From 23c01887cbada13ba031fbb9f05150f569ca34e4 Mon Sep 17 00:00:00 2001 From: Max Ghenis Date: Mon, 10 Aug 2026 18:31:53 -0400 Subject: [PATCH] File an issue when the scheduled zone-shell audit fails The daily production audit previously failed silently in the Actions tab. Now a scheduled-run failure opens (or bumps) a tracking issue so a zone child that stops rendering the site shell gets noticed the same day. Co-Authored-By: Claude Fable 5 --- .github/workflows/app-zone-shell-audit.yml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/.github/workflows/app-zone-shell-audit.yml b/.github/workflows/app-zone-shell-audit.yml index 4ff5d75bd..ac3891b17 100644 --- a/.github/workflows/app-zone-shell-audit.yml +++ b/.github/workflows/app-zone-shell-audit.yml @@ -15,6 +15,9 @@ jobs: audit: name: Audit PolicyEngine shell on app-zone routes runs-on: ubuntu-latest + permissions: + contents: read + issues: write steps: - uses: actions/checkout@v4 @@ -35,3 +38,21 @@ jobs: env: APP_ZONE_ALLOW_DESTINATION_FALLBACK: ${{ github.event_name == 'pull_request' && '1' || '0' }} run: node .github/scripts/audit-app-zone-shell.mjs + + - name: File or bump an issue when the scheduled audit fails + if: failure() && github.event_name == 'schedule' + env: + GH_TOKEN: ${{ github.token }} + run: | + title="Production zone-shell audit is failing" + run_url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" + existing=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open \ + --search "in:title \"$title\"" --json number --jq '.[0].number') + if [ -n "$existing" ]; then + gh issue comment "$existing" --repo "$GITHUB_REPOSITORY" \ + --body "Still failing: $run_url" + else + gh issue create --repo "$GITHUB_REPOSITORY" --title "$title" --body "The scheduled app-zone shell audit failed: $run_url + + A zone child stopped rendering the PolicyEngine site shell, or a route is down or erroring. Every embedded tool renders the shell itself (CLAUDE.md → Embedded sites → The shell rule); the child repo's own CI shell guard should catch this at PR time — fix the child and check why its guard did not." + fi