Skip to content

[Fleet incident] Disable orphaned bootstrap and finalizer workflow identities #847

Description

@seonghobae

Live Actions registry drift

Fresh live evidence on 2026-08-17 reports 59 workflow identities while protected default branch develop@acdbea6344fe1231c39535b575f4de35e4c607c9 contains only the current checked-in workflow YAML set. Many historical bootstrap, finalizer, diagnosis, and PR-specific registry identities remain state: active even though their .github/workflows/... source path is absent from that exact protected tree.

The same live registry snapshot also proves that GitHub-managed workflows are represented as dynamic/... paths without a separate trustworthy source field, for example:

  • dynamic/agents/anthropic-code-agent;
  • dynamic/agents/openai-code-agent;
  • dynamic/dependabot/dependabot-updates;
  • dynamic/dependabot/update-graph; and
  • dynamic/github-code-scanning/codeql.

Therefore lifecycle classification must not use workflow names, and must not trust an arbitrary auxiliary source: github field to override repository path/tree evidence. The observed dynamic/ namespace is treated separately from repository workflow paths; any other active non-repository path must fail closed unless independently proven.

Root cause / evidence boundary

Repository workflow source and the Actions registry have independent lifecycles, but absence from protected develop alone does not prove deletion from every live branch. The standalone BandScope detector intentionally does not enumerate every non-default branch. Consequently an active .github/workflows/... registry path that is absent from the exact protected tree is a lifecycle-drift candidate whose branch provenance is unproven, not yet a proven orphan.

The product/control-plane defect is therefore two-part: repository-tree cleanup was previously treated as complete registry lifecycle cleanup, while default-tree absence was also at risk of being overinterpreted as proof that no live branch still owns the workflow. Both are unsafe. File-level tests cannot establish either registry state or cross-branch provenance.

This drift leaves an inaccurate writer inventory, retains identities tied to superseded product slices, and risks disabling a still-owned branch workflow if default-tree absence is treated as sufficient authority.

Canonical BandScope implementation

PR #895 (fix/workflows): audit orphaned Actions registry identities) is the canonical BandScope-owned detector lane. Current exact PR head at this issue refresh: 460f462a8009d575f41ee6ff1f07eb9e0715ff88.

Its current implementation is read-only and exact-default-branch-bound: it paginates the full registry, binds classification to one immutable protected tree, fails closed on incomplete evidence or branch movement, distinguishes present/disabled/GitHub-dynamic/unresolved identities, and emits machine-readable pagination receipts. orphaned_deleted remains a reserved v1 schema bucket for deletion that has been independently proven; the standalone detector does not infer that state from default-tree absence.

Current regressions lock the live registry contract:

  1. a real-shaped dynamic/agents/openai-code-agent record with no source field classifies as GitHub-managed dynamic evidence;
  2. forged source: github metadata on an absent .github/workflows/deleted-repair.yml path cannot override exact path/tree authority and remains unresolved while branch provenance is unproven;
  3. an active repository workflow that is absent from develop but may still be owned by another live branch remains unresolved; and
  4. unknown active paths such as external/workflows/... remain unresolved/fail-closed.

Ownership / remediation

Do not restore deleted workflows, create a cleanup PAT, create another self-deleting cleanup workflow, or disable an identity from default-tree absence alone. Actual Actions-registry disablement is a separate authorized operator/control-plane action coordinated with central lifecycle issue ContextualWisdomLab/.github#945 and AppGuardrail detection issue ContextualWisdomLab/appguardrail#929.

For each candidate active repository-path identity, the authorized owner must independently establish that no live branch still owns the workflow source, re-resolve protected develop, refetch the exact registry record, and confirm the relevant evidence is unchanged immediately before mutation. If provenance or registry state changed, abort and re-audit rather than acting on a stale workflow ID. Before/after registry evidence must be retained.

BandScope owns the repository-specific detector and evidence only. Organization-wide inventory, cross-branch provenance, credentials, and registry mutation remain the central .github owner's authority.

Acceptance criteria

  • Complete paginated read-only detector design with exact protected-default-branch binding.
  • Adversarial coverage for incomplete pagination, count drift, branch movement, malformed/duplicate workflow identities, legitimate present bootstrap-named workflows, real GitHub dynamic/ identities, forged auxiliary source metadata, unknown active non-repository paths, and off-default branch-provenance ambiguity.
  • Standalone detector fails closed as unresolved when an active repository workflow is absent from protected develop but deletion from every live branch is unproven.
  • PR fix(workflows): audit orphaned Actions registry identities #895 unchanged exact head satisfies all applicable repository and central CI/security/coverage/review gates, with predecessor/queued/skipped/failed evidence excluded.
  • Canonical protected-base dependency-security prerequisite fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783 is integrated/revalidated where required rather than suppressed in fix(workflows): audit orphaned Actions registry identities #895.
  • Qualifying independent non-author last-push approval and ordinary branch-protection acceptance are satisfied where live policy requires them.
  • Central authorized lifecycle action independently proves branch provenance before disabling each reviewed active orphan repository-path identity or records an explicit evidence-backed exception.
  • Post-remediation live inventory proves reviewed orphan identities are disabled while current supported BandScope automation, any still-owned branch workflows, and GitHub-managed dynamic/ workflows remain intact.
  • Protected integration and post-remediation operational evidence close this issue.

This issue remains open until protected integration plus authorized registry cleanup evidence proves the product/control-plane defect is actually removed.

Metadata

Metadata

Assignees

No one assigned

    Labels

    area: accessibilityAccessibility and assistive-technology supportarea: authAuthentication, authorization, identity, or tenant isolationarea: ci-cdCI, GitHub Actions, checks, release, or supply chainarea: dependenciesDependency or lockfile maintenancepriority: mediumNormal-priority or P2 workstatus: triagedOpen issue has an organization taxonomy assignmenttype: featureNew or expanded product capability

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions