🔍 Upkeep Report

[github-actions]

🔍 Upkeep Report

Generated 2026-07-16T22:10:02.083Z

The repository is in good overall health: four of six reviewers (spec_flow, visual_icon, duplicate_orphan, docs_staleness) returned zero findings, and the three findings that surfaced are all medium-to-low severity with no correctness or security impact. The top priority is the CI artifact action version split — actions/upload-artifact@v7 producers paired with actions/download-artifact@v8 consumers across the entire discovery→reviewer→synthesis→report pipeline — because it is the only issue with a potential runtime failure mode and should be realigned to a single major (then verified via a full self-audit run). The remaining two findings are low-severity documentation drifts: CONTRIBUTING.md misstates the README layout for the en locale, and CLAUDE.md points to src/report.ts instead of src/finalize.ts for the finalize helpers; both can be cleaned up together in one docs-accuracy pass.

Summary

Severity	Count
🔴 High	0
🟠 Medium	1
🟡 Low	2
Total	3

Themes

LOW — Convention docs have drifted from the repo's actual structure

Two independent reviewers (convention and code_hygiene) each surfaced a case where an authoritative in-repo convention document describes the repository inaccurately, pointing to the same root cause: the human-maintained guidance files (CLAUDE.md, .github/CONTRIBUTING.md) have not kept pace with the layout and code they document. CONTRIBUTING.md claims every locale's README lives under docs//, but the English base is the root README.md and there is no docs/en/README.md — so a contributor following it literally would look in the wrong place. Separately, CLAUDE.md tells contributors the finalize/degradation helpers (finalizeReviewerOutput, finalizeSynthesis, readJsonOrNull) live in src/report.ts, when they are actually defined in src/finalize.ts and only imported by report.ts. Both are low-severity, non-runtime documentation drifts, but they share a mechanism (guidance describing structure that has since moved) and a fix pattern (correct the doc to match on-disk reality), so they should be addressed together in a single docs-alignment pass.
Files: .github/CONTRIBUTING.md, CLAUDE.md, src/finalize.ts

MEDIUM — Artifact upload/download actions are split across major versions in the CI pipeline

A single convention finding spans all four composite actions that form the discovery→reviewer→synthesis→report handoff: every producer uploads with actions/upload-artifact@v7 while every consumer reads back with actions/download-artifact@v8. Although reported as one finding, its root cause is systemic — a uniform, pipeline-wide major-version split consistent with a partial dependency bump — and it is the only finding in this audit with a plausible runtime impact, since upload-artifact and download-artifact are versioned in lockstep and cross-major compatibility is not guaranteed. Because it can break the artifact handoff between every stage of the engine, it warrants attention ahead of the documentation drifts, and the fix (realign both paired actions to the same major everywhere, then re-run the self-audit end-to-end) touches all four action files at once.
Files: .github/actions/reviewer/action.yml, .github/actions/discovery/action.yml, .github/actions/synthesis/action.yml, .github/actions/report/action.yml

Findings

Severity	Conf	File	Category	Reviewers	Problem
medium	medium	.github/actions/reviewer/action.yml	inconsistency	convention	The paired GitHub artifact actions are on mismatched major versions across the whole pipeline: every artifact is uploaded with actions/upload-artifact@v7 but read back with actions/download-artifact@v8. upload-artifact and download-artifact are versioned in lockstep and cross-major compatibility is not guaranteed (an artifact written by one major cannot reliably be read by a different major), so this risks breaking the discovery→reviewer→synthesis→report handoff at runtime.
low	high	src/finalize.ts	inconsistency	code_hygiene	The repo convention doc (CLAUDE.md) points contributors to the wrong file for the degradation/finalize helpers. It says these helpers live in src/report.ts, but the finalize helpers (finalizeReviewerOutput, finalizeSynthesis, readJsonOrNull) are actually defined in src/finalize.ts; src/report.ts only imports and calls them.
low	medium	.github/CONTRIBUTING.md	inconsistency	convention	CONTRIBUTING.md states that user docs (including README) live under docs/<locale>/ for all five locales, but the English README is the repository-root README.md — there is no docs/en/README.md. A contributor following CONTRIBUTING literally would look for docs/en/README.md and not find it, and the stated lockstep set doesn't match the actual on-disk layout for the en base.

Full interactive HTML report: open this run → download the report-html artifact (expires 2026-10-14, ~90d).