fix: guard artifact action version pairing + reviewer guard + comment-language convention#32
Merged
Merged
Conversation
Self-audit issue #25 flagged upload-artifact@v7 vs download-artifact@v8 across the discovery -> reviewer -> synthesis -> report pipeline as a high-severity drift risk, since these companion actions have had format-incompatible major bumps before (v3->v4). Verified compatible: v8's release notes (ESM migration, digest-mismatch defaults to error, Content-Type-driven unzip) don't change the artifact format v7 upload produces, and the 2026-07-20 self-audit run exercised upload@v7 + download@v8 across the full pipeline successfully. So this keeps the current pins and adds a regression test instead of downgrading download-artifact.
The other six reviewer steps in the Marketplace action.yml use `if: always() && contains(...)` so each reviewer runs regardless of discovery's outcome. docs_staleness was missing `always() &&`, so a bare if implicitly depended on success(), breaking that uniform contract (issue #25).
…h comments Self-audit issue #25 found src/ comments split roughly evenly between Traditional Chinese and English with no recorded convention. Records English (matching README.md's en base) in CLAUDE.md and translates the remaining Traditional-Chinese comments across src/*.ts to English. Comment text only — no behavioral changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the 3 findings from the self-audit tracking issue #25:
.github/actions/*/action.ymlpinactions/upload-artifact@v7andactions/download-artifact@v8across the discovery -> reviewer -> synthesis -> report pipeline, a boundary that has been format-incompatible before (v3->v4). Rather than downgrading either action (no shared major exists — upload-artifact tops out at v7, download-artifact at v8), addedtest/action-pins.test.tswhich asserts all upload-artifact pins match, all download-artifact pins match, and the pair equals an explicitALLOWED_PAIRconstant documented with the compatibility evidence: v8's release notes (ESM migration, digest-mismatch defaults to error, Content-Type-driven unzip) don't change the artifact format v7 upload produces, and the 2026-07-20 self-audit run exercised this exact pairing end-to-end successfully. Verified the test fails when a pin is changed and passes again once reverted.action.yml'sdocs_stalenessreviewer step was missing thealways() &&guard the other six reviewer steps have, so it alone implicitly depended on the discovery step succeeding. Added the guard for consistency.src/*.tscomments were split between Traditional Chinese and English with no recorded convention. Recorded "English, matching README.md's en base" in CLAUDE.md's Working conventions, and translated the remaining zh-TW comments to English acrosstypes.ts,issue.ts,matrix.ts,rubric.ts,find-issue.ts,discovery.ts,gitmeta.ts,consolidate.ts,classify.ts. Comment-only change — no code lines touched.Test plan
npx vitest run test/action-pins.test.ts— green (4/4)discovery/action.yml's upload-artifact pin to v8 — 2 assertions failed as expected; reverted — green againnpm test— 148/148 passing across 28 filesnpm run build— tsc cleangit diff main -- src/touches comment lines only;rg -n '[一-鿿]' src/— no outputgrep -n "always()" action.yml— all 7 reviewer steps guardedCloses #25
🤖 Generated with Claude Code