Distillation

Date: Sep 8, 2026

• 🔴 [enforced-workflow] (20:32) User directed that GitHub Actions REST API workflow_id be replaced with the workflow file name; GitHub endpoints accept a workflow file name such as main.yaml in place of the numeric workflow ID.
• 🟡 (20:32) Assistant identified a MUST-FIX security issue: workflow_dispatch in .github/workflows/ci-poller.yml:6 can execute a user-selected workflow ref before the default-branch checkout. The workflow has no ref restriction at :24; checkout at :41-46 only replaces the worktree before token use at :51-68, so a modified dispatched workflow could relocate credential use before checkout.
• 🟡 (20:32) Assistant identified a MUST-FIX input-validation issue: .github/workflows/ci-poller.yml:35 accepts ATTEMPT=09, but :448 performs Bash arithmetic after app tokens are minted at :51-68; ATTEMPT=09; attempt=$((ATTEMPT + 1)) exits with “value too great for base.” Recommended requiring canonical base-10 input and applying bounds before minting tokens.
• 🟡 (20:32) Assistant recorded a lint concern: yarn lint fails because unchanged .github/workflows/cocoapods-keepalive.yml:1 violates yml/plain-scalar.
• 🟡 (20:32) Assistant passed supply-chain pinning review: all workflow uses: actions are SHA-pinned; Craft remains digest-pinned at .github/workflows/publish.yml:352.
• 🟡 (20:32) Assistant passed automated-approval review: approval requires both an Internal App label event and matching github-actions[bot] request proof in src/publish/authorize-approval.js:135-171; direct release bots fail closed in src/modules/approval-authorizer.js:39-45; human requester self-approval fails in src/publish/authorize-approval.js:202-210.
• 🟡 (20:32) Assistant passed approval-attestation review: approval, event, CI-ready actor, title, and request digest are bound and revalidated through CI-ready and immediately before Craft in src/modules/approval-attestation.js:176-241, .github/workflows/ci-poller.yml:114-145,267-347, and .github/workflows/publish.yml:327-350.
• 🟡 (20:32) Assistant passed cleanup review: failure/cancellation removes the accepted label/state in .github/workflows/publish.yml:408-413 and src/modules/update-issue.js:62-80.
• 🟡 (20:32) Test/evidence results: yarn test --printConsoleTrace passed across 16 files and 71 tests; git diff --check passed; yarn lint failed on the noted YAML scalar violation.
• 🟡 (20:32) Assistant concluded DO-NOT-MERGE due to the two MUST-FIX issues and unresolved lint failure.