Monthly Workflow Audit - June 2026

[github-actions]

Monthly Workflow Audit - June 2026

Review Period: 2026-06-01 to 2026-06-30

Repository Activity Summary

• PRs merged: 5 (Automate Go version bumps via a go.mod-only checker #2, Add GetOrAdd and GetOrAddFunc to the single-component handle #4, Stop auto-flagging monthly audit issues as input required #5, Bump Go version from 1.26 to 1.26.4 #7, Trim centralized autonomous-workflow sections from CLAUDE.md #8)
• Issues closed: 2 (Add GetOrAdd and GetOrAddFunc to the single-component handle #3, Update Go version from 1.26 to 1.26.4 #6)
• Claude-labeled PRs: 5
• Claude-labeled issues: 2
• Failed PR attempts: 0
• Rework cycles: 0 (every PR merged in 1–2 commits)

Re-verified 2026-07-31 against the API — these counts are correct. See "Central Response" below for why the generated counts were unreliable across repositories and what fixed it.

Audit Tasks

Please analyze the repository activity from the review period and provide:

1. Pattern Analysis: Identify common failure patterns or workflow bottlenecks
2. Feature Discovery: Search for new GitHub/Claude Code features that could improve our workflow
3. Workflow Improvement Suggestions: Recommend specific changes to instructions, scripts, workflows, labels
4. Success Reference: Review the successful manual audit example (nrg#290) for inspiration — removed from the audit template on 2026-07-31; the reference does not resolve outside the repository it was written for.

Audit Findings (June 2026)

1. Pattern Analysis

This is the repository's first monthly audit, so there is no historical baseline to compare against. June was the module's bootstrap month.

• Throughput was healthy. 5 PRs merged, 2 issues closed, zero failed attempts and zero rework — every PR landed in 1–2 commits with no review-cycle churn.
• One genuine incident (already fixed): PR Trim centralized autonomous-workflow sections from CLAUDE.md #8 hit the classic "required check + paths-ignore deadlock." main's branch protection requires the analysis context, but analysis.yml carried paths-ignore: ['**.md', 'LICENSE', 'docs/**']. A doc-only PR skipped the workflow, so the required context never reported and the PR was permanently BLOCKED. Fixed in 5ddfa1e by dropping the path filters so analysis always runs and reports.
  • Residual fragility (not a regression): the pattern remains a trap. Any new required status check added later with a path filter reintroduces the same deadlock. Worth remembering as a convention: required checks must never carry paths-ignore/paths filters.

2. Feature Discovery

Notable June 2026 releases and their relevance to this repo:

• Claude Code fallbackModel chain (up to 3 fallbacks when the primary is overloaded) — relevant to autonomous-session reliability, but it lives in the centralized scheduler infra, not this repo. Flagging for the infra owner rather than actioning here.
• GitHub "Control who and what triggers workflows" (2026-06-18, workflow execution protections, public preview) — security hardening aimed at Enterprise/org admins; low priority for a small standalone module.
• GitHub Actions parallel steps (background/wait/parallel keywords) — could parallelize CI steps, but this repo's CI is already fast (a single tiny package); not worth the added complexity.

None of the June feature releases require changes to this repo's files.

3. Workflow Improvement Suggestions (repo-local)

Small, concrete, low-risk — all in .github/workflows/analysis.yml. Still open and still applicable: analysis.yml and go.yml were not part of the 2026-07-31 shared-workflow migration (7187af2), so they remain repo-local.

• Pin staticcheck. analysis.yml installs honnef.co/go/tools/cmd/staticcheck@latest. A floating @latest is non-deterministic and contradicts this repo's pinning discipline (golangci-lint is pinned to v2.9.0, the Go version derives from go.mod). A surprise staticcheck release could break CI on an unrelated PR.
• Deduplicate the analyzers. go vet runs in three places: go.yml (check), analysis.yml (standalone), and inside golangci-lint (govet). staticcheck runs twice: standalone and inside golangci-lint.

Verified 2026-07-31 against golangci-lint v2.9.0 sources (pkg/lint/lintersdb/builder_linter.go, pkg/golinters/staticcheck/staticcheck.go, pkg/config/linters_exclusions.go):

• Both govet and staticcheck carry WithGroups(config.GroupStandard) — i.e. both are enabled by default, with no .golangci.yml present.
• With no configuration, the bundled staticcheck runs ["all", "-ST1000", "-ST1003", "-ST1016", "-ST1020", "-ST1021", "-ST1022"] — equal to or broader than what standalone staticcheck ./... runs by default.
• v2 exclusion presets are opt-in (linters.exclusions.presets defaults to empty), so no findings are silently filtered out.

Consequence: Option A costs no coverage and needs no .golangci.yml. Dropping the standalone Install staticcheck / Run staticcheck / Run go vet steps from analysis.yml leaves the same checks running, pinned transitively to golangci-lint v2.9.0, and removes the @latest non-determinism as a side effect — so pinning becomes unnecessary rather than a second task.

Remaining nuance for the maintainer: go.yml's Vet step would still be a second go vet. It is not pure duplication — go.yml uses check-latest: true, so its vet runs on the newest patch toolchain and can catch toolchain regressions that analysis.yml (no check-latest) would not. Recommendation: keep it.

4. Success Reference

nrg#290 is in a separate repository and not readable from here. As of 2026-07-31 this item has been removed from the audit template entirely.

5. Central Response (2026-07-31)

Answered centrally across eleven audits in ten repositories. Summary as it applies here:

• The bad activity counts were caused by the permissions: block, not search-index lag. monthly-audit.yml's explicit block granted only issues: write and contents: read; with an explicit block every undeclared scope defaults to none, so the token had no pull-requests scope and gh pr list returned an empty set on private repositories without erroring. That is why issue counts were always right and only PR counts were wrong.
• Fixed here in 7187af2. This repo's monthly-audit.yml is now a stub calling trancecode/github-workflows/.github/workflows/monthly-audit.yml@main, and it grants pull-requests: read. Verified present in the stub. The August audit will generate correct counts natively.
• Distribution was the deeper problem. Workflows were copied per repository and never re-synchronised, so one bug became ten divergent copies. check-go-version, commit-validation, failing-checks-label, input-required-label, issue-dependencies, merge-conflict-label, and monthly-audit are now stubs; a fix in the shared repo reaches this one on its next run.
• Design and rationale: claude_code_environment/docs/plans/2026-07-31-shared-workflows-migration-design.md.

Repo-local data points for the two items the central response left open:

• auto-claude-label.yml is still a local copy here and triggers on pull_request: [opened, reopened, synchronize] — the majority pattern, not nrg's workflow_run variant. This repo needs no change when that workflow is shared; it can adopt the shared version as-is.
• The footer-grep readiness check is why this issue is still alive: the 2026-07-31 central comment carried no footer, so work detection saw human input and re-triggered. Conversely, any Claude reply here carries the footer (autonomous sessions must add it) and therefore sets input required — correct in this case, since decisions are pending.

---

Next Steps

When the discuss label is removed, Claude will:

• Edit .github/workflows/analysis.yml to remove the Install staticcheck, Run staticcheck, and Run go vet steps, leaving golangci-lint@v2.9.0 (which runs govet and staticcheck by default) plus the blank-line script check. No .golangci.yml is added.
• Leave go.yml's Vet step in place (it runs on the newest patch toolchain via check-latest: true).
• Not document the "no paths-ignore on required checks" convention in this repo unless the maintainer says otherwise — see the open question below.

Open questions:

• Static-analysis dedup: Option A (consolidate into golangci-lint, drop standalone steps) or Option B (keep standalone steps, just pin the version)? — Claude recommends Option A; verified against golangci-lint v2.9.0 sources that it loses no coverage. Awaiting maintainer confirmation.
• If Option A: acceptable to add a small .golangci.yml enabling staticcheck? — Not needed. staticcheck and govet are both in golangci-lint v2's default standard group; a config file would add nothing.
• Where should the "no paths-ignore/paths filters on required status checks" convention live? Now that the shared workflows are centralized and PR Trim centralized autonomous-workflow sections from CLAUDE.md #8 deliberately trimmed centralized guidance out of this repo's CLAUDE.md, Claude's recommendation is trancecode/github-workflows (central), with no repo-local duplication. Confirm, or name a repo-local home (CLAUDE.md, docs/styleguide.md, or a comment in analysis.yml/go.yml).
• Are the June 2026 centralized-infra items (fallbackModel) in scope for this repo's audit, or should they be routed to the scheduler-infra owner? — Routed centrally. Repo audits cover repo-local files only; infra items go to trancecode/github-workflows / the scheduler-infra owner.

Remaining blockers: confirmation of Option A, and the convention-location decision.

---

✨ Content generated by Claude AI.

[herve-quiroz]

Completed the June 2026 workflow audit and updated the issue description with the findings.

Summary:

• Activity: 5 PRs merged (Automate Go version bumps via a go.mod-only checker #2, Add GetOrAdd and GetOrAddFunc to the single-component handle #4, Stop auto-flagging monthly audit issues as input required #5, Bump Go version from 1.26 to 1.26.4 #7, Trim centralized autonomous-workflow sections from CLAUDE.md #8), 2 issues closed (Add GetOrAdd and GetOrAddFunc to the single-component handle #3, Update Go version from 1.26 to 1.26.4 #6), zero failed attempts and zero rework — a healthy bootstrap month.
• One incident, already fixed: PR Trim centralized autonomous-workflow sections from CLAUDE.md #8's "required check + paths-ignore deadlock" on doc-only PRs (fixed in 5ddfa1e). The residual lesson is a convention: required status checks must never carry path filters.
• Feature discovery: the relevant June 2026 releases (Claude Code fallbackModel, GitHub workflow-execution protections, parallel steps) target centralized infra or Enterprise use — none require changes to this repo.
• Repo-local suggestions (both in analysis.yml):
  1. Pin staticcheck (currently @latest, non-deterministic and against this repo's pinning discipline).
  2. Deduplicate static analysis — go vet runs 3× and staticcheck overlaps golangci-lint; consider consolidating into golangci-lint.

Updated the issue description:

• Filled in the real activity numbers and added an Audit Findings section (pattern analysis, feature discovery, suggestions).
• Added a Next Steps section describing what implementation would do, with 4 open questions.

Pending decisions — 4 question(s) remain before this issue can move to implementation. See the "Next Steps" section in the issue description.

---

✨ Content generated by Claude AI.

[herve-quiroz]

Answering this audit centrally: eleven audits across ten repositories reported the
same finding, so the response is one design and one fix rather than eleven.

Root cause, corrected

Every audit correctly spotted that the activity summary reported PRs merged: 0
while real pull requests had merged. Six audits attributed this to GitHub's
eventually-consistent search index lagging behind the midnight-on-the-1st cron.
That diagnosis is wrong. The webmirror audit had it right: it was the
permissions: block.

monthly-audit.yml declared an explicit block granting only issues: write and
contents: read. With an explicit block, every undeclared scope defaults to
none, so the token had no pull-requests scope. All these repositories except
visual_testing_data are private, so gh pr list returned an empty set. Search
returns empty rather than erroring, the step exits zero, and the count silently
renders as 0, which is why the issue counts were always correct and only the
pull request counts were wrong.

Two independent proofs:

• The July 2026 run log for nrg prints the granted scopes: Contents: read,
  Issues: write, Metadata: read. No pull-requests scope.
• nrg's earliest June merges landed on 2026-06-14 and were still counted as zero
  on 2026-07-01. Index lag cannot explain a three-week-old merge.

Verified after the fix: lockstep's June audit reported all zeros on 2026-07-01;
re-running with only pull-requests: read added reports PRs merged: 1, which
matches ground truth.

What changed

The deeper problem was distribution. These workflows were copied into each
repository at setup time and never re-synchronised, so one bug became ten
divergent copies and ten autonomous sessions rediscovered it independently,
reaching four different conclusions.

Shared workflows now live in
trancecode/github-workflows and
are called, not copied. Each repository keeps a stub supplying its own triggers
and permissions. A fix there reaches every repository on its next run.

Also folded in, from variants that had drifted apart, each of which had a real
feature the others had lost:

• check-go-version now normalizes go1.26 to go1.26.0, avoiding a spurious
  bump issue on the first day of every new Go minor.
• check-go-version uses an exact-title dedup guard instead of a fuzzy match.
• commit-validation handles the all-zeros before SHA on an initial branch push.
• input-required-label keeps design-label support and continues past a failing
  pull request instead of failing the whole run.

The audit template also no longer carries Reference: #134 or the nrg#290
success reference, neither of which resolves outside the repository it was
written for.

Design and rationale:
claude_code_environment/docs/plans/2026-07-31-shared-workflows-migration-design.md.

Still open

• auto-claude-label.yml is not yet shared. nrg drives it from a workflow_run
  trigger tied to its own Labeler workflow while every other repository triggers
  on pull_request; reconciling those needs a workflow_call input, and it is
  the agent's own control plane, so it wants review rather than a quiet change.
• The find-work readiness check identifies Claude-authored content by grepping
  for a footer string. Any bot comment carrying that footer permanently strands a
  discuss issue. Seven audits died this way and have been closed.

Leaving this issue open and labelled discuss for you to close or redirect.

[herve-quiroz]

Thanks — the central diagnosis lands, and it corrects something this audit never questioned: the description here was filled in with hand-verified counts on 2026-07-01, so the zero-count symptom was papered over locally rather than diagnosed. Re-checked today against the API: 5 PRs merged (#2, #4, #5, #7, #8) and 2 issues closed (#3, #6) — the numbers in the description are right, but they were right by manual correction, not because the generator worked.

Confirmed on this repo:

• monthly-audit.yml is now a stub calling trancecode/github-workflows and grants pull-requests: read, so the August audit should generate correct counts without hand-correction.
• auto-claude-label.yml (still local, still open centrally) triggers on pull_request: [opened, reopened, synchronize] — the majority pattern, not nrg's workflow_run variant. Nothing here needs reconciling; this repo can take the shared version as-is once it exists.

The two repo-local suggestions from June survive the migration, because analysis.yml and go.yml were not part of 7187af2 — they are still local copies. I dug into golangci-lint v2.9.0's own sources to settle the Option A/B question rather than leave it to preference:

• govet and staticcheck both carry WithGroups(config.GroupStandard) in pkg/lint/lintersdb/builder_linter.go — enabled by default, no config file required.
• With no config, the bundled staticcheck runs ["all", "-ST1000", "-ST1003", "-ST1016", "-ST1020", "-ST1021", "-ST1022"], equal to or broader than standalone staticcheck ./....
• v2 exclusion presets are opt-in (linters.exclusions.presets defaults to empty), so nothing gets silently filtered.

So Option A is strictly better and needs no .golangci.yml — dropping the standalone go vet and staticcheck steps loses no coverage and eliminates the @latest non-determinism as a side effect, making the "pin staticcheck" suggestion moot rather than a second task. Two of the four open questions close on that finding.

Updated the issue description:

• Added a Central Response (2026-07-31) section recording the permissions:-block root cause, the 7187af2 fix here, and repo-local data points for the two items left open centrally.
• Replaced the Option A/B open question with the verified golangci-lint v2.9.0 evidence and a concrete recommendation.
• Rewrote Next Steps to describe the exact analysis.yml edit, and noted that go.yml's Vet step should stay (it runs on the newest patch toolchain via check-latest: true, which analysis.yml does not).
• Struck the nrg#290 success reference and dropped the dangling Reference: #134 footer, per the template change.
• Marked the centralized-infra scope question resolved: infra items route to trancecode/github-workflows, not repo audits.

One meta-note, since it decides this issue's fate: the footer-grep readiness check is the only reason this audit is still alive — the central comment carried no footer, so work detection read it as human input. This reply does carry the footer, which will set input required. That is the correct outcome here, since two decisions are genuinely pending. I have not closed the issue: the description carries no instruction authorising Claude to close it, and "close or redirect" reads as addressed to you.

Pending decisions — 2 question(s) remain before this issue can move to implementation. See the "Next Steps" section in the issue description.

---

✨ Content generated by Claude AI.

[herve-quiroz]

Closing: the finding this audit raised is fixed and verified in production.

The activity summary reported PRs merged: 0 because monthly-audit.yml
declared an explicit permissions: block that omitted pull-requests. With an
explicit block every undeclared scope defaults to none, so gh pr list returned
an empty set in a private repository. Search returns empty rather than erroring,
which is why the issue counts were right and only the pull request counts
were wrong.

Verified end to end: the July 2026 audit in this repository was generated by the
shared workflow with pull-requests: read granted, and its counts match the
actual merge history.

Workflows are no longer copied per repository. They live in
trancecode/github-workflows and
are called from thin stubs, so the next correction reaches every repository at
once instead of being rediscovered eleven times.

The July 2026 audit supersedes this one for ongoing review.