Reconcile: visibilityTransitions counter missing from operator-readable Step Summary

[marcusrbrown]

Source: ce:review round 1 on feat/private-visibility-transition (agent-native, P2 conf 0.82)
Scope: .github/workflows/reconcile-repos.yaml — Step Summary emission

Problem

The new visibilityTransitions counter is emitted only in raw JSON stdout. There's no GITHUB_STEP_SUMMARY line, no log statement at info level. An operator (or another agent) reading the daily reconcile summary cannot tell whether a visibility transition fired without grepping the full job log.

Suggested fix

In .github/workflows/reconcile-repos.yaml, capture the reconcile JSON output and emit a markdown summary to $GITHUB_STEP_SUMMARY including:

• Dispatched count
• Visibility transitions detected
• Visibility transition issues created (success/skipped/failed)
• Other relevant outcomes

Acceptance

• The Reconcile Repos action run page's Summary tab shows the counter when a transition fires.
• Operators can answer "did any visibility transitions fire today?" without opening the raw job log.

Why not in the round-2 fix

Workflow YAML changes were out of round-2 scope (round-2 was script-only durability + correctness).

[fro-bot]

Reproduced. The signal is real, and the diagnosis in the issue is correct.

Confirmed

On feat/private-visibility-transition, scripts/reconcile-repos.ts does emit a visibilityTransitions counter (on summary, incremented at L625) and a visibilityTransitionIssues count on the top-level result (L1541). But the workflow at .github/workflows/reconcile-repos.yaml runs the script as a bare node scripts/reconcile-repos.ts — the JSON on stdout is written into the raw job log and nothing else. No GITHUB_STEP_SUMMARY write, no info-level surfacing of those counters. An operator landing on the run page's Summary tab learns nothing about whether a transition fired.

The issue's framing is right: this is operator-readability, not correctness. The script is doing its job; the workflow is swallowing the signal.

Proposed shape of the fix

Keep the script's contract (JSON on stdout) intact — that's what downstream tooling and tests pin against. Layer the Step Summary on top in the workflow step:

1. In the 🔁 Reconcile repos step, redirect stdout to a file (reconcile-result.json) while preserving exit code propagation.
2. Add a follow-up step (if: always() so failures still surface partial data) that parses that file with jq and appends a markdown table to $GITHUB_STEP_SUMMARY.
3. Include at minimum: accessListSize, summary.added / regained / lostAccess / refreshed / migrated, summary.visibilityTransitions, dispatches.length, dispatchesFailed.length, perRepoIssues, rollupIssues, visibilityTransitionIssues, issuesFailed, closedStaleIssues, probesFailed.
4. Highlight rows where a transition fired (visibilityTransitions > 0 or visibilityTransitionIssues > 0) — bold them, or prefix with a glyph — so the answer to "did anything happen with visibility today?" is visible at a glance without reading the table cell-by-cell.

Two footguns to avoid while implementing:

• Don't lose stderr. The script writes structured error breadcrumbs to stderr (see L1271). node script.ts > result.json is fine; &> result.json would hide the diagnostics the operator needs when things go sideways.
• Don't make the summary step block the run on parse failure. If the JSON is malformed (the script crashed mid-emit), the summary step should fall back to "JSON parse failed, see job log" and exit 0. The reconcile step itself owns the run's success/failure verdict.

Suggested next steps

• Open a PR against main (or whichever branch carries feat/private-visibility-transition once it lands) doing the workflow-only change above. Pure YAML diff, no script changes, no test changes — round-2 scope discipline preserved.
• Optionally: mirror the same Step Summary pattern in adjacent reconcile-adjacent workflows (poll-invitations, update-metadata) in a follow-up. Operators have asked for this signal more than once; a shared pattern is cheaper than three bespoke jq blobs. But that's a separate ticket — don't scope-creep this one.

Not blocking anything else. Picking this up if no one objects.

---

Run Summary

Field	Value
Event	issues
Repository	fro-bot/.github
Run ID	26149628642
Cache	hit
Session	ses_1bb97077dffe3XFn5IhLyBhlcX