feat(operations): audit GitHub Actions runner assignment

[seonghobae]

Purpose

Advance #30 with read-only fail-closed evidence that distinguishes GitHub Actions runner assignment from workflow/test conclusion and from environment/dependency pre-run waits. The diagnostic never replaces or satisfies a required Check.

Fresh identity

• Base: protected main 9adb784902cae19a150146a8fadd6a0491f67814.
• Head: e8f01e7b51dfbb8c74dd145620b853e8d23ac739 on feat/actions-runner-assignment-audit.
• Direct-main Draft; current head predates fix(security): update transitive nanoid for CVE-2026-67213 #76/build(reproducibility): restack deterministic npm controls after nanoid #89 protected integration.

Test-first boundary

The evaluator/collector/CLI is bounded to selected workflow runs and fully paginated job evidence. It classifies:

• PASS: assignment evidence only;
• PENDING: no isolated runner-allocation conclusion, including environment/dependency waits; nonzero and non-passing;
• FAIL / runner_assignment_stalled: only when a queued run+job has no assignment evidence anywhere in that selected run beyond bounded grace, or evidence is malformed/stale.

The active continuation corrected a false-positive risk where environment protection or needs dependency waiting could otherwise be aged as runner starvation. No excluded waiting state becomes success.

Newly proven #89 dependency

Fresh compare proves #88 and #89 are diverged lines with merge base at protected main. They overlap two authority-bearing files:

• package.json: feat(operations): audit GitHub Actions runner assignment #88 adds operations:runner-assignment; build(reproducibility): restack deterministic npm controls after nanoid #89 establishes package-manager identity / install-script policy and related package metadata.
• CHANGELOG.md: both add distinct ## Unreleased evidence.

Therefore #88 must not be replayed/merged from its current direct-main snapshot after #89 without reconciliation. Current safe order:

#76 protected integration
→ #89 refreshed/integrated deterministic package-manager baseline
→ rebuild/refresh only #88's runner-assignment script + audit implementation/docs/tests onto that exact lineage
→ preserve #89 package metadata and accumulated CHANGELOG
→ fresh exact-head CI/reviewer/Security Scan/review evidence

This does not make #89 part of runner-assignment semantics; it prevents #88 from regressing the newer package-manager control plane.

Current exact-head evidence

For e8f01e7b51dfbb8c74dd145620b853e8d23ac739:

• application ci 31352334940: terminal failure only at inherited protected-main nanoid audit after runner assignment, install/typecheck, 65/65 files / 662/662 tests, configured statements/branches/functions/lines 100%;
• central Security Scan 31352334880: terminal success;
• reviewer-ci 31352334908: terminal success;
• formal reviews: none;
• inline review threads: none.

CI also exposes the separate unreviewed lifecycle-script authority, owned by #77/#79/#89. Current evidence disproves a present repository-wide inability to receive hosted runners, but it does not establish the historical organization billing/runner-group/enterprise-policy cause.

Operator / authority contract

npm run operations:runner-assignment requires explicit GH_TOKEN, exact repository/head and bounded selected run IDs; it reads Actions evidence only and writes a bounded audit artifact. It cannot turn queued/pending/failed CI into success, approve a PR, satisfy review, merge, release, deploy, or close #30 by existence alone.

Acceptance boundary

1. fix(security): update transitive nanoid for CVE-2026-67213 #76 integrates under actual live governance.
2. build(reproducibility): restack deterministic npm controls after nanoid #89 or an equivalent current protected package-manager baseline integrates.
3. Refresh only feat(operations): audit GitHub Actions runner assignment #88's unique operations work onto that lineage, preserving package metadata/CHANGELOG.
4. Require fresh exact-source/current-base CI, reviewer and Security evidence and current review remediation.
5. Exercise the operator against real assigned/running plus malformed/stale/dependency/protection wait cases.
6. Keep historical organization/platform cause open until authorized evidence actually identifies it.

No repair/self-modifying workflow, check replacement, audit waiver, protection weakening, synthetic approval, release or deployment authority is introduced.

Related: #27, #30, #75, #76, #77, #79, #89

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1a660a98-9cb2-4daf-9496-ac3090273690

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by dependency-ordered replacement #94. Fresh #94 head 4b3a6d7896ae1c28de02aecd2542b62b0dcd1937 is based on #91's deterministic Node/npm/install-script baseline, has exactly the same 10 runner-assignment workstream paths as #88 while reconciling package.json and CHANGELOG.md onto #91 rather than replaying stale snapshots, and has fresh terminal-success application ci run 31378206257 plus reviewer-ci run 31378206300. Central Security Scan is absent on the feature-base stack and remains non-passing defer_until_trigger; that absence is not promoted to scanner success. #94 stays Draft/dependency-gated until #91 reaches protected lineage and fresh eligible security/review evidence is reacquired. Old #88 checks/reviews do not transfer.