fix(kanban): advance-deploy-env must fail closed on unreadable or truncated reads

[LukasWodka]

Summary

Two Bugbot findings on the develop -> staging promotion (.github#166). Both are the same class, and both fail open — which is the one direction this workflow must never fail, since a silent no-op looks identical to a green run.

1. A failed read was indistinguishable from "closes nothing." Both lookups ended in || CIS='{}' / || IRESP='{}'. An expired token, a rate limit, or a cross-repo permission error produced an empty result, the loop advanced nothing, and the run reported success. That is precisely the board drift this advancement was added to eliminate — returning invisibly.

2. Truncation was silent.closingIssuesReferences(first: 30) and projectItems(first: 10) requested no totalCount, so anything past the limit simply looked like it did not exist.

Changes

Both reads now follow the workflow's existing fail-closed convention (RUN_FAILED=1, warning, non-zero exit at the end):

• unreadable closing-issue list → warn + RUN_FAILED, never "closes nothing"
• unreadable issue → warn + RUN_FAILED, never "not on project"
• totalCount requested on both connections; exceeding the page size warns and sets RUN_FAILED rather than skipping the remainder quietly

Test plan

• actionlint clean
• YAML parses
• No behaviour change on the healthy path: same queries, same advancement logic, extra field only

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes CI kanban automation behavior on error paths across all repos that call this workflow; misclassification could redden runs or still miss cards, but the happy path is unchanged.

Overview
The closing-issue advancement path in advance-deploy-env no longer treats API failures or partial pages as “nothing to do.” GraphQL stderr is captured in a temp file so errors can be classified instead of being discarded with 2>/dev/null and || '{}' fallbacks.

For closing-issues lookups on scraped PR numbers, only “not a pull request” is skipped quietly; token, rate-limit, and permission failures emit warnings, set RUN_FAILED, and the step exits non-zero at the end. totalCount on closingIssuesReferences triggers a warning and RUN_FAILED when more than 30 closing issues exist.

Per-issue reads from GitHub-resolved triples always fail closed on any GraphQL error (including cross-repo access gaps), with no benign skip for “could not resolve” text. projectItems.totalCount over 10 is similarly flagged so a kanban item might be missed without a silent green run.

Healthy paths are unchanged aside from the extra totalCount fields in the queries.

^{Reviewed by Cursor Bugbot for commit c273577. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

Cross-reference: #181 fixes the same two .github#166 findings independently — opened ~15 minutes after this one, from a different session. Details and a side-by-side are in my comment there. The two must not both merge, and the choice is @LukasWodka's — I have not closed either.

Bugbot's review of #181 also caught a regression that was in this PR, and I have since fixed it here: PR_NUMBERS is scraped from commit subjects and legitimately carries numbers that are not PRs in this repo (the loop's own comment says so). My first version failed closed on those, which would have reddened ordinary pushes. Fail-closed is right for an outage and wrong for a reference that simply does not resolve — the two are now split on the error text, and the error is logged instead of discarded.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e05ac93. Configure here.}

[LukasWodka]

Closing in favour of #181, per @LukasWodka's decision.

Both PRs independently fix the same two Bugbot findings on .github#166 (fail-closed closing-issue lookups + totalCount in advance-deploy-env.yml); only one may merge. #181 is the chosen implementation:

• fix(kanban): fail-closed closing-issue lookups + totalCount (Bugbot .github#166) #181 — touches only advance-deploy-env.yml, fully Bugbot-green after 6 rounds, no open findings.
• fix(kanban): advance-deploy-env must fail closed on unreadable or truncated reads #180 (this PR) — still has an open High-severity fail-open finding (Could not resolve to a Repository treated as a benign skip, which masks permission failures), accidentally commits two .pyc files under scripts/__pycache__/, and is red on pii-gate.

Closing to keep the review queue unambiguous for @saadqbal. Reopen if ever needed.