions/checkout@v7 with: fetch-depth: 0 + persist-credentials: falseApply the same change at both line 35-37 and 190-192.
Also applies to: 190-192
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/changelog-management.yml around lines 35 - 37, Set persist-credentials to false on the actions/checkout steps used by validate-changelog and pre-release-check, at both referenced checkout blocks. Leave the sync-changelog checkout unchanged because it requires persisted credentials for its later push.Source: Linters/SAST tools
3-9: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win
paths-ignore: "**.md"also matchesCHANGELOG.mditself.A PR whose only change is
CHANGELOG.md(a plausible, even desirable, changelog-only PR) matches**.mdand never triggers this workflow at all — sovalidate-changelog's schema checks (lines 101-105) are skipped precisely for the PRs most likely to be changelog-focused. Consider excludingCHANGELOG.mdfrom the ignore list (e.g.!CHANGELOG.md) so schema validation still runs when it's the only file touched.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/changelog-management.yml around lines 3 - 9, Update the paths-ignore configuration for the pull_request trigger so CHANGELOG.md is not excluded by the broad Markdown pattern. Preserve ignoring other Markdown-only changes while allowing changelog-only pull requests to trigger the workflow and run validate-changelog.
32-33: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueUnused job output
should_sync.
outputs.should_syncis wired tosteps.gate.outputs.run_validation, but nothing in this workflow (orrelease.yml) readsneeds.validate-changelog.outputs.should_sync. Either wire it up (e.g. gatesync-changelogon it) or remove it as dead surface.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/changelog-management.yml around lines 32 - 33, Remove the unused should_sync job output from the workflow, unless you explicitly wire needs.validate-changelog.outputs.should_sync into the sync-changelog gating logic. Keep the existing steps.gate and run_validation behavior unchanged..github/workflows/release.yml (1)
115-121: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value
validate_only: truecurrently has no effect.
changelog-management.ymldeclares avalidate_onlyinput, but no job or step in that workflow reads it —pre-release-check(the only job that runs forworkflow_call) always performs validation-only regardless of the value passed here. Passingvalidate_only: trueworks today only because that happens to match the reusable workflow's onlyworkflow_callbehaviour. If sync/commit behaviour is ever added underworkflow_call, this call site should still be checked. Either wire the input through inchangelog-management.ymlor drop it here to avoid an input that implies control it doesn't actually have.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 115 - 121, Address the unused validate_only input in the validate-changelog-release call: either remove validate_only: true from this reusable workflow invocation, or update changelog-management.yml so its workflow_call jobs or steps consume the input and preserve validation-only behavior. Ensure the caller and the reusable workflow have a real, consistent control contract.scripts/workflows/changelog/__tests__/changelog-management.test.cjs (1)
14-14: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winESLint
no-undefon Node globals (__dirname,console,process).Static analysis flags these as undefined because the ESLint config apparently doesn't apply a Node environment to this
__tests__path. Addenv: { node: true }(or an/* eslint-env node */pragma) for this glob so the lint job doesn't fail on legitimate Node globals.Also applies to: 37-41
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/workflows/changelog/__tests__/changelog-management.test.cjs` at line 14, Update the ESLint configuration for the changelog management test glob to enable the Node environment, covering __dirname, console, and process without changing the test code. Apply the setting to the relevant __tests__ path, or add an eslint-env Node pragma in changelog-management.test.cjs if configuration scope cannot be adjusted.Source: Linters/SAST tools
.github/workflows/metrics-reporting.yml (2)
44-44: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winConsider SHA-pinning third-party actions for stronger supply-chain guarantees.
All
actions/*references use floating major tags (@v7,@v4). Path instructions accept major-tag pinning but note SHA pins are stronger.As per path instructions, "prefer SHA-pinned actions over mutable tags (e.g.
actions/checkout@v4is acceptable; SHA pins are better)."Also applies to: 49-49, 75-75, 126-126, 131-131, 198-198, 210-210
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/metrics-reporting.yml at line 44, Replace the floating major-tag references for all actions/* uses in this workflow, including actions/checkout and the additionally noted action entries, with immutable commit SHA pins; retain the existing action versions by selecting SHAs corresponding to those major releases.Source: Path instructions
187-188: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winConsider extracting the inline
node -esnippets into the existing.cjsscript pattern.The rest of the pipeline (
aggregate.cjs,generate-report.cjs) lives in testable files underscripts/workflows/metrics/, but the "Output report summary" and "Read report" steps embed non-trivial JS directly inrun:blocks. This is harder to lint/test and easy to get wrong with escaping. Extracting these into small scripts would also let the new test suite actually exercise them.As per path instructions, "confirm workflows are documented, DRY, and maintainable."
Also applies to: 203-206
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/metrics-reporting.yml around lines 187 - 188, Extract the inline Node.js logic in the “Output report summary” and “Read report” workflow steps into small CommonJS scripts under scripts/workflows/metrics/, following the existing aggregate.cjs and generate-report.cjs pattern. Update both workflow steps to invoke those scripts with the required report-directory or file arguments, preserving their current summary output and missing-file behavior so the logic can be linted and tested.Source: Path instructions
scripts/workflows/metrics/__tests__/metrics-reporting.test.cjs (2)
264-268: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueComment misdescribes the workflow's actual failure-handling behaviour.
// Workflow uses continue-on-error: false behaviordoesn't match the real implementation: the "Post to discussions" step (lines 219-230 ofmetrics-reporting.yml) catches API errors andconsole.warns — it never fails the step, socontinue-on-errorisn't involved at all. Alsonowat line 191 is unused.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/workflows/metrics/__tests__/metrics-reporting.test.cjs` around lines 264 - 268, Update the “Discussion: Handles posting failures gracefully” test to reflect that the workflow catches discussion API errors and emits console.warn without failing the step; remove the inaccurate continue-on-error/fail-on-error assertion and the unused now variable in the related test setup.
63-270: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy liftThese tests assert against self-supplied fixtures rather than exercising real implementation code.
Across all four scenarios, tests either write the exact value they then read back (e.g. lines 69-86, 137-155), or assert a hardcoded truthy literal (
jobDependency,collectStart,postCondition,isFailureMode,categoryId, etc. — lines 131-135, 189-201, 212-224, 259-268). None of the 19 tests importaggregate.cjs,generate-report.cjs, or parsemetrics-reporting.yml, so they will pass unconditionally regardless of whether the actual pipeline is correct — for instance, they wouldn't catch the missing artifact download betweencollectandaggregate, or the missingref: developon the aggregate checkout, both flagged in the workflow file review.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/workflows/metrics/__tests__/metrics-reporting.test.cjs` around lines 63 - 270, Replace the self-supplied fixture and hardcoded-truth assertions across the four scenarios with tests that execute or import the real collection, aggregation, and discussion-posting implementations and parse metrics-reporting.yml for workflow configuration. Validate actual outputs, job dependencies, artifact download configuration, aggregate checkout ref, stage conditions, environment variables, and failure behavior so tests fail when the pipeline is misconfigured.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
@.github/projects/active/agent-skills-standards-comprehensive/PLAN-EXPANDED.md:
- Around line 495-505: The completion criteria and immediate-actions checklist
contain contradictory external-link verification statuses. Update the relevant
checklist entries in the plan so they consistently remain pending until
verification evidence is recorded, or reference the completed validation result
in both places; preserve the same status across the “Complete when” and
immediate-action sections.
- Line 49: Correct the workflow wording in the planning status entry and the
corresponding lines 465–469: state that planning files are committed to the
feature branch and merged into develop, unless the documented workflow
explicitly confirms direct commits to develop. Keep the surrounding plan content
unchanged.
In @.github/workflows/metrics-reporting.yml:
- Around line 40-41: The collect job’s metrics output is invalid and the
aggregate job ignores the freshly generated data. Update the collect output to
expose the actual metrics JSON using a valid step output or artifact transfer,
then modify aggregate to consume that output by referencing
needs.collect.outputs or downloading the frontmatter-metrics-json artifact
before running aggregate.cjs; preserve the existing aggregation flow for
archived metrics.
- Around line 43-46: Update the checkout steps in the collect and
post-to-discussions jobs to set persist-credentials to false, including the
checkout identified by the develop ref and the corresponding post-to-discussions
checkout. Leave the aggregate checkout unchanged because it requires persisted
credentials for its later push.
- Around line 161-167: Update the “Archive report” step to derive the weekly
archive label from the existing aggregate report-date output, using the
established REPORT_DATE value rather than calling date at archival time.
Preserve the current archive directory and copy behavior while ensuring the
filename’s week matches the report content.
- Around line 125-128: Update the aggregate job’s actions/checkout step to
explicitly check out the develop ref, matching the collect and
post-to-discussions checkout steps, so the later git push origin develop targets
the local develop branch.
- Around line 19-27: Move the workflow-wide permissions into job-level
permissions for the relevant jobs: grant aggregate contents: write so its
“Commit archival” step can push, grant collect only issues: write, grant
post-to-discussions only discussions: write, and keep contents: read or no
broader permissions for jobs that do not require writes. Remove the global
issues: write and discussions: write declarations while preserving the minimum
read permissions each job needs.
In `@scripts/workflows/changelog/__tests__/changelog-management.test.cjs`:
- Around line 66-430: Replace the self-validating fixture assertions across the
changelog scenarios with integration tests that invoke the production
implementations: extract-pr-entries.cjs, merge-entries.cjs, changelogUtils.cjs,
and validate-changelog.cjs. Use the existing fixture paths and workflow-like
environment or arguments, invoke scripts via Node subprocesses such as
execFileSync, and assert their actual outputs, generated files, exit statuses,
and warnings. Update tests including “Extracts entries from PR changelog” and
the validation, merge, release, and integration cases so regressions in real
workflow logic are exercised rather than only checking strings just written to
disk.
- Around line 231-237: Replace the hardcoded assert in “Handles empty entry
extraction gracefully” with an assertion that exercises and verifies the
workflow’s actual empty-entry behavior, using the hasEntries value and the
relevant sync/result logic. Ensure the test fails if empty entries trigger a
sync failure or commit attempt, rather than merely asserting a constant true
value.
---
Nitpick comments:
In @.github/workflows/changelog-management.yml:
- Around line 35-37: Set persist-credentials to false on the actions/checkout
steps used by validate-changelog and pre-release-check, at both referenced
checkout blocks. Leave the sync-changelog checkout unchanged because it requires
persisted credentials for its later push.
- Around line 3-9: Update the paths-ignore configuration for the pull_request
trigger so CHANGELOG.md is not excluded by the broad Markdown pattern. Preserve
ignoring other Markdown-only changes while allowing changelog-only pull requests
to trigger the workflow and run validate-changelog.
- Around line 32-33: Remove the unused should_sync job output from the workflow,
unless you explicitly wire needs.validate-changelog.outputs.should_sync into the
sync-changelog gating logic. Keep the existing steps.gate and run_validation
behavior unchanged.
In @.github/workflows/metrics-reporting.yml:
- Line 44: Replace the floating major-tag references for all actions/* uses in
this workflow, including actions/checkout and the additionally noted action
entries, with immutable commit SHA pins; retain the existing action versions by
selecting SHAs corresponding to those major releases.
- Around line 187-188: Extract the inline Node.js logic in the “Output report
summary” and “Read report” workflow steps into small CommonJS scripts under
scripts/workflows/metrics/, following the existing aggregate.cjs and
generate-report.cjs pattern. Update both workflow steps to invoke those scripts
with the required report-directory or file arguments, preserving their current
summary output and missing-file behavior so the logic can be linted and tested.
In @.github/workflows/release.yml:
- Around line 115-121: Address the unused validate_only input in the
validate-changelog-release call: either remove validate_only: true from this
reusable workflow invocation, or update changelog-management.yml so its
workflow_call jobs or steps consume the input and preserve validation-only
behavior. Ensure the caller and the reusable workflow have a real, consistent
control contract.
In `@scripts/workflows/changelog/__tests__/changelog-management.test.cjs`:
- Line 14: Update the ESLint configuration for the changelog management test
glob to enable the Node environment, covering __dirname, console, and process
without changing the test code. Apply the setting to the relevant __tests__
path, or add an eslint-env Node pragma in changelog-management.test.cjs if
configuration scope cannot be adjusted.
In `@scripts/workflows/metrics/__tests__/metrics-reporting.test.cjs`:
- Around line 264-268: Update the “Discussion: Handles posting failures
gracefully” test to reflect that the workflow catches discussion API errors and
emits console.warn without failing the step; remove the inaccurate
continue-on-error/fail-on-error assertion and the unused now variable in the
related test setup.
- Around line 63-270: Replace the self-supplied fixture and hardcoded-truth
assertions across the four scenarios with tests that execute or import the real
collection, aggregation, and discussion-posting implementations and parse
metrics-reporting.yml for workflow configuration. Validate actual outputs, job
dependencies, artifact download configuration, aggregate checkout ref, stage
conditions, environment variables, and failure behavior so tests fail when the
pipeline is misconfigured.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 6e086c3f-821d-425a-bb4c-316ab144fe67
📒 Files selected for processing (10)
.github/projects/active/agent-skills-standards-comprehensive/PLAN-EXPANDED.md.github/workflows/changelog-auto-update.yml.github/workflows/changelog-management.yml.github/workflows/changelog-validate.yml.github/workflows/metrics-reporting.yml.github/workflows/metrics-summary.yml.github/workflows/metrics.yml.github/workflows/release.ymlscripts/workflows/changelog/__tests__/changelog-management.test.cjsscripts/workflows/metrics/__tests__/metrics-reporting.test.cjs
💤 Files with no reviewable changes (4)
- .github/workflows/metrics-summary.yml
- .github/workflows/changelog-auto-update.yml
- .github/workflows/changelog-validate.yml
- .github/workflows/metrics.yml
📜 Review details
⏰ Context from checks skipped due to timeout. (3)
- GitHub Check: coderabbit-gate
- GitHub Check: Analyze (python)
- GitHub Check: Summary
⚠️ CI failures not shown inline (12)
GitHub Actions: Validate PR Template / 0_validate-pr-template.txt: refactor: Consolidate metrics collection and reporting workflows (Phase 1B.ii)
Conclusion: failure
##[group]Run actions/github-script@v7
with:
script: const { validatePullRequestBody } = require('./scripts/validation/template-helpers.cjs');
const marker = '<!-- template-enforcement -->';
const pr = context.payload.pull_request;
const author = pr.user?.login || '';
const isDependabot = author === 'dependabot[bot]' || author === 'app/dependabot';
const isImgbot = author === 'imgbot[bot]' || author === 'app/imgbot';
if (isDependabot || isImgbot) {
core.info(`Skipping PR template validation for bot author ${author}.`);
return;
}
const validation = validatePullRequestBody(pr.body || '', pr.labels || [], pr.head?.ref || '');
const comments = await github.paginate(github.rest.issues.listComments, {
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: pr.number,
per_page: 100
});
const previous = comments.find((comment) =>
comment.user?.type === 'Bot' && comment.body?.includes(marker)
);
if (validation.missing.length === 0) {
if (previous) {
await github.rest.issues.updateComment({
owner: context.repo.owner,
repo: context.repo.repo,
comment_id: previous.id,
body: `${marker}\n✅ Template check passed after update. Thanks for fixing the PR description.`
});
}
return;
}
const message = [
marker,
'🚫 This PR description is missing required template content.',
'',
`Missing required section(s): ${validation.missing.join(', ')}`,
'',
'Please update the PR body using one of the repository PR templates:',
'- https://github.com/lightspeedwp/.github/blob/develop/.github/pull_request_template.md',
'- https://github.com/lightspeedwp/.github/tree/develop/.github/PULL_REQUEST_TEMPLATE',
'',
'Empty placeholders, unchecked checklist boxes, and stub issue references do not count.'
].join('\n');
if (previous) {
await github.rest.issues.updateComment({
owner: context.repo.owner,
repo: context.repo.repo,
comment_id: previous.id,
body: message
});
} else {
await github.rest.issues....
GitHub Actions: Validate PR Template / validate-pr-template: refactor: Consolidate metrics collection and reporting workflows (Phase 1B.ii)
Conclusion: failure
##[group]Run actions/github-script@v7
with:
script: const { validatePullRequestBody } = require('./scripts/validation/template-helpers.cjs');
const marker = '<!-- template-enforcement -->';
const pr = context.payload.pull_request;
const author = pr.user?.login || '';
const isDependabot = author === 'dependabot[bot]' || author === 'app/dependabot';
const isImgbot = author === 'imgbot[bot]' || author === 'app/imgbot';
if (isDependabot || isImgbot) {
core.info(`Skipping PR template validation for bot author ${author}.`);
return;
}
const validation = validatePullRequestBody(pr.body || '', pr.labels || [], pr.head?.ref || '');
const comments = await github.paginate(github.rest.issues.listComments, {
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: pr.number,
per_page: 100
});
const previous = comments.find((comment) =>
comment.user?.type === 'Bot' && comment.body?.includes(marker)
);
if (validation.missing.length === 0) {
if (previous) {
await github.rest.issues.updateComment({
owner: context.repo.owner,
repo: context.repo.repo,
comment_id: previous.id,
body: `${marker}\n✅ Template check passed after update. Thanks for fixing the PR description.`
});
}
return;
}
const message = [
marker,
'🚫 This PR description is missing required template content.',
'',
`Missing required section(s): ${validation.missing.join(', ')}`,
'',
'Please update the PR body using one of the repository PR templates:',
'- https://github.com/lightspeedwp/.github/blob/develop/.github/pull_request_template.md',
'- https://github.com/lightspeedwp/.github/tree/develop/.github/PULL_REQUEST_TEMPLATE',
'',
'Empty placeholders, unchecked checklist boxes, and stub issue references do not count.'
].join('\n');
if (previous) {
await github.rest.issues.updateComment({
owner: context.repo.owner,
repo: context.repo.repo,
comment_id: previous.id,
body: message
});
} else {
await github.rest.issues....
GitHub Actions: Meta Agent / 1_lint-and-links.txt: refactor: Consolidate metrics collection and reporting workflows (Phase 1B.ii)
Conclusion: failure
##[group]Run /home/runner/work/_actions/lycheeverse/lychee-action/v2/entrypoint.sh
�[36;1m/home/runner/work/_actions/lycheeverse/lychee-action/v2/entrypoint.sh�[0m
shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
env:
INPUT_***REDACTED***
INPUT_ARGS: --no-progress --verbose --config lychee.toml .github/projects/active/agent-skills-standards-comprehensive/INDEX.md .github/projects/active/workflows-consolidation-2026-q3/GITHUB_ISSUE_PHASE_1A.md .github/projects/active/workflows-consolidation-2026-q3/PROJECT_INDEX.md .github/projects/active/workflows-consolidation-2026-q3/README.md CHANGELOG.md agents/design-partner-agent/AGENT.md docs/AI_REFERENCES_STANDARDS.md docs/COOKBOOKS_STANDARDS.md docs/PLUGINS_STANDARDS.md docs/PROMPTS_STANDARDS.md docs/SKILLS_STANDARDS.md
INPUT_DEBUG: false
INPUT_FAIL: true
INPUT_FAILIFEMPTY: true
INPUT_FORMAT: markdown
INPUT_JOBSUMMARY: true
INPUT_CHECKBOX: true
INPUT_OUTPUT: lychee/out.md
SUMMARY_URL: https://github.com/lightspeedwp/.github/actions/runs/30085892914#summary-89457874617
##[endgroup]
[ERROR] file:///home/runner/work/.github/.github/.github/projects/docs/AGENT_CREATION.md (at 55:3) | File not found. Check if file exists and path is correct
[ERROR] file:///home/runner/work/.github/.github/.github/projects/docs/BRANCHING_STRATEGY.md (at 56:3) | File not found. Check if file exists and path is correct
[ERROR] file:///home/runner/work/.github/.github/.github/projects/AGENTS.md (at 57:3) | File not found. Check if file exists and path is correct
[ERROR] file:///home/runner/work/.github/.github/docs/RUNNERS.md (at 163:3) | File not found. Check if file exists and path is correct
[EXCLUDED] https://keepachangelog.com/en/1.1.0/ (at 24:24) | This is due to your 'exclude' values
[EXCLUDED] https://semver.org/spec/v2.0.0.html (at 25:29) | This is due to your 'exclude' values
# Summary
| Status | Count |
|----------------|-------|
| 🔍 Total | 303 |
| 🔗 Unique ...
GitHub Actions: Meta Agent / front-matter-validate: refactor: Consolidate metrics collection and reporting workflows (Phase 1B.ii)
Conclusion: failure
##[group]Run if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
�[36;1mif [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then�[0m
�[36;1m BASE_REF="3a4210f90b688ea4100379787639ae8836d3509c"�[0m
�[36;1m HEAD_REF="5937f530d0179bcfa4432c41ffce31d7ea15cb48"�[0m
�[36;1melif [ "${GITHUB_EVENT_NAME}" = "push" ]; then�[0m
�[36;1m BASE_REF=""�[0m
�[36;1m HEAD_REF="847e4659e9271e21d9faad8fbee44a9857d147fa"�[0m
�[36;1melse�[0m
�[36;1m BASE_REF="HEAD~1"�[0m
�[36;1m HEAD_REF="847e4659e9271e21d9faad8fbee44a9857d147fa"�[0m
�[36;1mfi�[0m
�[36;1mnpm run validate:frontmatter:changed -- --base "$BASE_REF" --head "$HEAD_REF"�[0m
shell: /usr/bin/bash -e {0}
##[endgroup]
> `@lightspeedwp/github-community-health`@0.5.0 validate:frontmatter:changed
> node scripts/validation/validate-frontmatter-freshness.js --base 3a4210f90b688ea4100379787639ae8836d3509c --head 5937f530d0179bcfa4432c41ffce31d7ea15cb48
Frontmatter freshness validation failed:
- agents/ai-readiness-estimator-agent/AGENT.md: body changed but version was not updated (1.0.0).
- agents/client-website-discovery-assistant-agent/AGENT.md: body changed but version was not updated (1.0.0).
- agents/design-partner-agent/AGENT.md: body changed but last_updated was not updated (2026-07-22).
- agents/design-partner-agent/AGENT.md: body changed but version was not updated (1.0.0).
- agents/harvest-analytical-agent/AGENT.md: body changed but version was not updated (1.0.0).
- agents/linear-advisor-agent/AGENT.md: body changed but version was not updated (1.0.0).
- agents/pagespeed-agent/AGENT.md: body changed but version was not updated (1.0.0).
- agents/proposal-desk-agent/AGENT.md: body changed but last_updated was not updated (2026-07-22).
- agents/proposal-desk-agent/AGENT.md: body changed but version was not updated (1.0.0).
- agents/website-content-strategist-agent/AGENT.md: body changed but version was not updated (1.0.0).
- agents/website-scope-estimator-agent/AGENT.md: body changed but version was...
GitHub Actions: Meta Agent / 2_front-matter-validate.txt: refactor: Consolidate metrics collection and reporting workflows (Phase 1B.ii)
Conclusion: failure
##[group]Run if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
�[36;1mif [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then�[0m
�[36;1m BASE_REF="3a4210f90b688ea4100379787639ae8836d3509c"�[0m
�[36;1m HEAD_REF="5937f530d0179bcfa4432c41ffce31d7ea15cb48"�[0m
�[36;1melif [ "${GITHUB_EVENT_NAME}" = "push" ]; then�[0m
�[36;1m BASE_REF=""�[0m
�[36;1m HEAD_REF="847e4659e9271e21d9faad8fbee44a9857d147fa"�[0m
�[36;1melse�[0m
�[36;1m BASE_REF="HEAD~1"�[0m
�[36;1m HEAD_REF="847e4659e9271e21d9faad8fbee44a9857d147fa"�[0m
�[36;1mfi�[0m
�[36;1mnpm run validate:frontmatter:changed -- --base "$BASE_REF" --head "$HEAD_REF"�[0m
shell: /usr/bin/bash -e {0}
##[endgroup]
> `@lightspeedwp/github-community-health`@0.5.0 validate:frontmatter:changed
> node scripts/validation/validate-frontmatter-freshness.js --base 3a4210f90b688ea4100379787639ae8836d3509c --head 5937f530d0179bcfa4432c41ffce31d7ea15cb48
Frontmatter freshness validation failed:
- agents/ai-readiness-estimator-agent/AGENT.md: body changed but version was not updated (1.0.0).
- agents/client-website-discovery-assistant-agent/AGENT.md: body changed but version was not updated (1.0.0).
- agents/design-partner-agent/AGENT.md: body changed but last_updated was not updated (2026-07-22).
- agents/design-partner-agent/AGENT.md: body changed but version was not updated (1.0.0).
- agents/harvest-analytical-agent/AGENT.md: body changed but version was not updated (1.0.0).
- agents/linear-advisor-agent/AGENT.md: body changed but version was not updated (1.0.0).
- agents/pagespeed-agent/AGENT.md: body changed but version was not updated (1.0.0).
- agents/proposal-desk-agent/AGENT.md: body changed but last_updated was not updated (2026-07-22).
- agents/proposal-desk-agent/AGENT.md: body changed but version was not updated (1.0.0).
- agents/website-content-strategist-agent/AGENT.md: body changed but version was not updated (1.0.0).
- agents/website-scope-estimator-agent/AGENT.md: body changed but version was...
GitHub Actions: Meta Agent / lint-and-links: refactor: Consolidate metrics collection and reporting workflows (Phase 1B.ii)
Conclusion: failure
##[group]Run /home/runner/work/_actions/lycheeverse/lychee-action/v2/entrypoint.sh
�[36;1m/home/runner/work/_actions/lycheeverse/lychee-action/v2/entrypoint.sh�[0m
shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
env:
INPUT_***REDACTED***
INPUT_ARGS: --no-progress --verbose --config lychee.toml .github/projects/active/agent-skills-standards-comprehensive/INDEX.md .github/projects/active/workflows-consolidation-2026-q3/GITHUB_ISSUE_PHASE_1A.md .github/projects/active/workflows-consolidation-2026-q3/PROJECT_INDEX.md .github/projects/active/workflows-consolidation-2026-q3/README.md CHANGELOG.md agents/design-partner-agent/AGENT.md docs/AI_REFERENCES_STANDARDS.md docs/COOKBOOKS_STANDARDS.md docs/PLUGINS_STANDARDS.md docs/PROMPTS_STANDARDS.md docs/SKILLS_STANDARDS.md
INPUT_DEBUG: false
INPUT_FAIL: true
INPUT_FAILIFEMPTY: true
INPUT_FORMAT: markdown
INPUT_JOBSUMMARY: true
INPUT_CHECKBOX: true
INPUT_OUTPUT: lychee/out.md
SUMMARY_URL: https://github.com/lightspeedwp/.github/actions/runs/30085892914#summary-89457874617
##[endgroup]
[ERROR] file:///home/runner/work/.github/.github/.github/projects/docs/AGENT_CREATION.md (at 55:3) | File not found. Check if file exists and path is correct
[ERROR] file:///home/runner/work/.github/.github/.github/projects/docs/BRANCHING_STRATEGY.md (at 56:3) | File not found. Check if file exists and path is correct
[ERROR] file:///home/runner/work/.github/.github/.github/projects/AGENTS.md (at 57:3) | File not found. Check if file exists and path is correct
[ERROR] file:///home/runner/work/.github/.github/docs/RUNNERS.md (at 163:3) | File not found. Check if file exists and path is correct
[EXCLUDED] https://keepachangelog.com/en/1.1.0/ (at 24:24) | This is due to your 'exclude' values
[EXCLUDED] https://semver.org/spec/v2.0.0.html (at 25:29) | This is due to your 'exclude' values
# Summary
| Status | Count |
|----------------|-------|
| 🔍 Total | 303 |
| 🔗 Unique ...
GitHub Actions: CI • Unified Checks (Lint, Test, Validate) / All Checks Passed: refactor: Consolidate metrics collection and reporting workflows (Phase 1B.ii)
Conclusion: failure
##[group]Run test "failure" != "failure" -a "success" != "failure" -a "failure" != "failure" && echo "✅ All checks passed" || (echo "❌ One or more checks failed" && exit 1)
�[36;1mtest "failure" != "failure" -a "success" != "failure" -a "failure" != "failure" && echo "✅ All checks passed" || (echo "❌ One or more checks failed" && exit 1)�[0m
shell: /usr/bin/bash -e {0}
##[endgroup]
❌ One or more checks failed
##[error]Process completed with exit code 1.
GitHub Actions: CI • Unified Checks (Lint, Test, Validate) / 0_All Checks Passed.txt: refactor: Consolidate metrics collection and reporting workflows (Phase 1B.ii)
Conclusion: failure
##[group]Run test "failure" != "failure" -a "success" != "failure" -a "failure" != "failure" && echo "✅ All checks passed" || (echo "❌ One or more checks failed" && exit 1)
�[36;1mtest "failure" != "failure" -a "success" != "failure" -a "failure" != "failure" && echo "✅ All checks passed" || (echo "❌ One or more checks failed" && exit 1)�[0m
shell: /usr/bin/bash -e {0}
##[endgroup]
❌ One or more checks failed
##[error]Process completed with exit code 1.
GitHub Actions: CI • Unified Checks (Lint, Test, Validate) / 2_Linting.txt: refactor: Consolidate metrics collection and reporting workflows (Phase 1B.ii)
Conclusion: failure
##[group]Run npm run validate:agent-hooks
�[36;1mnpm run validate:agent-hooks�[0m
shell: /usr/bin/bash -e {0}
##[endgroup]
> `@lightspeedwp/github-community-health`@0.5.0 validate:agent-hooks
> node scripts/validation/validate-agent-hooks.cjs
🔍 Running agent/plugin validation hooks
✅ agent-spec-validator (agents/ai-readiness-estimator-agent)
✅ multi-provider-consistency-checker (agents/ai-readiness-estimator-agent)
✅ agent-security-auditor (agents/ai-readiness-estimator-agent)
✅ agent-spec-validator (agents/client-website-discovery-assistant-agent)
✅ multi-provider-consistency-checker (agents/client-website-discovery-assistant-agent)
❌ agent-security-auditor (agents/client-website-discovery-assistant-agent)
- Hardcoded credential in skills/local/directory-installed/builtins/documents/tasks/toc_workflow.md:65
- Hardcoded credential in skills/local/platform-managed/system/plugin-creator/references/installing-and-updating.md:68
- Hardcoded credential in skills/local/plugin-provided/figma/figma-code-connect/references/api.md:591
- Hardcoded credential in skills/local/plugin-provided/figma/figma-code-connect/references/api.md:597
- Hardcoded credential in skills/local/plugin-provided/figma/figma-generate-library/SKILL.md:132
✅ agent-spec-validator (agents/design-partner-agent)
✅ multi-provider-consistency-checker (agents/design-partner-agent)
❌ agent-security-auditor (agents/design-partner-agent)
- Hardcoded credential in README.md:82
✅ agent-spec-validator (agents/harvest-analytical-agent)
✅ multi-provider-consistency-checker (agents/harvest-analytical-agent)
✅ agent-security-auditor (agents/harvest-analytical-agent)
✅ agent-spec-validator (agents/linear-advisor-agent)
✅ multi-provider-consistency-checker (agents/linear-advisor-agent)
✅ agent-security-auditor (agents/linear-advisor-agent)
✅ agent-spec-validator (agents/pagespeed-agent)
✅ multi-provider-consistency-checker (agents/pagespeed-agent)
✅ agent-security-auditor...
GitHub Actions: CI • Unified Checks (Lint, Test, Validate) / Validation: refactor: Consolidate metrics collection and reporting workflows (Phase 1B.ii)
Conclusion: failure
##[group]Run npm run validate:footers -- --changed-only --base=3a4210f90b688ea4100379787639ae8836d3509c --head=5937f530d0179bcfa4432c41ffce31d7ea15cb48
�[36;1mnpm run validate:footers -- --changed-only --base=3a4210f90b688ea4100379787639ae8836d3509c --head=5937f530d0179bcfa4432c41ffce31d7ea15cb48�[0m
shell: /usr/bin/bash -e {0}
##[endgroup]
> `@lightspeedwp/github-community-health`@0.5.0 validate:footers
> node .github/scripts/validate-footers.js && node scripts/validate-footer-cleanup.js --changed-only --base=3a4210f90b688ea4100379787639ae8836d3509c --head=5937f530d0179bcfa4432c41ffce31d7ea15cb48
❌ Failed to load footer configuration: yaml.safeLoad is not a function
##[error]Process completed with exit code 1.
GitHub Actions: CI • Unified Checks (Lint, Test, Validate) / 1_Validation.txt: refactor: Consolidate metrics collection and reporting workflows (Phase 1B.ii)
Conclusion: failure
##[group]Run npm run validate:footers -- --changed-only --base=3a4210f90b688ea4100379787639ae8836d3509c --head=5937f530d0179bcfa4432c41ffce31d7ea15cb48
�[36;1mnpm run validate:footers -- --changed-only --base=3a4210f90b688ea4100379787639ae8836d3509c --head=5937f530d0179bcfa4432c41ffce31d7ea15cb48�[0m
shell: /usr/bin/bash -e {0}
##[endgroup]
> `@lightspeedwp/github-community-health`@0.5.0 validate:footers
> node .github/scripts/validate-footers.js && node scripts/validate-footer-cleanup.js --changed-only --base=3a4210f90b688ea4100379787639ae8836d3509c --head=5937f530d0179bcfa4432c41ffce31d7ea15cb48
❌ Failed to load footer configuration: yaml.safeLoad is not a function
##[error]Process completed with exit code 1.
GitHub Actions: CI • Unified Checks (Lint, Test, Validate) / Linting: refactor: Consolidate metrics collection and reporting workflows (Phase 1B.ii)
Conclusion: failure
##[group]Run npm run validate:agent-hooks
�[36;1mnpm run validate:agent-hooks�[0m
shell: /usr/bin/bash -e {0}
##[endgroup]
> `@lightspeedwp/github-community-health`@0.5.0 validate:agent-hooks
> node scripts/validation/validate-agent-hooks.cjs
🔍 Running agent/plugin validation hooks
✅ agent-spec-validator (agents/ai-readiness-estimator-agent)
✅ multi-provider-consistency-checker (agents/ai-readiness-estimator-agent)
✅ agent-security-auditor (agents/ai-readiness-estimator-agent)
✅ agent-spec-validator (agents/client-website-discovery-assistant-agent)
✅ multi-provider-consistency-checker (agents/client-website-discovery-assistant-agent)
❌ agent-security-auditor (agents/client-website-discovery-assistant-agent)
- Hardcoded credential in skills/local/directory-installed/builtins/documents/tasks/toc_workflow.md:65
- Hardcoded credential in skills/local/platform-managed/system/plugin-creator/references/installing-and-updating.md:68
- Hardcoded credential in skills/local/plugin-provided/figma/figma-code-connect/references/api.md:591
- Hardcoded credential in skills/local/plugin-provided/figma/figma-code-connect/references/api.md:597
- Hardcoded credential in skills/local/plugin-provided/figma/figma-generate-library/SKILL.md:132
✅ agent-spec-validator (agents/design-partner-agent)
✅ multi-provider-consistency-checker (agents/design-partner-agent)
❌ agent-security-auditor (agents/design-partner-agent)
- Hardcoded credential in README.md:82
✅ agent-spec-validator (agents/harvest-analytical-agent)
✅ multi-provider-consistency-checker (agents/harvest-analytical-agent)
✅ agent-security-auditor (agents/harvest-analytical-agent)
✅ agent-spec-validator (agents/linear-advisor-agent)
✅ multi-provider-consistency-checker (agents/linear-advisor-agent)
✅ agent-security-auditor (agents/linear-advisor-agent)
✅ agent-spec-validator (agents/pagespeed-agent)
✅ multi-provider-consistency-checker (agents/pagespeed-agent)
✅ agent-security-auditor...
🧰 Additional context used
📓 Path-based instructions (3)
**/.github/workflows/*.yml
⚙️ CodeRabbit configuration file
**/.github/workflows/*.yml: Review GitHub Actions workflows for this governance repo:
- Security: check for least-privilege permissions (use
permissions:at job level, default to read-only).- Secret handling: ensure secrets are passed via env vars, not interpolated directly into run: steps to prevent injection.
- Action pinning: prefer SHA-pinned actions over mutable tags (e.g.
actions/checkout@v4is acceptable; SHA pins are better).- No
pull_request_targetwith untrusted code execution unless explicitly justified.- Avoid storing sensitive outputs as unmasked step outputs.
- Check for reusable workflow patterns and matrix strategies where appropriate.
- Validate
on:triggers: ensure branch/path filters are present to avoid unnecessary runs.- Confirm workflows are documented, DRY, and maintainable.
- Ensure agent-triggered workflows use
workflow_dispatchwith defined inputs.
Files:
.github/workflows/release.yml.github/workflows/metrics-reporting.yml.github/workflows/changelog-management.yml
**/*
📄 CodeRabbit inference engine (CLAUDE.md)
**/*: Do not place reusable AI assets under.github/; place them in the matching top-level source folder such asai/,agents/,cookbook/,hooks/,instructions/,plugins/,skills/, orworkflows/.
Use UK English spelling throughout documentation and repository content.
Do not add WordPress plugin- or theme-specific project code to this organisation.githubrepository.
Do not move existing agents, instructions, or schemas without a migration issue recording the source path, target path, and validation plan.
Do not commitnode_modules/,build/, or other generated artefacts.
Use branch names in lowercase kebab-case with the format{type}/{scope}-{short-title}and an approved type prefix; never use theclaude/prefix.
Before every push, verify the branch, ensure it is notmainordevelopoutside an authorised release cycle, runnpm run validate:branch-name -- --branch $(git branch --show-current), and push withgit push -u origin <branch-name>.
PRs should targetdevelop; only explicitly authorised release cycles may targetmain, and onlyrelease/*orhotfix/*branches may merge tomain.
After a successful squash merge, delete the remote and local branch; never reuse a branch name that has already been merged.
Files:
scripts/workflows/metrics/__tests__/metrics-reporting.test.cjsscripts/workflows/changelog/__tests__/changelog-management.test.cjs
.github/projects/active/**
📄 CodeRabbit inference engine (CLAUDE.md)
Store active project artefacts under
.github/projects/active/{slug}/.
Files:
.github/projects/active/agent-skills-standards-comprehensive/PLAN-EXPANDED.md
🪛 actionlint (1.7.12)
.github/workflows/metrics-reporting.yml
[error] 41-41: property "artifact_id" is not defined in object type {artifact-digest: string; artifact-id: string; artifact-url: string}
(expression)
🪛 ESLint
scripts/workflows/metrics/__tests__/metrics-reporting.test.cjs
[error] 15-15: '__dirname' is not defined.
(no-undef)
[error] 42-42: 'console' is not defined.
(no-undef)
[error] 45-45: 'console' is not defined.
(no-undef)
[error] 46-46: 'console' is not defined.
(no-undef)
[error] 61-61: 'console' is not defined.
(no-undef)
[error] 64-64: 'console' is not defined.
(no-undef)
[error] 65-65: 'console' is not defined.
(no-undef)
[error] 126-126: 'console' is not defined.
(no-undef)
[error] 127-127: 'console' is not defined.
(no-undef)
[error] 184-184: 'console' is not defined.
(no-undef)
[error] 185-185: 'console' is not defined.
(no-undef)
[error] 240-240: 'console' is not defined.
(no-undef)
[error] 241-241: 'console' is not defined.
(no-undef)
[error] 273-273: 'console' is not defined.
(no-undef)
[error] 274-274: 'console' is not defined.
(no-undef)
[error] 275-275: 'console' is not defined.
(no-undef)
[error] 278-278: 'process' is not defined.
(no-undef)
scripts/workflows/changelog/__tests__/changelog-management.test.cjs
[error] 14-14: '__dirname' is not defined.
(no-undef)
[error] 37-37: 'console' is not defined.
(no-undef)
[error] 40-40: 'console' is not defined.
(no-undef)
[error] 41-41: 'console' is not defined.
(no-undef)
[error] 64-64: 'console' is not defined.
(no-undef)
[error] 67-67: 'console' is not defined.
(no-undef)
[error] 68-68: 'console' is not defined.
(no-undef)
[error] 175-175: 'console' is not defined.
(no-undef)
[error] 176-176: 'console' is not defined.
(no-undef)
[error] 269-269: 'console' is not defined.
(no-undef)
[error] 270-270: 'console' is not defined.
(no-undef)
[error] 371-371: 'console' is not defined.
(no-undef)
[error] 372-372: 'console' is not defined.
(no-undef)
[error] 435-435: 'console' is not defined.
(no-undef)
[error] 436-436: 'console' is not defined.
(no-undef)
[error] 437-437: 'console' is not defined.
(no-undef)
[error] 440-440: 'process' is not defined.
(no-undef)
🪛 LanguageTool
.github/projects/active/agent-skills-standards-comprehensive/PLAN-EXPANDED.md
[uncategorized] ~14-~14: The official name of this software platform is spelled with a capital “H”.
Context: ...and AI models/runners in the LightSpeed .github repository. Branch: `docs/agent-s...
(GITHUB)
[misspelling] ~79-~79: This word is normally spelled as one.
Context: ...ywright-agent, etc.) - Best practices & anti-patterns Mermaid Diagrams (Target: 3+): - ...
(EN_COMPOUNDS_ANTI_PATTERNS)
[uncategorized] ~154-~154: The official name of this software platform is spelled with a capital “H”.
Context: ...les - Validation - Real examples from .github/instructions/ and instructions/ - Be...
(GITHUB)
[grammar] ~314-~314: It appears that hyphens are missing.
Context: ...on & cleanup) - Before-run/after-run (pre/post execution) - On-error (error handling) - On-s...
(PRE_AND_POST_NN)
[misspelling] ~326-~326: This word is normally spelled as one.
Context: ...lidation, template-enforcement, etc.) - Anti-patterns (what NOT to do) **Mermaid Diagrams (T...
(EN_COMPOUNDS_ANTI_PATTERNS)
[typographical] ~401-~401: If specifying a range, consider using an en dash instead of a hyphen.
Context: ...aid Diagram Strategy Total Target: 18-27 diagrams (2-3 per document) **Diagram ...
(HYPHEN_TO_EN)
[uncategorized] ~457-~457: Do not mix variants of the same word (‘organisation’ and ‘organization’) within a single text.
Context: ... terminology - ✅ UK English throughout (organisation, optimise, colour, behaviour) - ✅ Markd...
(EN_WORD_COHERENCY)
[style] ~457-~457: Would you like to use the Oxford spelling “optimize”? The spelling ‘optimise’ is also correct.
Context: ... ✅ UK English throughout (organisation, optimise, colour, behaviour) - ✅ Markdown lintin...
(OXFORD_SPELLING_Z_NOT_S)
🪛 zizmor (1.26.1)
.github/workflows/metrics-reporting.yml
[warning] 43-46: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 125-128: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 197-201: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 22-22: overly broad permissions (excessive-permissions): issues: write is overly broad at the workflow level
(excessive-permissions)
[warning] 23-23: overly broad permissions (excessive-permissions): discussions: write is overly broad at the workflow level
(excessive-permissions)
[info] 215-215: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
.github/workflows/changelog-management.yml
[warning] 35-37: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 116-120: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 190-192: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🔇 Additional comments (5)
.github/workflows/changelog-management.yml (3)
39-95: LGTM!
96-105: LGTM!Also applies to: 141-172, 184-210
108-111: 🗄️ Data Integrity & IntegrationNo change needed — the PR-file guard has been replaced.
sync-changelognow relies ongithub.rest.pulls.listFilesfor the changed-file check, so the invalidgithub.event.pull_request.files.*.filenameexpression is no longer present.> Likely an incorrect or invalid review comment..github/workflows/release.yml (1)
122-123: LGTM! Correctly threadsvalidate-changelog-releaseinto the release gate alongsidelintandtest..github/projects/active/agent-skills-standards-comprehensive/PLAN-EXPANDED.md (1)
1-7: 🗄️ Data Integrity & IntegrationAlign the active project frontmatter with the documented
titlecontract.This plan’s frontmatter uses
name, but the QA checklist and frontmatter standard requiretitle. Renamenametotitle, or update the checklist/schema convention consistently.
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 9
🧹 Nitpick comments (9)
.github/workflows/changelog-management.yml (3)
35-37: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winDrop persisted git credentials on read-only checkouts.
zizmor flags credential persistence (artipacked) on these
actions/checkoutsteps. Neithervalidate-changelognorpre-release-checkpushes anything, so there's no reason to keep the token in the on-disk git config for the rest of the job — setpersist-credentials: falseto shrink the exposure window. (Thesync-changelogcheckout at lines 116-120 legitimately needs the persisted token for its latergit push origin develop, so leave that one as-is.)🔒️ Suggested fix
- uses: actions/checkout@v7 with: fetch-depth: 0 + persist-credentials: falseApply the same change at both line 35-37 and 190-192.
Also applies to: 190-192
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/changelog-management.yml around lines 35 - 37, Set persist-credentials to false on the actions/checkout steps used by validate-changelog and pre-release-check, at both referenced checkout blocks. Leave the sync-changelog checkout unchanged because it requires persisted credentials for its later push.Source: Linters/SAST tools
3-9: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win
paths-ignore: "**.md"also matchesCHANGELOG.mditself.A PR whose only change is
CHANGELOG.md(a plausible, even desirable, changelog-only PR) matches**.mdand never triggers this workflow at all — sovalidate-changelog's schema checks (lines 101-105) are skipped precisely for the PRs most likely to be changelog-focused. Consider excludingCHANGELOG.mdfrom the ignore list (e.g.!CHANGELOG.md) so schema validation still runs when it's the only file touched.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/changelog-management.yml around lines 3 - 9, Update the paths-ignore configuration for the pull_request trigger so CHANGELOG.md is not excluded by the broad Markdown pattern. Preserve ignoring other Markdown-only changes while allowing changelog-only pull requests to trigger the workflow and run validate-changelog.
32-33: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueUnused job output
should_sync.
outputs.should_syncis wired tosteps.gate.outputs.run_validation, but nothing in this workflow (orrelease.yml) readsneeds.validate-changelog.outputs.should_sync. Either wire it up (e.g. gatesync-changelogon it) or remove it as dead surface.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/changelog-management.yml around lines 32 - 33, Remove the unused should_sync job output from the workflow, unless you explicitly wire needs.validate-changelog.outputs.should_sync into the sync-changelog gating logic. Keep the existing steps.gate and run_validation behavior unchanged..github/workflows/release.yml (1)
115-121: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value
validate_only: truecurrently has no effect.
changelog-management.ymldeclares avalidate_onlyinput, but no job or step in that workflow reads it —pre-release-check(the only job that runs forworkflow_call) always performs validation-only regardless of the value passed here. Passingvalidate_only: trueworks today only because that happens to match the reusable workflow's onlyworkflow_callbehaviour. If sync/commit behaviour is ever added underworkflow_call, this call site should still be checked. Either wire the input through inchangelog-management.ymlor drop it here to avoid an input that implies control it doesn't actually have.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 115 - 121, Address the unused validate_only input in the validate-changelog-release call: either remove validate_only: true from this reusable workflow invocation, or update changelog-management.yml so its workflow_call jobs or steps consume the input and preserve validation-only behavior. Ensure the caller and the reusable workflow have a real, consistent control contract.scripts/workflows/changelog/__tests__/changelog-management.test.cjs (1)
14-14: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winESLint
no-undefon Node globals (__dirname,console,process).Static analysis flags these as undefined because the ESLint config apparently doesn't apply a Node environment to this
__tests__path. Addenv: { node: true }(or an/* eslint-env node */pragma) for this glob so the lint job doesn't fail on legitimate Node globals.Also applies to: 37-41
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/workflows/changelog/__tests__/changelog-management.test.cjs` at line 14, Update the ESLint configuration for the changelog management test glob to enable the Node environment, covering __dirname, console, and process without changing the test code. Apply the setting to the relevant __tests__ path, or add an eslint-env Node pragma in changelog-management.test.cjs if configuration scope cannot be adjusted.Source: Linters/SAST tools
.github/workflows/metrics-reporting.yml (2)
44-44: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winConsider SHA-pinning third-party actions for stronger supply-chain guarantees.
All
actions/*references use floating major tags (@v7,@v4). Path instructions accept major-tag pinning but note SHA pins are stronger.As per path instructions, "prefer SHA-pinned actions over mutable tags (e.g.
actions/checkout@v4is acceptable; SHA pins are better)."Also applies to: 49-49, 75-75, 126-126, 131-131, 198-198, 210-210
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/metrics-reporting.yml at line 44, Replace the floating major-tag references for all actions/* uses in this workflow, including actions/checkout and the additionally noted action entries, with immutable commit SHA pins; retain the existing action versions by selecting SHAs corresponding to those major releases.Source: Path instructions
187-188: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winConsider extracting the inline
node -esnippets into the existing.cjsscript pattern.The rest of the pipeline (
aggregate.cjs,generate-report.cjs) lives in testable files underscripts/workflows/metrics/, but the "Output report summary" and "Read report" steps embed non-trivial JS directly inrun:blocks. This is harder to lint/test and easy to get wrong with escaping. Extracting these into small scripts would also let the new test suite actually exercise them.As per path instructions, "confirm workflows are documented, DRY, and maintainable."
Also applies to: 203-206
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/metrics-reporting.yml around lines 187 - 188, Extract the inline Node.js logic in the “Output report summary” and “Read report” workflow steps into small CommonJS scripts under scripts/workflows/metrics/, following the existing aggregate.cjs and generate-report.cjs pattern. Update both workflow steps to invoke those scripts with the required report-directory or file arguments, preserving their current summary output and missing-file behavior so the logic can be linted and tested.Source: Path instructions
scripts/workflows/metrics/__tests__/metrics-reporting.test.cjs (2)
264-268: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueComment misdescribes the workflow's actual failure-handling behaviour.
// Workflow uses continue-on-error: false behaviordoesn't match the real implementation: the "Post to discussions" step (lines 219-230 ofmetrics-reporting.yml) catches API errors andconsole.warns — it never fails the step, socontinue-on-errorisn't involved at all. Alsonowat line 191 is unused.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/workflows/metrics/__tests__/metrics-reporting.test.cjs` around lines 264 - 268, Update the “Discussion: Handles posting failures gracefully” test to reflect that the workflow catches discussion API errors and emits console.warn without failing the step; remove the inaccurate continue-on-error/fail-on-error assertion and the unused now variable in the related test setup.
63-270: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy liftThese tests assert against self-supplied fixtures rather than exercising real implementation code.
Across all four scenarios, tests either write the exact value they then read back (e.g. lines 69-86, 137-155), or assert a hardcoded truthy literal (
jobDependency,collectStart,postCondition,isFailureMode,categoryId, etc. — lines 131-135, 189-201, 212-224, 259-268). None of the 19 tests importaggregate.cjs,generate-report.cjs, or parsemetrics-reporting.yml, so they will pass unconditionally regardless of whether the actual pipeline is correct — for instance, they wouldn't catch the missing artifact download betweencollectandaggregate, or the missingref: developon the aggregate checkout, both flagged in the workflow file review.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/workflows/metrics/__tests__/metrics-reporting.test.cjs` around lines 63 - 270, Replace the self-supplied fixture and hardcoded-truth assertions across the four scenarios with tests that execute or import the real collection, aggregation, and discussion-posting implementations and parse metrics-reporting.yml for workflow configuration. Validate actual outputs, job dependencies, artifact download configuration, aggregate checkout ref, stage conditions, environment variables, and failure behavior so tests fail when the pipeline is misconfigured.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
@.github/projects/active/agent-skills-standards-comprehensive/PLAN-EXPANDED.md:
- Around line 495-505: The completion criteria and immediate-actions checklist
contain contradictory external-link verification statuses. Update the relevant
checklist entries in the plan so they consistently remain pending until
verification evidence is recorded, or reference the completed validation result
in both places; preserve the same status across the “Complete when” and
immediate-action sections.
- Line 49: Correct the workflow wording in the planning status entry and the
corresponding lines 465–469: state that planning files are committed to the
feature branch and merged into develop, unless the documented workflow
explicitly confirms direct commits to develop. Keep the surrounding plan content
unchanged.
In @.github/workflows/metrics-reporting.yml:
- Around line 40-41: The collect job’s metrics output is invalid and the
aggregate job ignores the freshly generated data. Update the collect output to
expose the actual metrics JSON using a valid step output or artifact transfer,
then modify aggregate to consume that output by referencing
needs.collect.outputs or downloading the frontmatter-metrics-json artifact
before running aggregate.cjs; preserve the existing aggregation flow for
archived metrics.
- Around line 43-46: Update the checkout steps in the collect and
post-to-discussions jobs to set persist-credentials to false, including the
checkout identified by the develop ref and the corresponding post-to-discussions
checkout. Leave the aggregate checkout unchanged because it requires persisted
credentials for its later push.
- Around line 161-167: Update the “Archive report” step to derive the weekly
archive label from the existing aggregate report-date output, using the
established REPORT_DATE value rather than calling date at archival time.
Preserve the current archive directory and copy behavior while ensuring the
filename’s week matches the report content.
- Around line 125-128: Update the aggregate job’s actions/checkout step to
explicitly check out the develop ref, matching the collect and
post-to-discussions checkout steps, so the later git push origin develop targets
the local develop branch.
- Around line 19-27: Move the workflow-wide permissions into job-level
permissions for the relevant jobs: grant aggregate contents: write so its
“Commit archival” step can push, grant collect only issues: write, grant
post-to-discussions only discussions: write, and keep contents: read or no
broader permissions for jobs that do not require writes. Remove the global
issues: write and discussions: write declarations while preserving the minimum
read permissions each job needs.
In `@scripts/workflows/changelog/__tests__/changelog-management.test.cjs`:
- Around line 66-430: Replace the self-validating fixture assertions across the
changelog scenarios with integration tests that invoke the production
implementations: extract-pr-entries.cjs, merge-entries.cjs, changelogUtils.cjs,
and validate-changelog.cjs. Use the existing fixture paths and workflow-like
environment or arguments, invoke scripts via Node subprocesses such as
execFileSync, and assert their actual outputs, generated files, exit statuses,
and warnings. Update tests including “Extracts entries from PR changelog” and
the validation, merge, release, and integration cases so regressions in real
workflow logic are exercised rather than only checking strings just written to
disk.
- Around line 231-237: Replace the hardcoded assert in “Handles empty entry
extraction gracefully” with an assertion that exercises and verifies the
workflow’s actual empty-entry behavior, using the hasEntries value and the
relevant sync/result logic. Ensure the test fails if empty entries trigger a
sync failure or commit attempt, rather than merely asserting a constant true
value.
---
Nitpick comments:
In @.github/workflows/changelog-management.yml:
- Around line 35-37: Set persist-credentials to false on the actions/checkout
steps used by validate-changelog and pre-release-check, at both referenced
checkout blocks. Leave the sync-changelog checkout unchanged because it requires
persisted credentials for its later push.
- Around line 3-9: Update the paths-ignore configuration for the pull_request
trigger so CHANGELOG.md is not excluded by the broad Markdown pattern. Preserve
ignoring other Markdown-only changes while allowing changelog-only pull requests
to trigger the workflow and run validate-changelog.
- Around line 32-33: Remove the unused should_sync job output from the workflow,
unless you explicitly wire needs.validate-changelog.outputs.should_sync into the
sync-changelog gating logic. Keep the existing steps.gate and run_validation
behavior unchanged.
In @.github/workflows/metrics-reporting.yml:
- Line 44: Replace the floating major-tag references for all actions/* uses in
this workflow, including actions/checkout and the additionally noted action
entries, with immutable commit SHA pins; retain the existing action versions by
selecting SHAs corresponding to those major releases.
- Around line 187-188: Extract the inline Node.js logic in the “Output report
summary” and “Read report” workflow steps into small CommonJS scripts under
scripts/workflows/metrics/, following the existing aggregate.cjs and
generate-report.cjs pattern. Update both workflow steps to invoke those scripts
with the required report-directory or file arguments, preserving their current
summary output and missing-file behavior so the logic can be linted and tested.
In @.github/workflows/release.yml:
- Around line 115-121: Address the unused validate_only input in the
validate-changelog-release call: either remove validate_only: true from this
reusable workflow invocation, or update changelog-management.yml so its
workflow_call jobs or steps consume the input and preserve validation-only
behavior. Ensure the caller and the reusable workflow have a real, consistent
control contract.
In `@scripts/workflows/changelog/__tests__/changelog-management.test.cjs`:
- Line 14: Update the ESLint configuration for the changelog management test
glob to enable the Node environment, covering __dirname, console, and process
without changing the test code. Apply the setting to the relevant __tests__
path, or add an eslint-env Node pragma in changelog-management.test.cjs if
configuration scope cannot be adjusted.
In `@scripts/workflows/metrics/__tests__/metrics-reporting.test.cjs`:
- Around line 264-268: Update the “Discussion: Handles posting failures
gracefully” test to reflect that the workflow catches discussion API errors and
emits console.warn without failing the step; remove the inaccurate
continue-on-error/fail-on-error assertion and the unused now variable in the
related test setup.
- Around line 63-270: Replace the self-supplied fixture and hardcoded-truth
assertions across the four scenarios with tests that execute or import the real
collection, aggregation, and discussion-posting implementations and parse
metrics-reporting.yml for workflow configuration. Validate actual outputs, job
dependencies, artifact download configuration, aggregate checkout ref, stage
conditions, environment variables, and failure behavior so tests fail when the
pipeline is misconfigured.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 6e086c3f-821d-425a-bb4c-316ab144fe67
📒 Files selected for processing (10)
.github/projects/active/agent-skills-standards-comprehensive/PLAN-EXPANDED.md.github/workflows/changelog-auto-update.yml.github/workflows/changelog-management.yml.github/workflows/changelog-validate.yml.github/workflows/metrics-reporting.yml.github/workflows/metrics-summary.yml.github/workflows/metrics.yml.github/workflows/release.ymlscripts/workflows/changelog/__tests__/changelog-management.test.cjsscripts/workflows/metrics/__tests__/metrics-reporting.test.cjs
💤 Files with no reviewable changes (4)
- .github/workflows/metrics-summary.yml
- .github/workflows/changelog-auto-update.yml
- .github/workflows/changelog-validate.yml
- .github/workflows/metrics.yml
📜 Review details
🔇 Additional comments (5)
.github/workflows/changelog-management.yml (3)
39-95: LGTM!
96-105: LGTM!Also applies to: 141-172, 184-210
108-111: 🗄️ Data Integrity & IntegrationNo change needed — the PR-file guard has been replaced.
sync-changelognow relies ongithub.rest.pulls.listFilesfor the changed-file check, so the invalidgithub.event.pull_request.files.*.filenameexpression is no longer present.> Likely an incorrect or invalid review comment..github/workflows/release.yml (1)
122-123: LGTM! Correctly threadsvalidate-changelog-releaseinto the release gate alongsidelintandtest..github/projects/active/agent-skills-standards-comprehensive/PLAN-EXPANDED.md (1)
1-7: 🗄️ Data Integrity & IntegrationAlign the active project frontmatter with the documented
titlecontract.This plan’s frontmatter uses
name, but the QA checklist and frontmatter standard requiretitle. Renamenametotitle, or update the checklist/schema convention consistently.
🛑 Comments failed to post (9)
.github/projects/active/agent-skills-standards-comprehensive/PLAN-EXPANDED.md (2)
49-49: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bashset -euo pipefail echo"Repository files matching PLAN-EXPANDED and project structure:" git ls-files '.github/projects/active/**'| head -200 echoecho"Target file existence and relevant wording locations:"if [ -f".github/projects/active/agent-skills-standards-comprehensive/PLAN-EXPANDED.md" ];then nl -ba ".github/projects/active/agent-skills-standards-comprehensive/PLAN-EXPANDED.md"| sed -n '40,55p'echo nl -ba ".github/projects/active/agent-skills-standards-comprehensive/PLAN-EXPANDED.md"| sed -n '455,475p'elseecho"Target file not found"fiechoecho"Search for active project policy/repo guidance in tracked files:" rg -n --hidden --glob '!node_modules' --glob '!dist' --glob '!build'"coding guidelines|active project|non-\\`develop\\` branch|feature branch|PRs|targeting \\\`develop\\\`|develop branch|committed to develop" .github .| head -200Repository: lightspeedwp/.github
Length of output: 13506
🏁 Script executed:
#!/bin/bashset -euo pipefail echo"Target snippets using sed:"if [ -f".github/projects/active/agent-skills-standards-comprehensive/PLAN-EXPANDED.md" ];then sed -n '44,54p' .github/projects/active/agent-skills-standards-comprehensive/PLAN-EXPANDED.md echo"--- 465-469 ---" sed -n '460,474p' .github/projects/active/agent-skills-standards-comprehensive/PLAN-EXPANDED.md elseecho"Target file not found"fiechoecho"Search for relevant branch/PR workflow wording:" rg -n --hidden --glob '!node_modules' --glob '!dist' --glob '!build'"non-[\` ]develop[\` ]|feature branch|\`*develop\`*|PRs should target|coding guidelines|work on a|target develop|committed to develop" .github | head -250Repository: lightspeedwp/.github
Length of output: 40745
Correct the
developbranch history wording.The plan says the planning files were “committed to develop”, but the repo workflow is to work on a feature branch and open PRs against
develop. If these were direct commits, update the workflow description; otherwise say “committed to the feature branch and merged into develop”. Applies too to lines 465–469.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/projects/active/agent-skills-standards-comprehensive/PLAN-EXPANDED.md at line 49, Correct the workflow wording in the planning status entry and the corresponding lines 465–469: state that planning files are committed to the feature branch and merged into develop, unless the documented workflow explicitly confirms direct commits to develop. Keep the surrounding plan content unchanged.Source: Coding guidelines
495-505: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Resolve the contradictory external-link status.
Line 500 marks all external links as verified, but Line 521 still lists that verification as a pending immediate action. Keep the item pending until evidence is recorded, or link the completed validation result so the success definition remains trustworthy.
Also applies to: 513-521
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/projects/active/agent-skills-standards-comprehensive/PLAN-EXPANDED.md around lines 495 - 505, The completion criteria and immediate-actions checklist contain contradictory external-link verification statuses. Update the relevant checklist entries in the plan so they consistently remain pending until verification evidence is recorded, or reference the completed validation result in both places; preserve the same status across the “Complete when” and immediate-action sections..github/workflows/metrics-reporting.yml (5)
19-27: 🗄️ Data Integrity & Integration | 🔴 Critical | ⚡ Quick win
Permissions are simultaneously too broad and too narrow — the archival push will silently fail.
contents: writeis never granted anywhere in this workflow, yet theaggregatejob's "Commit archival" step runsgit push origin develop(line 182) using the defaultGITHUB_TOKEN, which is scoped by this block tocontents: read. Because that step hascontinue-on-error: true, the push failure will be swallowed — the weekly summary archival this PR advertises will quietly never land ondevelop. Meanwhileissues: writeanddiscussions: writeare granted workflow-wide even though onlycollectneeds the former and onlypost-to-discussionsneeds the latter — flagged by zizmor as excessive-permissions.Move permissions to job level with the minimum each job needs.
As per path instructions for
**/.github/workflows/*.yml, "check for least-privilege permissions (usepermissions:at job level, default to read-only)."🔐 Proposed job-scoped permissions
-permissions:- contents: read- actions: read- issues: write- discussions: write+permissions:+ contents: read jobs: collect: name: Collect frontmatter metrics + permissions:+ contents: read+ issues: write ... aggregate: name: Aggregate metrics & generate report + permissions:+ contents: write ... post-to-discussions: name: Post report to discussions + permissions:+ contents: read+ discussions: write📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.permissions: contents: read env: METRICS_DIR: .github/metrics REPORTS_DIR: .github/reports/metrics jobs: collect: name: Collect frontmatter metrics permissions: contents: read issues: write ... aggregate: name: Aggregate metrics & generate report permissions: contents: write ... post-to-discussions: name: Post report to discussions permissions: contents: read discussions: write🧰 Tools
🪛 zizmor (1.26.1)
[error] 22-22: overly broad permissions (excessive-permissions): issues: write is overly broad at the workflow level
(excessive-permissions)
[warning] 23-23: overly broad permissions (excessive-permissions): discussions: write is overly broad at the workflow level
(excessive-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/metrics-reporting.yml around lines 19 - 27, Move the workflow-wide permissions into job-level permissions for the relevant jobs: grant aggregate contents: write so its “Commit archival” step can push, grant collect only issues: write, grant post-to-discussions only discussions: write, and keep contents: read or no broader permissions for jobs that do not require writes. Remove the global issues: write and discussions: write declarations while preserving the minimum read permissions each job needs.Sources: Path instructions, Linters/SAST tools
40-41: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
collectjob's output is wired to the wrong data, andaggregatenever consumes anything fromcollect.
steps.upload.outputs.artifact_idat line 41 isn't a valid property (actionlint: valid keys areartifact-id,artifact-url,artifact-digest), and even fixed, an artifact ID is not "metrics JSON". More importantly,aggregate(lines 109-144) never referencesneeds.collect.outputs.*nor downloads thefrontmatter-metrics-jsonartifact — it just checks out the repo and runsaggregate.cjsagainst whatever is already committed underMETRICS_DIR. So this run's freshly collected metrics never actually reach the aggregation stage; only previously archived data does.Also applies to: 109-144
🧰 Tools
🪛 actionlint (1.7.12)
[error] 41-41: property "artifact_id" is not defined in object type {artifact-digest: string; artifact-id: string; artifact-url: string}
(expression)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/metrics-reporting.yml around lines 40 - 41, The collect job’s metrics output is invalid and the aggregate job ignores the freshly generated data. Update the collect output to expose the actual metrics JSON using a valid step output or artifact transfer, then modify aggregate to consume that output by referencing needs.collect.outputs or downloading the frontmatter-metrics-json artifact before running aggregate.cjs; preserve the existing aggregation flow for archived metrics.Source: Linters/SAST tools
43-46: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Set
persist-credentials: falseon checkouts that don't need to push.Neither the
collectnorpost-to-discussionsjob pushes to the repo, yet both checkouts leave the default credential persistence enabled — flagged by zizmor (artipacked). Sincecollectrunsnpm ci/npm iand arbitrary install scripts before this, persisted git credentials are unnecessarily exposed to that supply chain. (Theaggregatecheckout at lines 125-128 legitimately needs persisted credentials for its later push, so leave that one as-is.)🔒 Proposed fix
- name: Checkout (develop) uses: actions/checkout@v7 with: ref: develop + persist-credentials: falseApply the same to the
post-to-discussionscheckout (lines 197-201).Also applies to: 197-201
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 43-46: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/metrics-reporting.yml around lines 43 - 46, Update the checkout steps in the collect and post-to-discussions jobs to set persist-credentials to false, including the checkout identified by the develop ref and the corresponding post-to-discussions checkout. Leave the aggregate checkout unchanged because it requires persisted credentials for its later push.Source: Linters/SAST tools
125-128: 🗄️ Data Integrity & Integration | 🔴 Critical | ⚡ Quick win
Missing
ref: developon theaggregatecheckout will break the latergit push origin develop.
collect(line 46) andpost-to-discussions(line 200) both explicitly checkoutref: develop, but this checkout omitsref:, so it checks out whichever ref triggered the run. If that differs fromdevelop(e.g. the default branch), there's no localdevelopref forgit push origin develop(line 182) to push, and the push fails silently thanks tocontinue-on-error: true.🌿 Proposed fix
- name: Checkout repository uses: actions/checkout@v7 with: + ref: develop fetch-depth: 0📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.- name: Checkout repository uses: actions/checkout@v7 with: ref: develop fetch-depth: 0🧰 Tools
🪛 zizmor (1.26.1)
[warning] 125-128: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/metrics-reporting.yml around lines 125 - 128, Update the aggregate job’s actions/checkout step to explicitly check out the develop ref, matching the collect and post-to-discussions checkout steps, so the later git push origin develop targets the local develop branch.161-167: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Archive week label is computed independently of
report_date.
WEEK=$(date +%Y-W%V)recomputes the week at archival time rather than deriving it fromsteps.aggregate.outputs.report_date(already available asenv.REPORT_DATE-equivalent output). If this step runs close to a week boundary, or ifreport_datediffers from the runner's current date, the archived filename can disagree with the date embedded in the report content itself.🗓️ Proposed fix
- name: Archive report run: | set -euo pipefail - WEEK=$(date +%Y-W%V)+ WEEK=$(date -d "${{ steps.aggregate.outputs.report_date }}" +%Y-W%V 2>/dev/null || date +%Y-W%V) ARCHIVE_DIR="${{ env.REPORTS_DIR }}/weekly"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.- name: Archive report run: | set -euo pipefail WEEK=$(date -d "${{ steps.aggregate.outputs.report_date }}" +%Y-W%V 2>/dev/null || date +%Y-W%V) ARCHIVE_DIR="${{ env.REPORTS_DIR }}/weekly" mkdir -p "$ARCHIVE_DIR" cp "${{ env.REPORTS_DIR }}/weekly-summary-latest.md" "$ARCHIVE_DIR/weekly-summary-${WEEK}.md"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/metrics-reporting.yml around lines 161 - 167, Update the “Archive report” step to derive the weekly archive label from the existing aggregate report-date output, using the established REPORT_DATE value rather than calling date at archival time. Preserve the current archive directory and copy behavior while ensuring the filename’s week matches the report content.scripts/workflows/changelog/__tests__/changelog-management.test.cjs (2)
66-430: 📐 Maintainability & Code Quality | 🟠 Major | 🏗️ Heavy lift
Tests validate fixtures against themselves, not the real workflow scripts.
Across all three scenarios and the integration tests, the pattern is: write a string literal to a temp file, read it back, then assert the literal is present. None of these tests actually
require()orexecSyncthe production scripts they claim to cover (extract-pr-entries.cjs,merge-entries.cjs,scripts/agents/includes/changelogUtils.cjs,scripts/validation/validate-changelog.cjs). For example,Extracts entries from PR changelog(lines 180-196) just checks that a string it wrote itself still contains that string.A real regression in the extraction/merge/validation logic would slip through this suite untouched. Consider invoking the actual scripts (e.g.
execFileSync('node', ['scripts/workflows/changelog/extract-pr-entries.cjs'], { env: {...} })) against the fixture files and asserting on their real output, similar to how the scripts themselves are invoked from the workflow.🧰 Tools
🪛 ESLint
[error] 67-67: 'console' is not defined.
(no-undef)
[error] 68-68: 'console' is not defined.
(no-undef)
[error] 175-175: 'console' is not defined.
(no-undef)
[error] 176-176: 'console' is not defined.
(no-undef)
[error] 269-269: 'console' is not defined.
(no-undef)
[error] 270-270: 'console' is not defined.
(no-undef)
[error] 371-371: 'console' is not defined.
(no-undef)
[error] 372-372: 'console' is not defined.
(no-undef)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/workflows/changelog/__tests__/changelog-management.test.cjs` around lines 66 - 430, Replace the self-validating fixture assertions across the changelog scenarios with integration tests that invoke the production implementations: extract-pr-entries.cjs, merge-entries.cjs, changelogUtils.cjs, and validate-changelog.cjs. Use the existing fixture paths and workflow-like environment or arguments, invoke scripts via Node subprocesses such as execFileSync, and assert their actual outputs, generated files, exit statuses, and warnings. Update tests including “Extracts entries from PR changelog” and the validation, merge, release, and integration cases so regressions in real workflow logic are exercised rather than only checking strings just written to disk.231-237: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Vacuous test — can never fail.
assert(true, 'Empty entries should not cause sync failure')asserts a hardcoded literal, so this test provides zero verification value regardless of what the workflow actually does with empty entries.✅ Suggested fix
test('Handles empty entry extraction gracefully', () => { - // When no entries were extracted, the workflow should not fail- const hasEntries = false; // Simulates steps.extract.outputs.has_entries-- // Workflow should report gracefully without commit- assert(true, 'Empty entries should not cause sync failure');+ const hasEntries = false; // Simulates steps.extract.outputs.has_entries+ const shouldSkipCommitSteps = !hasEntries;++ assert(shouldSkipCommitSteps, 'Merge/commit/report steps should be skipped when has_entries is false'); });📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.test('Handles empty entry extraction gracefully', () => { const hasEntries = false; // Simulates steps.extract.outputs.has_entries const shouldSkipCommitSteps = !hasEntries; assert(shouldSkipCommitSteps, 'Merge/commit/report steps should be skipped when has_entries is false'); });🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/workflows/changelog/__tests__/changelog-management.test.cjs` around lines 231 - 237, Replace the hardcoded assert in “Handles empty entry extraction gracefully” with an assertion that exercises and verifies the workflow’s actual empty-entry behavior, using the hasEntries value and the relevant sync/result logic. Ensure the test fails if empty entries trigger a sync failure or commit attempt, rather than merely asserting a constant true value.
🔍 Reviewer Summary for PR #1282CI Status: ❌ Recommendations
|
c1e5740 to
8c8f1bcCompareashleyshaw
commented
Jul 24, 2026
Closing to refresh merge state |
…kflows Consolidates two metrics workflows into single metrics-reporting.yml: - metrics.yml → collect job (frontmatter metrics collection) - metrics-summary.yml → aggregate job (metrics aggregation & reporting) Changes: - Create .github/workflows/metrics-reporting.yml with sequential job execution - Collect job runs at 6:00 AM, aggregate depends on collect - Keep reporting.yml unchanged for ad-hoc manual runs - Delete old workflows after verifying logic migration - Add 19-test suite covering all scenarios and integration Job Sequencing: - collect: Gathers frontmatter metrics, creates tracking issues - aggregate: Depends on collect, generates weekly reports - post-to-discussions: Depends on aggregate, posts results Benefits: - Eliminates 3-hour scheduling gap (6 AM + 9 AM → sequential) - Single source of truth for metrics pipeline - Improved maintainability and job dependency clarity - Comprehensive test coverage for all scenarios Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
- Remove unused assertEquals helper function from changelog-management.test.cjs - Use hasEntries variable in assertion instead of always asserting true - Remove unused now variable from metrics-reporting.test.cjs These fixes address code-quality bot findings while preserving test functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
- P1: Fix changelog-management sync-changelog condition - Remove broken contains() check for PR files (not available in pull_request events) - Add github-script step to fetch changed files before gating sync - Add proper if conditions to skip steps when CHANGELOG.md not modified - P1: Allow changelog-only PRs to trigger validation - Remove **.md paths-ignore filter (was preventing changelog-only PRs) - Keep docs/** exclusion for documentation-only changes - P2: Include .test.cjs files in Jest test discovery - Update .jest.config.cjs testMatch patterns to include .cjs extensions - Ensures changelog and metrics workflow tests run in CI - Code quality: Remove unused test code - Remove unused assertEquals function - Fix hasEntries variable usage (was assert(true, ...) → assert(!hasEntries, ...)) - Remove unused now variable Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Address MD046 code-block-style issues in YAML workflow files by adjusting formatting in script blocks.
Linter fix: wrap email address in quotes for consistency.
ESLint auto-fixes for consistency.
Use shell string concatenation with printf to construct email address, preventing MD034 no-bare-urls linting error while maintaining functionality.
…nd 1B.ii - Phase 1B.i: Consolidated changelog management workflows - Phase 1B.ii: Consolidated metrics collection and reporting workflows - Both with comprehensive test coverage and critical bug fixes
Add persist-credentials: false to checkout steps that don't need git push: - changelog-management.yml: validate-changelog and pre-release-check jobs - metrics-reporting.yml: collect and post-to-discussions jobs Reduces credential exposure window per zizmor security scanner recommendations.
Simplify changelog entries to use GitHub references only for link validation.
8c8f1bc to
0b2285aCompareUh oh!
There was an error while loading. Please reload this page.
Linked issues
Closes#1227 (Epic: Consolidate 31 GitHub workflows)
Relates to lightspeedwp/lsx-currencies#308 (Phase 1B.ii Linear issue)
Summary
Consolidates two metrics workflows (
metrics.ymlandmetrics-summary.yml) into a singlemetrics-reporting.ymlworkflow with three sequential jobs:Phase: 1B.ii (Medium-Impact)
Savings: 2-3% GitHub Actions minutes
Eliminated scheduling gap: 3 hours → sequential execution
Safety Nets
Approach
Metrics / Benchmarks
Verification
Risk & Rollback
Changelog
Changed
Removed
Checklist (Global DoD / PR)