fix(operations): audit orphaned Actions workflow identities

[seonghobae]

Buyer and control-plane incident

Issue #31 proves that protected main contains four supported workflow sources while the live GitHub Actions registry reports 27 identities, including historical PR #20 repair, bootstrap, diagnosis, and finalizer paths that remain state: active after their YAML was deleted. Source deletion is therefore not complete workflow lifecycle cleanup.

This Draft begins a read-only, exact-revision lifecycle audit. It does not restore historical repair workflows, disable workflow records, add an Actions-write credential, change release blocker #17, or weaken PR #20's post-release integration gate.

Intentional RED

Exact test-only head: b50676d95f8803c556dd459e5c9899c52d8d425e
Exact protected-main parent: 2559425084389176870eac9d1a855d219bc12ce3

tests/test_actions_registry_audit.py requires the repository-owned production detector at scripts/ci/actions_registry_audit.py. Production code is intentionally absent. The focused local test was collected normally and failed only with:

AssertionError: scripts/ci/actions_registry_audit.py is not implemented

The committed design and implementation plan require:

• complete paginated workflow and open-PR inventories;
• exact protected-main and current same-repository PR-head tree authority;
• fail-closed handling of truncated trees, permission/API failure, malformed metadata, path ambiguity, duplicate IDs, collisions, and state movement;
• finite classifications for protected source, active-PR source, disabled, dynamic, orphaned, and unresolved records;
• bounded schema-v1 JSON evidence with exact workflow IDs and pagination receipts;
• an hourly/manual workflow with only actions: read, contents: read, and pull-requests: read;
• a separate authorized mutation plane for any later disablement;
• Python 3.10–3.14, exact 100% production statement/branch coverage and public docstrings;
• ADR, operability, incident, threat, test, traceability, and CHANGELOG integration.

Authority and dependency boundary

Keep Draft through RED → GREEN, exact-head hosted gates, semantic review, and protected merge policy. Protected-main integration will still be intermediate: issue #31 closes only after an authorized operator independently revalidates the exact live ledger, disables only confirmed active orphan IDs through the GitHub Actions lifecycle API, preserves ci, Hourly PR Maintenance, Hourly Product Development, and Release ThreadWeave, and records before/after evidence.

Related: ThreadWeave #31, ContextualWisdomLab/.github#945, ContextualWisdomLab/appguardrail#929.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5d0bfee7-3f90-4704-802c-e47dfbc98d1e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}