[coretl]

Remediation of an external CI/Actions review of .github/workflows/*, assemble/assemble.mjs, test/ and the docs that describe them. Every claim was reproduced against the code before being acted on; the two findings I handled differently from the plan are called out at the bottom.

One commit per theme — reviewable in order.

Behavioural fixes

Prereleases were ranked and detected wrongly (the worst of these). isPrerelease needed the marker to follow a digit immediately, so every hyphenated semver spelling read as stable, and git tag -l --sort=-v:refname independently ranks 1.1.0-beta.1 above 1.1.0. Together: preferredVersion returned the beta, so stable/ aliased it and the root redirect pointed at it. Reproduced in a scratch repo before fixing.

• one MARKERS list covering PEP 440 and the hyphenated/dotted forms, digit-anchored (so release-1.0 stays stable) with a trailing lookahead (so 1.0-candidate does too)
• ordering moves into compareTags, so "what order" and "what counts as a prerelease" share that list instead of needing versionsort.suffix kept in step by hand
• release.yml's case globs were case-sensitive where the regex is not (1.0.0RC1 was published stable). It now uses the identical list via grep -Eqi, and test_release_prerelease.py runs 27 tag spellings through both implementations — the drift guard the "mirrors assemble.mjs" comment was standing in for
• default branch threaded through ordering (generate --default-branch), so a develop consumer is not sorted in among the pr-<n> previews

The origin verify was blind on the commonest deploy. It compared the live switcher.json with the assembled one — but that file lists only the version set, so an ordinary docs edit on the default branch reproduces it byte-for-byte and got == want on attempt 1 whether or not the origin moved. generate now also writes site/deploy-id.txt (run + attempt + UTC), which the verify polls as the primary assertion with switcher.json kept as secondary. Safe at the site root: discoverVersions returns directories only.

Three narrow gather defects, each where the comment already stated the intended rule.

• Number(values["max-releases"]) || 0 turned "3O" into 0 — i.e. unlimited — so a typo in a consumer's publish.yml silently disabled the guard against a 1 GB deploy failure. parseCap throws.
• Two "newest artifact" tie-breaks: newest() broke on id, the per-SHA index kept whatever the API returned last (page order). Both go through the one comparator now.
• Release zips were selected by asset id but downloaded by tag, so a release re-cut between listing and download would cache new bytes under the old id — the exact failure id-addressing was chosen to prevent. Fetched by asset id, with a zip-magic check, since gh api > file writes an error body before exiting non-zero.

Pages deploys queue instead of cancelling. The old cancel-in-progress: true was argued from artifact correctness, which is true and not the question: the kill lands inside deploy-pages, between upload and the backend finishing. Cost is bounded — a group holds one pending run — and stated in the comment.

base-path input so the site can be served from /. The engine resolved the Pages URL from the API precisely so a CNAME works, and the docs advertised it, but docs.yml hardcoded /<repo> — switcher links right, every page they point at 404ing its assets. New how-to.

Hardening

docs.yml interpolated contexts straight into shell. Git accepts $( ), backticks and quotes in ref names, and this is a reusable workflow: a consumer on push: branches: ['**'] hands that string to anyone who can push a branch. Values now come through env:, and the resulting name is validated against [A-Za-z0-9._-].

The general guard matters more than the fix: test_shape.py now fails on any ${{ inside any run: body, across every workflow, with no allow-list — those three lines were the only ones in the repo, so the rule starts clean. renderRedirect escapes HTML metacharacters too, since the version name it renders is validated one file away.

Also: permissions and timeout-minutes on everything (both asserted structurally — the timeout check skips uses:-only jobs, which cannot set one); actionlint pinned to 1.7.12 with a recorded SHA-256 and a Renovate custom manager; fetch-depth: 1 + fetch-tags: true for the consumer checkout, which only ever needed the tags.

Docs and comment drift

• workflows.md still described a three-rung gather ending "the current build highest" — a pre-feat!: publish on workflow_run, deleting the trampoline, shim and injection #66 survival; there is no current-build rung under workflow_run
• publish.yml claimed the local uses: means "the working tree is what gets tested". True post-merge, misleading pre-merge: GitHub runs the default branch's copy, so a PR touching the engine is never exercised by a real deploy — the harness is what covers it
• stable/ is materialised as a full copy by upload-pages-artifact --dereference, and the size report ran before the symlink existed and would not have followed it. Moved after, with du -shL, and the duplication named in keep-the-site-small.md
• documents what approving a fork preview grants: the preview runs on the org-wide ORG.github.io origin, so it is a review of the built output, not a "CI is green" check
• pr-<n> entries in the public switcher are now documented as deliberate in both the reference and CLAUDE.md, so nobody "fixes" them later

Deviations from the review's plan

• .mvs collision: documented as a reserved path rather than renamed — renaming churns the harness for a near-zero-probability clash.
• Silent truncation: added the gh pr list --limit 200 warning; skipped the artifact-pagination ceiling. Confirmed the existing "N non-expired 'docs' artifact(s)" line already counts fetched, not selected.

Not done, deliberately: replacing the stable/ copy with a redirect would avoid the duplication but breaks deep links into stable/<page> — worth an issue, not a commit here.

Verification

npm test (64 checks), npm run test:workflows (gather + shape + prerelease parity), npx prek run --all-files, actionlint clean, npm run docs strict.

New coverage: prerelease/ordering cases, parseCap rejections, tie-break stability under input reordering, renderRedirect escaping, the wedge cases against a mock origin (new mock curl), asset-id download incl. failure leaving nothing cached, malformed cap exiting non-zero, PR-list truncation, base-path composition, and the four version names that must be rejected.

🤖 Generated with Claude Code