[devantler]

🤖 Generated by the Agentic Engineer

Summary

• replace KSail's reusable to-do scanner job with a repository-owned job because the shared workflow exposes no ignore input
• preserve the existing hardened runner, GitHub App project token, retry helper, issue/project behavior, and pinned scanner image
• pass the scanner's narrow ^third_party/ path filter so vendored go-archive comments cannot create KSail issues
• add a regression test that proves vendored paths match, maintained paths do not, and the ignore input reaches the scanner container

Fixes #6707.

Root cause

The scanner supports a file-path ignore expression, but devantler-tech/actions v13.2.1's reusable workflow and composite interface do not expose it. KSail therefore scanned third_party/go-archive as maintained source and opened scanner-created issues 6688–6702 from upstream comments.

This change stays downstream-only as requested; it does not alter the shared actions contract.

Verification

RED first:

• TestTODOScannerExcludesOnlyVendoredSources failed because the reusable job could not deliver a KSail-specific scanner input

GREEN on commit 8f8161fb4fb14215a3cb08278a42971f8d63ff49:

• go test ./internal/ciharness
• focused golangci-lint: 0 issues
• actionlint .github/workflows/todos.yaml
• offline zizmor .github/workflows/todos.yaml: no findings
• git diff --check

The full go test ./... run produced no failure output but did not terminate inside the bounded local window, so complete repository proof remains with required CI.

Remaining gate

Keep this draft until required CI, current-head review, and user evaluation are green. Close scanner-created issues 6688–6702 and remove their Project 5 items only after this prevention is merged and a post-merge scanner run confirms they cannot be recreated.

[github-actions]

✅MegaLinter analysis: Success

✅ Linters with no issues

actionlint, bash-exec, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_GITLEAKS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

[devantler]

Consider upstreaming filtering instead of this. That way we keep the integration pure.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

@devantler I will review the current pull request changes.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: bcc19301-3786-4381-a3cf-3287f2a9e3b9

📥 Commits

Reviewing files that changed from the base of the PR and between e0ec735 and 8f8161f.

📒 Files selected for processing (2)

• .github/workflows/todos.yaml
• internal/ciharness/todos_workflow_test.go

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (4)

Use Go 1.26.1 or newer, matching the version declared in `go.mod`.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

• internal/ciharness/todos_workflow_test.go

Generated files must not be hand-edited; run `make generate` as the canonical regeneration command.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

• internal/ciharness/todos_workflow_test.go

Validate workflow changes with `mega-linter-runner -f go`; MegaLinter runs `actionlint` for GitHub Actions workflows.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

• .github/workflows/todos.yaml

Add regression tests for confident bug fixes and run flaky-test candidates repeatedly with `go test -run -count=10 ./...`.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

• internal/ciharness/todos_workflow_test.go

🔇 Additional comments (2)

.github/workflows/todos.yaml (1)

14-108: LGTM!

internal/ciharness/todos_workflow_test.go (1)

13-71: LGTM!

---

📝 Walkthrough

Walkthrough

The todos job now runs locally on ubuntu-latest instead of using the shared reusable workflow. It preserves runner hardening, authentication, retry handling, source synchronization, scanner settings, and pinned images. It excludes paths matching ^third_party/. A regression test parses the workflow and validates the job environment, ignore pattern, scanner command, and container image.

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	❌ Error	The changes satisfy issue #6707 by excluding third_party/ paths, preserving first-party scanning and scanner controls, and adding regression coverage. Issue #6688 remains unaddressed; the PR does no…	Implement the filepath.WalkDir error-handling requirements from #6688, or remove #6688 from the linked issues if it is not part of this PR's scope.
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	The workflow and regression-test changes are within the scope of issue #6707. No unrelated code changes are present.
Title check	✅ Passed	The title clearly identifies the main CI change: excluding vendored TODO comments from scanning.
Description check	✅ Passed	The description directly explains the workflow replacement, the ^third_party/ filter, preserved behavior, regression test, verification, and linked issue.

Full details: Linked Issues check

Explanation

The changes satisfy issue #6707 by excluding third_party/ paths, preserving first-party scanning and scanner controls, and adding regression coverage. Issue #6688 remains unaddressed; the PR does not implement the required filepath.WalkDir error handling.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

Resolved CodeRabbit's Linked Issues check: issue #6707 is the sole close target. The PR body now describes scanner-created artifacts 6688 through 6702 without linking them, because their cleanup is intentionally deferred until this prevention merges and a post-merge scan proves they cannot recur.

The optional docstring warning does not require a code change: the only new function is Go's TestTODOScannerExcludesOnlyVendoredSources test entrypoint, and the repository's current-head lint and required CI are green.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

@devantler I will review the current pull request changes.

⚠️ Action not completed

Already reviewed the last commit. Use @coderabbitai full review to rerun a review of the entire changeset.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[devantler]

🤖 Generated by the Agentic Engineer

I evaluated the upstream option. The current task constraint is a KSail-only downstream repair, and the shared v13.2.1 workflow exposes no IGNORE input, so this PR intentionally keeps the change in KSail. It preserves the shared job's hardened runner, App-backed Project token, retry helper, issue behavior, and exact scanner digest while adding only the repository-specific ^third_party/ selector.

User evaluation at exact head 8f8161fb4fb14215a3cb08278a42971f8d63ff49: I exercised the real checked-in workflow through TestTODOScannerExcludesOnlyVendoredSources. The actual INPUT_IGNORE expression excluded third_party/go-archive/archive/tar/reader.go, retained internal/maintenance/todos.go, and reached the scanner container invocation; the focused test passed. A hosted write-mode run is deliberately deferred until after merge because this workflow has no safe read-only runtime surface and can create, close, assign, and board issues. That post-merge run remains the gate before cleaning up scanner-created issues 6688 through 6702.