From 1159e88c580a6a71aacb38cb4de67d7f26d0c7f6 Mon Sep 17 00:00:00 2001 From: Michael I Chen Date: Tue, 15 Sep 2026 16:15:35 -0700 Subject: [PATCH 1/3] ci(prose-body): repin to the release that has it Both prose-body workflows have failed on every run since they landed, six in a row, because v0.4.0 does not contain the reusable workflows they call. They exist on the default branch, which is where I read them and where the README documents them -- using v0.4.0 in its own examples -- but the tag ships neither. v0.5.0 is the first release that carries them. Verified at the tag rather than inferred from it being newest: both files are present, neither declares a required input, unwrap-pr-body-check still accepts pull_request_target, and neither contains actions/checkout, which is the property that makes pull_request_target safe here. Nothing caught this. A reusable workflow that cannot be resolved fails the run before any job starts, and a run with no jobs contributes no check, so the failures never appeared on a pull request -- not even the one that added them, which went through review convergence. Both files now carry that reasoning. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/prose-body-write.yml | 5 ++++- .github/workflows/prose-body.yml | 10 +++++++++- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/.github/workflows/prose-body-write.yml b/.github/workflows/prose-body-write.yml index 08fec36..21dfa7a 100644 --- a/.github/workflows/prose-body-write.yml +++ b/.github/workflows/prose-body-write.yml @@ -18,6 +18,9 @@ # marker to distinguish a break the author wanted from one their editor made, # so this can join a break that was meant to stay. `` on # the line above a paragraph keeps it. +# Pinned to v0.5.0, the first release carrying this reusable workflow; see the +# note in prose-body.yml for why the tag has to be checked for the file rather +# than assumed from the release being newest. name: Prose body write on: @@ -28,4 +31,4 @@ jobs: edit: permissions: pull-requests: write - uses: michen00/markdown-prose-hooks/.github/workflows/unwrap-pr-body.yml@v0.4.0 + uses: michen00/markdown-prose-hooks/.github/workflows/unwrap-pr-body.yml@v0.5.0 diff --git a/.github/workflows/prose-body.yml b/.github/workflows/prose-body.yml index 4da5a09..e33954f 100644 --- a/.github/workflows/prose-body.yml +++ b/.github/workflows/prose-body.yml @@ -31,6 +31,14 @@ # The cost is the same one prose-body-write.yml pays. `pull_request_target` # reads the workflow from the default branch, so a pull request cannot test a # change to this file; it takes effect once merged. +# Pinned to v0.5.0 because that is the first release carrying these reusable +# workflows. The original pin said v0.4.0, read from the default branch, where +# the files exist and the README documents them with v0.4.0 examples -- but +# they were not in that tag. Verify a `uses:` ref actually contains the file, +# not just that the tag is the newest release: a reusable workflow that cannot +# be resolved fails the run before any job starts, and a run with no jobs +# contributes no check, so six consecutive failures left no mark on any pull +# request and were only visible in the Actions tab. name: Prose body on: @@ -43,4 +51,4 @@ jobs: # comment needs one, and the scope belongs on the calling job. permissions: pull-requests: write - uses: michen00/markdown-prose-hooks/.github/workflows/unwrap-pr-body-check.yml@v0.4.0 + uses: michen00/markdown-prose-hooks/.github/workflows/unwrap-pr-body-check.yml@v0.5.0 From e2dd8dd138ee662f09259da1d2e397e5b30c6629 Mon Sep 17 00:00:00 2001 From: Michael I Chen Date: Wed, 16 Sep 2026 00:30:21 +0100 Subject: [PATCH 2/3] docs: trim abstruse prose from a comment Co-authored-by: Michael I Chen Signed-off-by: Michael I Chen --- .github/workflows/prose-body-write.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/prose-body-write.yml b/.github/workflows/prose-body-write.yml index 21dfa7a..7b629bb 100644 --- a/.github/workflows/prose-body-write.yml +++ b/.github/workflows/prose-body-write.yml @@ -18,9 +18,7 @@ # marker to distinguish a break the author wanted from one their editor made, # so this can join a break that was meant to stay. `` on # the line above a paragraph keeps it. -# Pinned to v0.5.0, the first release carrying this reusable workflow; see the -# note in prose-body.yml for why the tag has to be checked for the file rather -# than assumed from the release being newest. + name: Prose body write on: From 1c16c116882423881ad5d3de5a30d4595ce17cf2 Mon Sep 17 00:00:00 2001 From: Michael I Chen Date: Tue, 15 Sep 2026 16:31:59 -0700 Subject: [PATCH 3/3] docs: trim abstruse prose from a comment --- .github/workflows/prose-body.yml | 36 +------------------------------- 1 file changed, 1 insertion(+), 35 deletions(-) diff --git a/.github/workflows/prose-body.yml b/.github/workflows/prose-body.yml index e33954f..382f75c 100644 --- a/.github/workflows/prose-body.yml +++ b/.github/workflows/prose-body.yml @@ -4,41 +4,7 @@ # at whatever width it was typed to. A file has the opposite problem -- the # break renders as a space and costs a reflowed diff -- and the pre-commit hook # covers that side. -# -# Deliberately narrower than the upstream example, which also carries `opened` -# and `reopened`. Those belong to prose-body-write.yml: sharing an event fires -# both at once, and this report would then describe a body the rewrite is about -# to replace. `edited` is not in the default type set and is the one that -# matters -- editing a body fires it alone, so without it a report would stand -# on a body the author has already fixed. -# -# `pull_request_target`, not `pull_request`, and the difference is who the -# report reaches. A fork's token is read-only whatever a caller's -# `permissions:` block asks for, so under `pull_request` the comment is refused -# for every outside contributor -- the people least likely to know this -# repository's prose convention, and the ones the report exists for. The run -# does not fail there and the report is not lost: the reusable workflow falls -# back to the job summary. But a summary is something you have to open a check -# to find, and a comment is not. -# -# What makes that safe here is that the reusable workflow checks out nothing -- -# it has no `actions/checkout` step at all. It reads the body from the event -# payload and posts a comment, so the usual `pull_request_target` hazard, a -# writable token handed to unreviewed code, has nothing to attach to. Keep it -# that way: adding a checkout of the pull request head under this trigger is -# what would turn it into the vulnerability the pattern is known for. -# -# The cost is the same one prose-body-write.yml pays. `pull_request_target` -# reads the workflow from the default branch, so a pull request cannot test a -# change to this file; it takes effect once merged. -# Pinned to v0.5.0 because that is the first release carrying these reusable -# workflows. The original pin said v0.4.0, read from the default branch, where -# the files exist and the README documents them with v0.4.0 examples -- but -# they were not in that tag. Verify a `uses:` ref actually contains the file, -# not just that the tag is the newest release: a reusable workflow that cannot -# be resolved fails the run before any job starts, and a run with no jobs -# contributes no check, so six consecutive failures left no mark on any pull -# request and were only visible in the Actions tab. + name: Prose body on: