[NSchatz]

What & why

Self-check now also runs nightly at 05:45 UTC and on workflow_dispatch, so a main that goes red without a push (a runner image, a pinned action, a date in a test) is found the next morning. push and pull_request are unchanged, and so are the job names (actionlint, scripts) and everything a pull request run checks.

• on: gains schedule: - cron: "45 5 * * *" and workflow_dispatch:. We picked minute 45 because GitHub delays scheduled runs at high load, and the start of every hour is one of those times.
• One guard, in the actionlint step. Its reviewdog reporter, github-pr-check, takes the owner and repo from the event payload. A schedule payload carries neither, so the nightly run would fail on a clean tree with POST https://api.github.com/repos///check-runs: 404 (Github-Check gives POST 404 error when used inside a cron job reviewdog/reviewdog#832 and #1263, both still open; v0.21.0, the version this action's image pins, still reads them only from the payload). Outside a pull request the step now sets reporter: github-annotations. That reporter makes no API call and writes the findings to the log as ::error annotations. Under this workflow's contents: read token, the check-run reporter already falls back to those same annotations after its check-run request is refused with a 403. Pull request runs keep github-pr-check.
• scripts needs no guard. node --test reads only the checkout (git ls-files) and temporary repositories. It already passes on push runs to main, and a scheduled or dispatched run checks out the same thing.

How it was checked

• Dispatch on this branch, green: https://github.com/cosyte/.github/actions/runs/39357698783 (workflow_dispatch, head 6985d41). Both jobs passed. The actionlint step ran with reporter: github-annotations, and scripts ran 1031 tests with 0 failures.

• The schedule case, reproduced locally. A dispatch payload includes repository, so a dispatch run cannot show the schedule failure. We ran the reviewdog v0.21.0 release binary (checksum verified) with the action's own flags against a stub API that answers like a contents: read token (403 on creating a check run, 404 on any other path), with event payloads for push, dispatch and schedule:

  event	github-pr-check	github-annotations
  push	exit 0 (403, falls back to annotations)	exit 0, no API call
  workflow_dispatch	exit 0 (403, falls back to annotations)	exit 0, no API call
  schedule	exit 1, POST /repos///check-runs: 404	exit 0, no API call

• Local gate: actionlint 1.7.12 with shellcheck 0.11.0 over every workflow, exit 0. node --test "test/*.test.mjs" on Node 24.22.0: 1031 pass, 0 fail. node scripts/check-no-emdash.mjs: OK on the tree and on the diff.

Found while doing this, not changed here

• fail_on_error: true does not fail the job. The action passes -fail-level=none (its input default) as well as -fail-on-error=true. In reviewdog v0.21.0 an explicit none is not the unset default, so failLevel() returns none and a finding exits 0 on every event. The local run above shows this: a fake actionlint finding exits 0 with every reporter and payload. Findings are annotated, but the actionlint check stays green. Setting fail_level: error would make it gate. That changes what a pull request run checks, so it belongs in its own PR.
• ci.yml's actionlint job has the same reporter. It is on by default (run-actionlint: true), and a caller whose CI runs on schedule will hit the same repos///check-runs: 404 on that job. ci.yml is out of scope for this PR, so we have not changed it.

Checklist

• The repo's gate passes locally (actionlint, node --test, no-emdash). This repo has no package.json.
• Tests cover the change: the dispatch run above and the local reproduction. No unit test was added, because the scheduled run tests this path every night.
• No .changeset/ directory and no CHANGELOG.md here: nothing to record.
• No PHI anywhere in the diff.
• One logical change per PR.

Harness-Task: 49

🤖 Generated with Claude Code