translate setup scaffolds a review workflow into every new target repo that cannot fire on the PRs it exists to review, and doctor passes the repo anyway. Five of the six in-repo templates carry the same defect; only connect-existing.md is correct.
The scaffolded workflow is also pinned to action v0.9.0 — 25 releases stale — with no permissions: and no concurrency: block.
Once scaffolded, a template is a copy that never updates, so every repo created from it carries the defect until someone hand-fixes it. This is the same shape as the v0.21.0 incident where six PRs of real translated content merged unreviewed.
Fix is one canonical template in examples/ that the generator and all five doc pages read from.
Findings covered
7 audit findings land here. F<n> are stable references into the audit; rank is the report ordering (1 = act first of 139).
Plan
Estimate 15h · Rebuilds dist-action/ no · Wave 1, PR D
F7 + F136 + F91 + F137 + F27 + F135 — one canonical workflow template in examples/, generator and five doc pages read it, @v0, permissions:, concurrency:, checkout@v7, the labeled/reopened trigger and label guard, the rebase workflow. Also lands the docs + scaffolded-workflow remnant of F127, whose silent-failure half is already fixed upstream
From the technical-debt audit of 2026-07-23 (141 candidates adversarially verified, re-validated against v0.23.0, 139 live). Effort is stopgap / full — t≈0.5h, s≈3.5h, m≈11h, L≈28h. Items marked ½ were partially addressed by v0.22.0/v0.23.0.
translate setupscaffolds a review workflow into every new target repo that cannot fire on the PRs it exists to review, anddoctorpasses the repo anyway. Five of the six in-repo templates carry the same defect; onlyconnect-existing.mdis correct.The scaffolded workflow is also pinned to action
v0.9.0— 25 releases stale — with nopermissions:and noconcurrency:block.Once scaffolded, a template is a copy that never updates, so every repo created from it carries the defect until someone hand-fixes it. This is the same shape as the v0.21.0 incident where six PRs of real translated content merged unreviewed.
Fix is one canonical template in
examples/that the generator and all five doc pages read from.Findings covered
7 audit findings land here.
F<n>are stable references into the audit; rank is the report ordering (1 = act first of 139).F7· rank 4 · high · s/s —translate setupscaffolds a review workflow that cannot fire on Action sync PRs;doctorpasses it anywayF136· rank 5 · high · s/s — Five of six in-repo review-workflow templates emit the same unfireable workflow; onlyconnect-existing.mdis correctF27· rank 22 · med · t/t —setupscaffolds every new repo pinned to actionv0.9.0— 25 releases stale — with nopermissions:/concurrency:F137· rank 23 · med · s/s — Same pin, cross-repo view: the release checklist omitssetup.tsentirely, which is why it is staleF91· rank 24 · med · s/s —setup's generated source workflow has onlytypes: [closed]— nolabeled, noissue_comment, no rebase workflowF135· rank 25 · low · t/t — The scaffolder emitsactions/checkout@v4while 19 doc snippets teach@v7F127½ · rank 122 · low · s/s — The same; the silent-failure half is fixed (acore.warningnow fires) — the remnant is docs and the scaffolded workflowPlan
Estimate 15h · Rebuilds
dist-action/no · Wave 1, PR DF7+F136+F91+F137+F27+F135— one canonical workflow template inexamples/, generator and five doc pages read it,@v0,permissions:,concurrency:,checkout@v7, thelabeled/reopenedtrigger and label guard, the rebase workflow. Also lands the docs + scaffolded-workflow remnant ofF127, whose silent-failure half is already fixed upstreamFrom the technical-debt audit of 2026-07-23 (141 candidates adversarially verified, re-validated against v0.23.0, 139 live). Effort is stopgap / full — t≈0.5h, s≈3.5h, m≈11h, L≈28h. Items marked ½ were partially addressed by v0.22.0/v0.23.0.