chore(maintenance): reproducible workflow/script consumer inventory - #422
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 20dfacb7de
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if re.match(r"^on:\s*(?:#.*)?$", line): | ||
| in_on = True | ||
| continue | ||
| inline = re.match(r"^on:\s*\[([^]]+)\]", line) |
There was a problem hiding this comment.
When a workflow uses valid scalar, quoted, flow-map, or non-two-space-indented YAML such as on: push, "on":, or a four-space-indented trigger, these regexes return an empty event list. The resulting inventory therefore silently omits real triggers while claiming to list top-level trigger types; handle the valid YAML forms or reject unsupported syntax rather than recording incomplete data.
AGENTS.md reference: AGENTS.md:L58-L66
Useful? React with 👍 / 👎.
| if not full.is_file(): | ||
| raise FileNotFoundError("Tracked text file missing: " + path) | ||
| content = full.read_text(encoding="utf-8-sig", errors="replace") |
There was a problem hiding this comment.
When the documented command is run from a checkout containing staged or unstaged tracked edits, this reads the worktree files while sourceCommit is still populated from HEAD. The JSON is then attributed to a commit whose blobs do not match the report, making cross-candidate comparisons and provenance unreliable; either read files from the advertised Git tree or reject a dirty index/worktree.
AGENTS.md reference: AGENTS.md:L27-L33
Useful? React with 👍 / 👎.
1 participant
Verified audit finding M05 → executable inventory
The 27 Sep baseline audit records 28 workflows / 55 scripts and explicitly does not claim script orphans without a full consumer inventory. This PR implements the first reviewable inventory step, rather than rewriting working Discovery or revisiting the already accepted stable release.
ARSAS-maintenance-dependency-inventoryfrom the exact triggering revision. It does not fail merely because a script has no literal in-tree caller.Boundary and acceptance
Base
cd6efb89a592821e3461f189bed900e1b1873d0c, head20dfacb7de28e6946b08f733ca39616be81d6ecd; exact four-file scope: two new audit scripts,.github/workflows/build.yml, and a dated follow-up runbook. No WPF/application/protocol/engine/RCB/GI/SCL/reporting code, release publisher, version, lock or physical evidence changed. Full exact-head Windows CI, test step, artifact generation and post-merge main verification required. Tracks #380. No DCO sign-off requested under current contribution policy.