Repository navigation
docs(maintenance): find Claude-workflow callers by inventory; keep mac-diagnostics' callers - #30
Merged
Merged
Conversation
…c-diagnostics' callers The re-tag procedure looped over a hand-written caller list, which was wrong twice (2026-10-21 "all 3 consumers"; 2026-10-23 mac-diagnostics missing). The scope check now loops over workflow-consumers.sh output, which finds callers by their uses: target and exits 2 when any repo or file was unreadable. Record the 2026-10-26 decision to keep mac-diagnostics' two callers: they have their own schedules, run green, and the orchestrator does not cover the repo, so none of the 10-21 retirement reasons applies. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Reviewer's guide (collapsed on small PRs)Reviewer's GuideUpdates MAINTENANCE.md to make reusable-workflow consumer discovery reliable and actionable through the local inventory script, including safe handling of incomplete results, and records why mac-diagnostics' two Claude workflow callers remain in service. Flow diagram for safe reusable-workflow re-taggingflowchart TD
A[Run workflow-consumers.sh] --> B{Inventory exit code}
B -->|2| C[Stop: list may be incomplete]
B -->|0| D[Read each caller permissions block]
D --> E{Every required scope count is 1?}
E -->|No| F[Do not re-tag]
E -->|Yes| G[Re-tag reusable workflow v1]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 3 issues
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="MAINTENANCE.md" line_range="67" />
<code_context>
```bash
-for r in <callers>; do gh api "repos/docdyhr/$r/contents/.github/workflows/<caller-file>.yml" --jq .content | base64 -d | grep -c '<new-scope>: read'; done
+bash ~/.claude/skills/_shared/workflow-consumers.sh docdyhr <reusable-file>.yml > /tmp/callers.txt; echo "inventory exit $?" # must be 0
+awk '$1 == "CONSUMER" {print $2, $3}' /tmp/callers.txt | while read -r r f; do
+ printf '%s %s: ' "$r" "$f"; gh api "repos/$r/contents/$f" --jq .content </dev/null | base64 -d | grep -c '<new-scope>: read'
</code_context>
<issue_to_address>
**Predictable temporary file can clobber data**
When A local attacker can create `/tmp/callers.txt` before the maintainer runs the procedure on a system that follows the symlink, the shell follows a pre-created `/tmp/callers.txt` symlink and truncates its target before running the inventory, allowing a local attacker to overwrite a file writable by the maintainer.
Create the output with `mktemp` and restrictive permissions, then use that generated path for the inventory and subsequent read.
</issue_to_address>
### Comment 2
<location path="MAINTENANCE.md" line_range="19-20" />
<code_context>
|---|---|---|
-| `claude-dependabot-merge.yml` | Headless Claude Dependabot auto-merge. Only pigame (T4) still calls it (see below) | v1 |
-| `claude-status-check.yml` | Repo health check (PRs, CI, issues, alerts, branches). Only pigame (T4) still calls it (see below) | v1 |
+| `claude-dependabot-merge.yml` | Headless Claude Dependabot auto-merge. Callers on 2026-10-26: pigame and mac-diagnostics (see below); for the current list, run the inventory under Re-tagging | v1 |
+| `claude-status-check.yml` | Repo health check (PRs, CI, issues, alerts, branches). Callers on 2026-10-26: pigame and mac-diagnostics (see below); for the current list, run the inventory under Re-tagging | v1 |
Caller templates for new consumers: `workflow-templates/`
</code_context>
<issue_to_address>
**Private repository activity disclosed**
When MAINTENANCE.md is published in a publicly readable repository, unauthenticated readers can learn the private repository’s name, its weekly workflow schedules, and that its Claude status job ran on a specific date, giving them operational details about a repository they otherwise cannot see.
Avoid naming the private repository or publishing its workflow schedule and run details in public documentation.
Also at `MAINTENANCE.md:34`.
</issue_to_address>
### Comment 3
<location path="MAINTENANCE.md" line_range="68" />
<code_context>
```bash
-for r in <callers>; do gh api "repos/docdyhr/$r/contents/.github/workflows/<caller-file>.yml" --jq .content | base64 -d | grep -c '<new-scope>: read'; done
+bash ~/.claude/skills/_shared/workflow-consumers.sh docdyhr <reusable-file>.yml > /tmp/callers.txt; echo "inventory exit $?" # must be 0
+awk '$1 == "CONSUMER" {print $2, $3}' /tmp/callers.txt | while read -r r f; do
+ printf '%s %s: ' "$r" "$f"; gh api "repos/$r/contents/$f" --jq .content </dev/null | base64 -d | grep -c '<new-scope>: read'
+done
</code_context>
<issue_to_address>
**Caller paths with spaces are truncated**
When an inventory result contains a caller workflow path with whitespace, `awk` prints the repo and path as whitespace-separated fields, and `read` splits them again, so the path is truncated before `gh api` receives it. The check targets the wrong file and cannot verify that caller's scope.
Preserve the caller path as a single value when parsing the inventory and passing it to `gh api`.
</issue_to_address>Sourcery assessment
Approval pending. 3 findings to address first.
Blocking findings: MAINTENANCE.md:67, MAINTENANCE.md:20, MAINTENANCE.md:68
|
|
||
| ```bash | ||
| for r in <callers>; do gh api "repos/docdyhr/$r/contents/.github/workflows/<caller-file>.yml" --jq .content | base64 -d | grep -c '<new-scope>: read'; done | ||
| bash ~/.claude/skills/_shared/workflow-consumers.sh docdyhr <reusable-file>.yml > /tmp/callers.txt; echo "inventory exit $?" # must be 0 |
There was a problem hiding this comment.
🟡 Medium · Predictable temporary file can clobber data
When A local attacker can create /tmp/callers.txt before the maintainer runs the procedure on a system that follows the symlink, the shell follows a pre-created /tmp/callers.txt symlink and truncates its target before running the inventory, allowing a local attacker to overwrite a file writable by the maintainer.
Create the output with mktemp and restrictive permissions, then use that generated path for the inventory and subsequent read.
Prompt for AI agents
In `MAINTENANCE.md` at line 67:
**Predictable temporary file can clobber data**
When A local attacker can create `/tmp/callers.txt` before the maintainer runs the procedure on a system that follows the symlink, the shell follows a pre-created `/tmp/callers.txt` symlink and truncates its target before running the inventory, allowing a local attacker to overwrite a file writable by the maintainer.
Create the output with `mktemp` and restrictive permissions, then use that generated path for the inventory and subsequent read.
Comment on lines
+19
to
+20
| | `claude-dependabot-merge.yml` | Headless Claude Dependabot auto-merge. Callers on 2026-10-26: pigame and mac-diagnostics (see below); for the current list, run the inventory under Re-tagging | v1 | | ||
| | `claude-status-check.yml` | Repo health check (PRs, CI, issues, alerts, branches). Callers on 2026-10-26: pigame and mac-diagnostics (see below); for the current list, run the inventory under Re-tagging | v1 | |
There was a problem hiding this comment.
🟡 Medium · Private repository activity disclosed
When MAINTENANCE.md is published in a publicly readable repository, unauthenticated readers can learn the private repository’s name, its weekly workflow schedules, and that its Claude status job ran on a specific date, giving them operational details about a repository they otherwise cannot see.
Avoid naming the private repository or publishing its workflow schedule and run details in public documentation.
Also at MAINTENANCE.md:34.
Prompt for AI agents
In `MAINTENANCE.md` at lines 19-20:
**Private repository activity disclosed**
When MAINTENANCE.md is published in a publicly readable repository, unauthenticated readers can learn the private repository’s name, its weekly workflow schedules, and that its Claude status job ran on a specific date, giving them operational details about a repository they otherwise cannot see.
Avoid naming the private repository or publishing its workflow schedule and run details in public documentation.
Also at `MAINTENANCE.md:34`.| ```bash | ||
| for r in <callers>; do gh api "repos/docdyhr/$r/contents/.github/workflows/<caller-file>.yml" --jq .content | base64 -d | grep -c '<new-scope>: read'; done | ||
| bash ~/.claude/skills/_shared/workflow-consumers.sh docdyhr <reusable-file>.yml > /tmp/callers.txt; echo "inventory exit $?" # must be 0 | ||
| awk '$1 == "CONSUMER" {print $2, $3}' /tmp/callers.txt | while read -r r f; do |
There was a problem hiding this comment.
🟡 Medium · Caller paths with spaces are truncated
When an inventory result contains a caller workflow path with whitespace, awk prints the repo and path as whitespace-separated fields, and read splits them again, so the path is truncated before gh api receives it. The check targets the wrong file and cannot verify that caller's scope.
Preserve the caller path as a single value when parsing the inventory and passing it to gh api.
Prompt for AI agents
In `MAINTENANCE.md` at line 68:
**Caller paths with spaces are truncated**
When an inventory result contains a caller workflow path with whitespace, `awk` prints the repo and path as whitespace-separated fields, and `read` splits them again, so the path is truncated before `gh api` receives it. The check targets the wrong file and cannot verify that caller's scope.
Preserve the caller path as a single value when parsing the inventory and passing it to `gh api`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
workflow-consumers.sh, not a hand-written<callers>list. The inventory finds callers by theiruses:target, so a caller saved under another file name still counts. Exit 2 means the list may be incomplete. A written list was wrong twice: on 2026-10-21 ("all 3 consumers") and on 2026-10-23, when mac-diagnostics was missing.schedule:, both run green, and the orchestrator does not cover the repo, so none of the 10-21 retirement reasons applies. The status run does real work: its Claude job ran 41 s on 2026-10-26. The merger stops at "Nothing to do" when there is no Dependabot PR.Type of change
Checklist
claude-status-check.ymlandcontents. Inventory exit 0; pigame 1, mac-diagnostics 1.Related issues
None in this repo. Follow-up to #27 (the 2026-10-21 retirement). mac-diagnostics is in neither the tier table nor the orchestrator list; whether it gets a tier is a separate decision.
🤖 Generated with Claude Code
Summary by Sourcery
Make reusable-workflow maintenance rely on caller inventory and document the retained mac-diagnostics workflows.
Bug Fixes:
Enhancements:
Documentation: