fix(scheduler): scope Actions credentials by run host

[seonghobae]

Root cause

Central required-workflow inventory and force-cancellation were routed through the same cross-repository Actions credential used for target repositories. If the mutation App installation exhausted its independent API quota, the scheduler could not discover or cancel central current-head review runs even though the receiving workflow runner token had the required same-repository authority.

Historical owner PR #1231 contains this valid repair mixed with unrelated linter, SBOM, GPU, and mutation-credential changes on a branch 36 commits behind protected main. This successor extracts only the independently verifiable host-scoped Actions credential boundary; #1231 remains open for complete delta reconciliation.

RED → GREEN

• RED: 8cc62ce8837e456dfac4f592bcbd0786a77e4b81
  • permanent regression requires central discovery/cancellation to use the central runner token and target operations to retain the explicit cross-repository Actions token
• GREEN: 7bf3451a47768dbda903115a393b1da1d98e1dba
  • adds one repository-aware Actions command boundary
  • routes active-run inventory and force-cancellation through that boundary
  • compares central repository identity case-insensitively
  • updates CHANGELOG, APA-style doctoring, and docs/product-technical-gap-baseline.md

Authority and safety

• Base: protected main@c9052e607e5f3cc76e73207e7786b21500721b79
• Branch updates are normal fast-forwards; no force push or rebase
• No reviewer, status, ruleset, mutation, or cross-repository permission is weakened
• Missing target authority still fails closed at the GitHub API boundary
• Status remains Proposed until fresh exact-head GitHub Checks and independent review are terminal and clean

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Baseline reproduction narrows #2005 failure ownership

Independent clean-detached reproduction was completed against parent stack head 14f7c85ca56be3297fa4d090d39d487d7be9bf14 in /tmp/cwl-2005-baseline.nThdOD (session 78451). No source mutation was made.

Command:

.venv/bin/python -m pytest tests/test_pr_review_merge_scheduler.py -q -k 'cancel_stale_opencode_runs_uses_bounded_executor_for_multiple_runs or force_cancel_failure_logs_reason_and_does_not_raise or force_cancel_multiple_runs_reports_only_failures or workflow_starting_credentials_allow_head_mutations' --tb=short

Result: 4 failed, 330 deselected / 13.60s / terminal 1.

The same four failures already exist before #2005's target-Actions-inventory omission delta:

1. cancel_stale_opencode_runs_uses_bounded_executor_for_multiple_runs — cancellation mock list.append does not accept the new stdin= keyword.
2. force_cancel_failure_logs_reason_and_does_not_raise — fail_cancel fixture does not accept stdin=.
3. force_cancel_multiple_runs_reports_only_failures — maybe_fail fixture does not accept stdin=.
4. workflow_starting_credentials_allow_head_mutations — remains false under the parent credential-proof contract.

Therefore these four are parent-stack regressions, not caused by #2005's child-only inventory-suppression delta. This does not prove that the remaining 11 failures from #2005 hosted run 34082563712 / job 101620505562 have the same cause; those still require separate RCA.

Canonical repair request for #2002/#2003 owner lane:

• Preserve the production safety contract: repository-aware Actions calls must keep stdin forwarding and host-scoped credentials; do not weaken cancellation authority or fail-closed credential proof merely to satisfy fixtures.
• Repair cancellation mocks/fixtures to match the real callable signature where fixture drift is proven.
• Independently verify workflow_starting_credentials_allow_head_mutations against the intended fix(scheduler): prove workflow-starting mutation token #2003 present/distinct-token contract; if the production contract changed intentionally, update the test expectation/fixture only after proving semantic equivalence. If production behavior is wrong, fix the implementation instead.
• Re-run this exact 4-test baseline first, then the broader Runtime Quality review-repair suite, before claiming fix(scheduler): skip central target Actions inventory #2005 exact-head failure resolved.

No force push, source change, close, or safety-gate weakening is requested.