Distillation

Date: Sep 8, 2026

• 🔴 [workflow-id-file-name-convention] (20:47) User specified that REST API workflow_id parameters can be replaced with the workflow file name (for example, main.yaml).
• 🟡 (20:47) GitHub Actions REST API documentation: GET /repos/{owner}/{repo}/actions/workflows lists repository workflows; read access is sufficient, and private repositories require repo scope for OAuth app tokens and classic PATs. Pagination defaults are per_page=30 (maximum 100) and page=1. Each workflow includes id, node_id, name, path, state, timestamps, API/HTML/badge URLs, and optional deleted_at.
• 🟡 (20:47) GitHub Actions REST API documentation: GET /repos/{owner}/{repo}/actions/workflows/{workflow_id} gets a workflow; {workflow_id} accepts either its ID or workflow file name such as main.yaml; requires read access, with repo scope for OAuth app tokens/classic PATs on private repositories; returns HTTP 200.
• 🟡 (20:47) GitHub Actions REST API documentation: PUT /repos/{owner}/{repo}/actions/workflows/{workflow_id}/disable disables a workflow, setting state to disabled_manually; {workflow_id} accepts a workflow file name; OAuth tokens and classic PATs require repo scope; returns HTTP 204.
• 🟡 (20:47) GitHub Actions REST API documentation: POST /repos/{owner}/{repo}/actions/workflows/{workflow_id}/dispatches manually triggers a workflow and accepts a workflow file name for {workflow_id}. The workflow must configure workflow_dispatch; required body field ref is a branch or tag, optional inputs supports at most 25 properties and omitted inputs use configured defaults; OAuth tokens and classic PATs require repo scope; documented response is HTTP 200 with workflow_run_id, run_url, and html_url.
• 🟡 (20:47) GitHub Actions REST API documentation: PUT /repos/{owner}/{repo}/actions/workflows/{workflow_id}/enable enables a workflow and sets state to active; {workflow_id} accepts a workflow file name; OAuth tokens and classic PATs require repo scope; returns HTTP 204.
• 🟡 (20:47) GitHub Actions REST API documentation: GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/timing reports current-cycle billable usage for private-repository GitHub-hosted runners in milliseconds, including reruns but excluding macOS/Windows multipliers and whole-minute rounding. {workflow_id} accepts a file name; the endpoint is being retired. Response HTTP 200 contains billable.UBUNTU.total_ms, billable.MACOS.total_ms, and billable.WINDOWS.total_ms.
• 🟡 (20:47) Agent review found a must-fix arbitrary-ref secret-boundary vulnerability: workflow_dispatch can select YAML from arbitrary refs, and the CI relay’s permissions: {} only removes GITHUB_TOKEN; selected-ref YAML can add ${{ secrets.* }} in .github/workflows/ci-poller-dispatch.yml:3-12. .github/workflows/cocoapods-keepalive.yml:9,18-20 is more severe because its dispatch directly exposes a production secret. Agent classified this as violating the arbitrary-ref secret boundary and issued DO-NOT-MERGE.
• 🟡 (20:47) Agent review found yarn lint fails at .github/workflows/cocoapods-keepalive.yml:1 with yml/plain-scalar; characterized as pre-existing but leaving the exact HEAD lint-red.
• 🟡 (20:47) Agent verified privileged-poller behavior: .github/workflows/ci-poller.yml:40-67 checks out the default branch before requesting either app token; .github/workflows/ci-poller-dispatch.yml:3-12 declares no credentials.
• 🟡 (20:47) Agent verified manual recovery remains unconditional through the relay’s workflow_dispatch and poller’s workflow_run gate in .github/workflows/ci-poller-dispatch.yml:3-12 and .github/workflows/ci-poller.yml:8-10,23.
• 🟡 (20:47) Agent verified repository-dispatch attempts are bounded before arithmetic and self-dispatch uses validated base-10 input in .github/workflows/ci-poller.yml:28-38,445-455.
• 🟡 (20:47) Agent verified approval protections: request-bound automated proof and direct-bot rejection in src/publish/authorize-approval.js:135-169; human requester/approver separation in src/publish/authorize-approval.js:200-210; event/digest binding in src/publish/validate-approval-attestation.js:71-100; CI-ready revalidation in .github/workflows/ci-poller.yml:130-145,266-346; and pre-Craft fencing in .github/workflows/publish.yml:197-220,328-353.
• 🟡 (20:47) Agent verified changed workflows pin actions and Craft to full immutable revisions in .github/workflows/auto-approve.yml:17-23, .github/workflows/ci-poller.yml:41-52, and .github/workflows/publish.yml:192-223,353.
• 🟡 (20:47) Test evidence: yarn test --printConsoleTrace passed with 16 files and 72 tests; git diff --check passed; yarn lint failed at the pre-existing .github/workflows/cocoapods-keepalive.yml:1 yml/plain-scalar error.