MAINT-SW-001 — Repair CI Workflow Schema and Stale-PR Automation Permissions #290

Ownership

Maintainer-owned repository recovery task. This is not a Drips contributor issue.

• No points.
• Do not add wave-candidate or Stellar Wave.
• Do not enable automatic merging or broaden token permissions without review.

Problem

The current default-branch .github/workflows/ci.yml places an - name step outside the job's steps list, making the workflow structurally invalid.

The scheduled stale-PR workflow also failed on November 9 when it attempted to add a label and received GitHub API 403 Resource not accessible by integration.

Scope

• Correct the CI job schema and put every step under the proper steps collection.
• Add workflow syntax validation and actionlint coverage.
• Verify all action references are immutable and valid.
• Diagnose why the scheduled stale-PR workflow cannot write issue labels despite its declared permissions.
• Keep permissions minimal; do not solve this by using pull_request_target or exposing write credentials to untrusted PR code.
• Make the stale-PR workflow report permission failures clearly and avoid repeated unhandled failures.
• Revalidate the existing Wave PR guard, readiness, intake and stale-review automations together.

Acceptance criteria

• All workflow YAML parses and passes actionlint.
• CI runs on pull requests and main with stable check names.
• Stale-PR automation can perform its intended label/comment actions using an appropriately scoped token, or safely reports that the repository policy prevents the action.
• Fork PRs remain read-only.
• Wave readiness never merges PRs or activates issues.
• All required checks pass at one exact head SHA.
• Independent maintainer approval is recorded before merge.

References

• Current CI: https://github.com/DigiNodes/stellarforge-cli/blob/main/.github/workflows/ci.yml
• Failed stale-PR run: https://github.com/DigiNodes/stellarforge-cli/actions/runs/42653212552
• Existing contributor issue SW-046 — Add Smart Contract Cargo metadata conformance #148 and PR test(templates): validate generated Smart Contract Cargo metadata #289 remain separate work.

Non-goals

• CLI product feature work.
• npm publishing or credential changes.
• Drips activation, assignment or point allocation.

Audit snapshot — 2026-11-13 (pre-repair)

Verified against default branch commit 8037159101d807fadf6831a4a6dc4d3f58b6e38a:

• .github/workflows/ci.yml had the workflow-permissions audit step at job level, outside quality.steps. The push-triggered workflow run for this SHA failed without creating CI jobs.
• The Release and E2E Smoke push runs for the same SHA both failed at npm run build.
• The production build diagnostics included stale timeout outcome comparisons in src/diagnostics/docker.ts, src/diagnostics/git.ts, and src/diagnostics/rust.ts; misspelled references to BEARER_CREDENTIAL and SENSITIVE_ASSIGNMENT in src/output/redaction.ts; and a missing ./types.js import target in src/validate.ts.
• Scheduled stale-PR runs on November 11 and November 12 failed while adding the status: stale label, with GitHub API 403 Resource not accessible by integration. The workflow declares issues: write, but the effective token/repository policy still prevents the write.
• Open PR test(templates): validate generated Smart Contract Cargo metadata #289 contains some production compilation repairs, but also combines them with SW-046 — Add Smart Contract Cargo metadata conformance #148 metadata coverage and protected output-redaction changes. Its Wave PR scope and ownership check is failing; it is not a substitute for this maintainer-owned recovery task or approval to merge.

Validation snapshot — 2026-11-13

A maintainer repair was committed directly to main:

• Commit: 0c110b8bd5c07a99d601a17fef894f9568858d6c
• Change: moved the workflow-permissions audit command into quality.steps, after checkout, Node setup and npm ci.
• CI now creates all five expected jobs (Quality plus Linux Node 22/24, macOS Node 22 and Windows Node 22). The workflow-schema failure is cleared.
• The permissions audit command returned success, but inspection of scripts/audit-workflow-permissions.mjs found malformed template interpolation in normalizePerm and diagnostic messages. The success is therefore not yet trustworthy; repair the audit implementation and its tests before treating this check as valid.
• The Quality job then failed at typecheck. It reports the known production errors plus 12 test/tooling type errors. The redaction runtime bug also causes repeated failures in critical-path and deployment-security tests.
• All four platform test jobs failed; Linux Node 22 reported 64 failed tests, 1,709 passed, 9 skipped, and 12 errors. The build steps were consequently skipped.
• Release and E2E Smoke also failed on this commit. OpenSSF Scorecard passed.
• Exact commit CI run: https://github.com/DigiNodes/stellarforge-cli/actions/runs/43347506556
• Exact commit Release run: https://github.com/DigiNodes/stellarforge-cli/actions/runs/43347506574

The workflow schema is repaired, but the repository is not release-ready. Do not publish, merge PR #289, reopen completed Drips issues, or change Drips state.

Maintainer constraints

Keep this issue maintainer-owned. Do not add Drips labels/points or weaken permissions to make checks green. The stale-PR 403 still requires a repository/organization Actions-token policy or GitHub App installation-permission diagnosis; the current workflow declaration alone does not establish the effective token grant.

Follow-up repair snapshot — 2026-11-13

Additional maintainer changes on main after the initial CI schema repair:

• 8de698650b5a01a33a75c91c16035362ea44620f: stale-PR automation now catches GitHub 403 / Resource not accessible by integration write denials and emits explicit warnings rather than failing the whole scheduled job. Non-permission errors still fail normally.
• 5e9c11d310fb4dd33552b0812637e8dfcd6a6fc9 and 0a828cc1eb34432f80b72c1c3f4a71192f71d2f6: repaired malformed interpolation in the permissions audit and added explicit per-job allowlists. The first corrected audit run exposed previously hidden elevated permissions in CodeQL, Scorecard, Wave claim, Wave intake and Wave PR readiness.
• 6a8d5215bf2604251c90ca2739f1d467579d06e4, fe352e1740f7bddd9711be3a673c4c6dc7d591d4, 2cd8e6bddb28531a700043cf30e77b2100fc0d72, c3ff29045b944a69390c456bd05f2d581f878fbf, and c56832bf6158c5aa5adce882e9d496ec56910161: moved workflow write permissions from workflow-level declarations into the specific jobs that need them. The allowlist is explicit for each such job; no broad permissions were introduced.

Current default-branch head at this snapshot: c56832bf6158c5aa5adce882e9d496ec56910161.

• CI run for this exact head is pending and has not yet supplied a final quality result: https://github.com/DigiNodes/stellarforge-cli/actions/runs/43347973503
• E2E Smoke for this exact head failed at Build production CLI: https://github.com/DigiNodes/stellarforge-cli/actions/runs/43347973245
• The earlier corrected audit run correctly failed and identified the elevated permissions that needed job-level scoping. The latest head includes those scoping changes; its audit result is still pending with CI.
• The latest run of the stale-PR scheduled workflow has not been manually dispatched. Do not trigger it merely to test permissions because it may add stale labels/comments across live contributor PRs. Wait for the scheduled run and inspect its warnings/results.

The workflow permission model is now more narrowly scoped, but the effective token write grant remains unconfirmed until the scheduled stale-PR run demonstrates successful writes or the repository/organization Actions policy is inspected. The repository still has no green full validation baseline; no release, publish, PR merge, issue reopening, Drips assignment, points, or Stellar Wave activation is authorized by this repair.

Draft production recovery PR — 2026-11-13

Opened PR #297 from maint/recovery-production-build, based on the repaired workflow head. It is deliberately a draft and remains unmerged.

The PR addresses directly observed failures from CI at c56832bf6158c5aa5adce882e9d496ec56910161:

• The command classifier did not represent timed-out subprocesses even though Docker/Rust diagnostics expected timed-out; Git used the inconsistent timeout literal. Added an explicit ETIMEDOUT classification and aligned Git.
• src/output/redaction.ts declared BEARER_CREDENTIAL and SENSITIVE_ASSIGNMENT but referenced misspelled identifiers, causing a runtime ReferenceError in output redaction and deployment tests. Corrected the references.
• src/validate.ts imported a nonexistent ./types.js; the actual interfaces live in src/generator/types.ts. Corrected the import.
• Repaired test-only strict TypeScript failures in the fake signal source, exit-code parser, npm invocation assertions, npm pack dry-run handling, and audit-module declaration.

PR #297 has passed the Wave PR scope/ownership guard and Dependency Review. At last check, CodeQL, Quality, the four platform jobs and E2E smoke were still running. No merge is proposed until all required checks finish successfully on the same PR head and protected-surface review requirements are satisfied.

The current CI run on main remains failed at typecheck; the branch PR is the controlled validation path.

Validation follow-up — 2026-11-13

The draft recovery PR now has a complete green Quality job on exact head f9a635f0411194db5dba9808ecd92ae08cc70073:

• workflow permission audit: pass
• typecheck: pass
• lint: pass
• Prettier format check: pass
• full Vitest suite: pass
• production build: pass
• linked CLI E2E smoke: pass

Linux Node 22, Linux Node 24 and macOS Node 22 platform test/build jobs also pass on that exact head. Windows Node 22 is still running; do not call the baseline green until that job and CodeQL/other required checks finish successfully.

To clear the repository-wide formatting baseline, a temporary branch-restricted formatter workflow ran npm run format on maint/recovery-production-build, committed the resulting formatter-only changes, and was then removed from the branch. The temporary workflow is not present in the final PR diff.

Windows portability fixes

The previous Windows matrix run exposed cross-platform test assumptions rather than product defects:

• Documentation tests searched fenced JSON using LF-only regexes; they now accept CRLF.
• The release workflow parser did not normalize CRLF before matching job IDs.
• npm pack dry-run tests invoked npm directly, which is not a Windows executable name; they now use the repository's platform-aware npm invocation helper.

PR #289 scope separation

A maintainer REQUEST_CHANGES review was submitted to PR #289, asking the contributor to keep #148 Cargo metadata coverage/documentation and remove the overlapping production timeout/redaction/import repairs now covered by PR #297. The protected-surface review requirement remains intact. PR #289 was not merged or closed.

Stale-PR token scope follow-up

The stale-PR job now requests both issues: write and pull-requests: write at the job level, with both explicitly allowlisted in the permission audit. This reflects that the automation writes labels/comments on pull-request issue resources. It remains unconfirmed whether the earlier 403 was solely missing PR write scope or an organization/repository Actions policy restriction. The next scheduled run is the safe validation point; the workflow now reports denied writes without crashing.

No release/publish, Drips activation, points, issue assignment, or completed issue state changes were made.

Recovery PR validation complete — 2026-11-13

PR #297 is now ready for review (not merged). Exact head SHA:

38b91fd00e300efc74ae20e210fdd42fc2c835d8

All required checks passed on this exact SHA:

• actionlint workflow validation — success
• least-privilege permissions audit — success
• TypeScript typecheck — success
• ESLint — success
• Prettier format check — success
• full Vitest suite — success
• production build — success
• linked CLI E2E smoke — success
• Linux Node 22 — tests/build success
• Linux Node 24 — tests/build success
• macOS Node 22 — tests/build success
• Windows Node 22 — tests/build success
• CodeQL — success
• Dependency Review — success
• Contributor PR Guard — success

Runs:

• CI: https://github.com/DigiNodes/stellarforge-cli/actions/runs/43351345818
• CodeQL: https://github.com/DigiNodes/stellarforge-cli/actions/runs/43351345824

The PR includes the patch changeset and the latest scoped stale-PR permission allowlist/workflow change. It was moved from draft to ready-for-review. No merge or release has been performed.

Remaining gates

1. Maintainer review/approval and explicit authorization are still required before merging fix(recovery): restore production typecheck and regression baseline #297. Until merge, default branch remains at 192c8a1123a5f7572cecd1cb7bda84210325b343 and its CI still fails because it does not yet contain the production fixes in fix(recovery): restore production typecheck and regression baseline #297.
2. test(templates): validate generated Smart Contract Cargo metadata #289 is under maintainer REQUEST_CHANGES review to remove overlapping production repairs and retain the SW-046 — Add Smart Contract Cargo metadata conformance #148 metadata contribution only.
3. The stale-PR workflow now requests both issues: write and pull-requests: write in its job. The next scheduled run will determine whether this resolves the prior 403; no manual dispatch was made.
4. SW-073 — Integrate generated API Service with stellarforge test #173/SW-074 — Integrate generated Smart Contract test plan #174 remain closed with their completed Drips records preserved.
5. The next contributor batch remains a preparation task until fix(recovery): restore production typecheck and regression baseline #297 is merged and the default branch inherits the green baseline. Existing candidates SW-109 — Add npm package-files allowlist regression test #123, SW-023 — Add diagnostic stderr redaction regression suite #126, SW-029 — Add doctor summary pluralization and grammar tests #132, SW-035 — Add generator substitution allowlist negative tests #137, SW-042 — Add Basic App clean install and test smoke #144, SW-046 — Add Smart Contract Cargo metadata conformance #148 and Deploy generated Soroban contracts with a verified Wasm artifact #291–Handle API Service startup bind failures with actionable errors #296 must be deduplicated against all open issues/PRs before any new issue creation.

No Drips activation, points, issue assignment, Stellar Wave labels, PR merges, npm publishing or releases have been performed.

Contributor backlog duplicate audit — 2026-11-13

Current open Wave candidate inventory checked against the open issue list and open PR list:

• SW-109 — Add npm package-files allowlist regression test #123 — npm package files allowlist regression coverage; remains open/assigned.
• SW-023 — Add diagnostic stderr redaction regression suite #126 — diagnostic stderr redaction coverage; remains open/assigned.
• SW-029 — Add doctor summary pluralization and grammar tests #132 — doctor summary pluralization; remains open/assigned.
• SW-035 — Add generator substitution allowlist negative tests #137 — generator substitution negative tests; remains open; no GitHub assignee currently recorded.
• SW-042 — Add Basic App clean install and test smoke #144 — Basic App clean-install smoke; remains open/assigned.
• SW-046 — Add Smart Contract Cargo metadata conformance #148 — Smart Contract Cargo metadata conformance; remains open/assigned and is the subject of test(templates): validate generated Smart Contract Cargo metadata #289.
• Deploy generated Soroban contracts with a verified Wasm artifact #291 — verified Soroban Wasm artifact deployment; distinct from Fix deployment security regression boundaries #237, which changes Testnet deploy boundary/terminal redaction files only.
• Validate Full Stack template backend port as a strict TCP port #292–Handle API Service startup bind failures with actionable errors #296 — strict port validation, bounded process shutdown, Stellar endpoint validation, and startup bind failures; all remain open.

Other open PRs checked: #233/#284 are dependency updates; #228/#229/#230 are older diagnostic/unknown-command test PRs and are superseded or require separate stale-PR disposition. #237 is the deployment-security boundary PR and does not implement #291's verified Wasm artifact resolution. #297 is the recovery PR described above.

No duplicate issue was created and no existing issue was closed, reopened, assigned, relabeled, or had Drips points changed. The next contributor batch is not yet created: main must first inherit the green recovery baseline, and contributor scope/ownership for #289 and the other open PRs must be reconciled. After that, build a distinct 50–100 issue candidate set with per-repository duplicate checks before activation.

Intake automation side-effect check

Editing this maintainer issue triggered the existing Wave Intake workflow. The run completed successfully and reported reconciliation of 7 open Wave issues. I checked label events for #119, #123, #126, #132, #137, #144 and #148 for the run window; no label add/remove events were recorded. No Wave issue labels were changed by these issue edits.

Merge and default-branch verification — 2026-11-13

PR #297 was merged with squash after explicit maintainer authorization.

• PR: fix(recovery): restore production typecheck and regression baseline #297
• Merge commit / new main HEAD: dde43acaf4cfb212fb3413649efdad8b7cdd14d2
• GitHub branch lookup confirms main points to this exact commit.
• Merge commit parent: 192c8a1123a5f7572cecd1cb7bda84210325b343.

The merge-triggered default-branch workflows have started. At first post-merge inspection, all substantive checks were queued or in progress on the exact new main SHA (Quality, four platform matrix jobs, linked CLI smoke, CodeQL, Scorecard, and release-mode selection). The manual release-readiness dry-run was skipped as expected. Do not declare the default-branch baseline green until these push-triggered runs complete successfully.

The next work remains:

1. Verify all post-merge checks on dde43acaf4cfb212fb3413649efdad8b7cdd14d2.
2. Inspect the next scheduled stale-PR workflow run for actual label/comment write success or explicit permission-denial warnings.
3. Re-review test(templates): validate generated Smart Contract Cargo metadata #289 when the contributor responds; retain only the SW-046 — Add Smart Contract Cargo metadata conformance #148 Cargo metadata contribution and keep protected-surface approval requirements.
4. Reconcile SW-073 — Integrate generated API Service with stellarforge test #173/SW-074 — Integrate generated Smart Contract test plan #174 without changing their completed Drips records.
5. Only after the default-branch baseline is green, finish deduplication and prepare the next distinct contributor batch (target 50–100 issues in this repository).

No Drips points, assignments, Stellar Wave labels, issue state changes, npm publish, or release were performed.

Post-merge CI follow-up — 2026-11-13

On dde43acaf4cfb212fb3413649efdad8b7cdd14d2, the first default-branch validation update is positive but not complete:

• Quality: success.
• Linux Node 22: success.
• Linux Node 24: success.
• Linked CLI MVP smoke: success.
• macOS Node 22 and Windows Node 22: still running at last inspection.
• CodeQL and Scorecard: still running at last inspection.
• Wave intake/dependency reconciliation: success.
• Wave PR readiness, npm publication, and GitHub release publication were skipped; no package or release was published.

A separate issue surfaced in the push-triggered Release workflow's Changesets PR step. The step successfully computed version updates, then failed creating the version PR with GitHub's explicit response: GitHub Actions is not permitted to create or approve pull requests. This is a repository/organization Actions policy gate, not a build or changeset calculation failure. Do not broaden workflow permissions blindly; inspect the repository/organization setting that permits GitHub Actions to create and approve pull requests, and keep publication disabled until release readiness is separately approved.

Release workflow run: https://github.com/DigiNodes/stellarforge-cli/actions/runs/43363969838

The main validation baseline is therefore still pending completion of the cross-platform/security checks. The Changesets PR-creation permission is a separate release-automation follow-up and must not be confused with the successful Quality/build baseline.

Final default-branch baseline and policy diagnosis — 2026-11-13

Rechecked all push-triggered checks on exact main SHA dde43acaf4cfb212fb3413649efdad8b7cdd14d2:

• CI Quality: success.
• Linux Node 22 and Node 24: success.
• macOS Node 22: success.
• Windows Node 22: success.
• Linked CLI E2E smoke: success.
• CodeQL: success.
• OpenSSF Scorecard: success.

The production/test/typecheck/lint/build/cross-platform/security baseline is green on this exact default-branch commit.

Release PR creation policy

Inspected .github/workflows/release.yml. The version job already declares least-privilege contents: write and pull-requests: write; the action is using github.token. The failure is the separate repository/organization Actions policy that disallows the GITHUB_TOKEN from creating pull requests. Increasing YAML permissions will not fix that policy denial.

GitHub documents the required setting at:
Settings → Actions → General → Workflow permissions → Allow GitHub Actions to create and approve pull requests.

For an organization-owned repository, the organization Actions setting may control the inherited default; an organization/enterprise policy may prevent repository-level override. The connected GitHub read integration does not expose the Actions settings endpoint or administrative mutation, so I could not read or change the toggle. A repository/org admin must inspect it. Only enable this if the maintainers want the Changesets workflow to open its version PR automatically; it does not enable npm publishing. Publication remains separately disabled by NPM_PUBLISH_ENABLED.

Reference: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository

Stale PR automation

The merged workflow now requests both issues: write and pull-requests: write, and catches permission denials with a warning rather than failing the entire run. The workflow is scheduled daily at 06:17 UTC. No post-merge scheduled run was present in the recent Actions run listing at this inspection, so the 403 fix remains unverified in execution. Recheck after the next scheduled run; do not infer success from the YAML alone.

PR #289 and historical issues

PR #289 is still on head 10577456296cda79604fe4a66fcdb4589bfa7af4 with the maintainer's CHANGES_REQUESTED review. No contributor update was observed. The diff still includes the four overlapping production files and timeout/redaction fixes that now exist on main; contributor should narrow the PR to the Cargo metadata test/docs for #148 before it can be reconsidered.

Issues #173 and #174 remain closed (closed 2026-10-18). Their completion records are preserved; do not reopen or alter their Drips history. Their remaining implementation gaps, if pursued, require new distinct issue scopes rather than rewriting completed records.

Contributor batch gate

The main validation gate is now satisfied. The next 50–100 issue batch is not yet created because #289's overlapping PR scope remains unresolved and several open PRs still need overlap disposition. The current open issue inventory contains 15 issues, and the open PR inventory includes #289 plus dependency/security/older test PRs. Finish the PR overlap reconciliation and historical-issue dedupe before creating a large batch. No new issues or Drips changes were made in this pass.