feat: add Yunxiao sync preflight

[shinetata]

Summary

• Add a manual, read-only GitHub Actions preflight for Yunxiao Projex.
• Validate the configured PAT, target project, requirement type, default assignee 孙起, workflow statuses, and priority 中 before any sync write path is introduced.
• Add focused tests for documented Yunxiao response shapes and ensure the workflow cannot create or update Yunxiao work items.

Safety

• Only workflow_dispatch is enabled; no Issue or PR event triggers exist yet.
• The PAT is scoped to the Python preflight step and is never logged.
• This PR contains no create, update, or backfill operation. Those require a separate confirmation after preflight succeeds.

Verification

• uv run --no-project --with pytest pytest tests/test_yunxiao_github_sync.py -q
• uv run --no-project --with ruff ruff check --no-fix scripts/yunxiao_github_sync.py tests/test_yunxiao_github_sync.py
• uv run --no-project --with ruff ruff format --check scripts/yunxiao_github_sync.py tests/test_yunxiao_github_sync.py

Made with Proma · GitHub

[Memtensor-AI]

🤖 Open Code Review

Target: PR #2159
Task: 683b0d413c8305f7
Base: main
Head: feat/yunxiao-github-sync-preflight

🔍 OpenCodeReview found 7 issue(s) in this PR.

⚠️ 1 warning(s) occurred during review.

---

1. tests/test_yunxiao_github_sync.py (L11-L13)

Using assert for runtime validation of external conditions (file existence, loader availability) is fragile: assertions are stripped under python -O, causing a confusing AttributeError on SPEC.loader.exec_module(MODULE) instead of a clear error. Use an explicit guard:

if SPEC is None or SPEC.loader is None:
    raise ImportError(f"Cannot load module from {MODULE_PATH}")

---

2. tests/test_yunxiao_github_sync.py (L190-L199)

Raw substring checks on YAML text are unreliable: a commented-out line such as # pull_request_target: or a string value containing preflight would satisfy the assertion even if the actual YAML structure is broken or the key is absent. Consider parsing with yaml.safe_load and asserting on the parsed structure for keys like on, permissions, and jobs that are critical to correctness.

---

3. .github/workflows/yunxiao-github-sync.yml (L58-L62)

Script injection risk: ${{ inputs.mode }} and ${{ inputs.apply }} are interpolated directly into the shell run: block. Although workflow_dispatch inputs come from authenticated users rather than untrusted PR contributors, a value containing shell metacharacters (e.g. ; rm -rf /) would still be executed. Pass them through environment variables instead:

env:
  INPUT_MODE: ${{ inputs.mode }}
  INPUT_APPLY: ${{ inputs.apply }}
  YUNXIAO_TOKEN: ${{ secrets.YUNXIAO_TOKEN }}
  GH_TOKEN: ${{ github.token }}
run: |
  if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ]; then
    ARGS="--mode $INPUT_MODE"
    if [ "$INPUT_MODE" = "backfill" ] && [ "$INPUT_APPLY" != "true" ]; then
      ARGS="$ARGS --dry-run"
    fi

---

4. .github/workflows/yunxiao-github-sync.yml (L6-L7)

pull_request_target runs in the base-branch context with access to repository secrets. The current checkout uses ref: ${{ github.event.repository.default_branch }} (base branch), which is safe. However, there is no guard preventing a future change from switching the ref to github.event.pull_request.head.sha, which would execute untrusted contributor code with secret access. Add a comment explicitly documenting why the base-branch ref must never be changed to the PR head, to prevent accidental regression.

---

5. .github/workflows/yunxiao-github-sync.yml (L24-L27)

Permissions are declared at the workflow level rather than the job level. Any future job added to this workflow will silently inherit all three permissions. Move the permissions block under jobs.sync for tighter scoping. Additionally, contents: read is not used by the sync script (which reads GitHub data via the API using GH_TOKEN, not via git), so it can be dropped entirely.

---

6. .github/workflows/yunxiao-github-sync.yml (L33-L37)

Internal organizational identifiers (YUNXIAO_PROJECT_ID, assignee name, project name) are hardcoded in plaintext in a public workflow file. These should be stored as repository variables and referenced via ${{ vars.YUNXIAO_PROJECT_ID }} etc., to avoid exposing internal project structure and to allow reconfiguration without a code change.

---

7. .github/workflows/yunxiao-github-sync.yml (L53-L57)

No shell: bash is specified for this multi-line run: block. On ubuntu-latest this defaults to bash, but explicit declaration is a best practice for portability and clarity, especially if the workflow is ever adapted for Windows or self-hosted runners.

      - name: Run sync
        shell: bash
        env:

---

🧹 Filtered 6 low-confidence OCR finding(s) before posting/fix-loop (existing_code_mismatch: 6).

Generated by cloud-assistant via Open Code Review.

[Memtensor-AI]

✅ Automated Test Results: PASSED

All tests passed (7/7 executed). memos_github_open_source/smoke: 1/1, memos_python_core/changed-repo-python: 6/6. Duration: 2s [advisory, non-gating] AI-generated tests on branch test/auto-gen-daae1cc2d1e8b904-20260725140107: 181/181 passed — these do NOT affect the PR verdict; review the branch manually.

Branch: feat/yunxiao-github-sync-preflight

[Memtensor-AI]

✅ Automated Test Results: PASSED

All tests passed (8/8 executed). memos_github_open_source/smoke: 1/1, memos_python_core/changed-repo-python: 7/7. Duration: 2s

Branch: feat/yunxiao-github-sync-preflight

[Memtensor-AI]

✅ Automated Test Results: PASSED

All tests passed (8/8 executed). memos_github_open_source/smoke: 1/1, memos_python_core/changed-repo-python: 7/7. Duration: 2s

Branch: feat/yunxiao-github-sync-preflight