Daily PR/CI Summary

[github-actions]

Daily PR and CI Summary

Generated: 2026-04-06T08:44:25.018Z

PR Overview

• Open PRs (base main): 3
• Bot PRs: 1
• Human PRs: 2

Open PR List

• #59 chore(deps): bump the npm-minor-patch group with 3 updates
• #58 chore(security): daily quarantine update
• #57 chore(catalog): daily sync refresh

Failing PR Checks

• No failing checks detected on open PRs.

Failed Workflow Runs (Last 24h)

• No failed workflow runs in the last 24 hours.

This issue is updated daily by workflow automation.

[amitrintzler]

Resolved the failures reported in this summary.\n\nRoot cause\n- failed because workflow steps searched in repo, while runtime state was written under default path.\n\nFix applied\n- Commit: \n- Updated workflows to use deterministic state root in Actions: where repo-backed checks are expected.\n- Hardened report lookup to avoid hard-fail when report path is empty.\n\nFiles changed\n- \n- \n- \n\nVerification\n- Manual Daily Security run on fix commit: success\n - https://github.com/amitrintzler/skills-and-mcps/actions/runs/22480216388\n- CI on fix commit: success\n - https://github.com/amitrintzler/skills-and-mcps/actions/runs/22480213346\n- Security / CodeQL: success\n - https://github.com/amitrintzler/skills-and-mcps/actions/runs/22480213364\n- Security / SBOM + Trivy: success\n - https://github.com/amitrintzler/skills-and-mcps/actions/runs/22480213367\n\nHistorical CI failures in this issue body (JSON truncation from shared mutations) were already addressed earlier with runtime state isolation and deterministic claim verification.

[amitrintzler]

Correcting the previous comment formatting (shell escaped markdown).

Resolved the failures reported in this summary.

Root cause

• Daily Security failed because workflow steps searched data/security-reports/*/report.json in the repo workspace, while runtime state was written under default ~/.toolkit.

Fix applied

• Commit: e1cdf00
• Updated workflows to use deterministic state root in Actions: TOOLKIT_HOME=${{ github.workspace }} where repo-backed checks are expected.
• Hardened Daily Security report lookup to avoid hard-fail when report path is empty.

Files changed

• .github/workflows/daily-security.yml
• .github/workflows/catalog-sync.yml
• .github/workflows/ci.yml

Verification

• Daily Security (manual dispatch on fix commit): success
  https://github.com/amitrintzler/skills-and-mcps/actions/runs/22480216388
• CI (push on fix commit): success
  https://github.com/amitrintzler/skills-and-mcps/actions/runs/22480213346
• Security / CodeQL: success
  https://github.com/amitrintzler/skills-and-mcps/actions/runs/22480213364
• Security / SBOM + Trivy: success
  https://github.com/amitrintzler/skills-and-mcps/actions/runs/22480213367

Historical CI failures in this issue body (Unexpected end of JSON input from shared data/* mutation) were previously fixed via runtime-state isolation and deterministic claim checks.

[amitrintzler]

Closing now as repository is clean (no open PRs or active failures). Daily summary automation now auto-closes itself when clean and reopens only if actionable items return.

[amitrintzler]

Closing manually — all failures shown were from earlier today during active development. Current repo state is clean: no open PRs, no active failures.