ci: extract inline scripts from all workflows into standalone testable files #755

Problem

GitHub Actions workflow YAML files should not contain inline JavaScript, Python, or PowerShell scripts. Inline scripts in workflows are:

• Untestable — no way to unit test logic embedded in YAML
• Hard to review — YAML + embedded code is noisy and error-prone
• Hard to reuse — logic locked inside a specific workflow can't be shared

This was discovered during PR #753 review, where inline JS spam-scoring logic had to be extracted into scripts/comment-moderation.mjs with its own test file.

Proposed Convention

All workflow logic should live in standalone script files with their own tests:

1. Scripts go in scripts/ (or a workflow-specific subdirectory)
2. Tests go in test/ following existing vitest patterns
3. Workflows use run: node scripts/my-script.mjs instead of actions/github-script with inline code
4. Context is passed via environment variables (GITHUB_TOKEN, event data, etc.)

Scope

Audit all existing workflows in .github/workflows/ for inline scripts:

• squad-comment-moderation.yml — partially extracted (PR feat(ci): automated comment spam protection — block spam accounts and auto-moderate PR comments #753 in progress)
• squad-pr-readiness.yml — has inline JS in actions/github-script
• squad-ci.yml — check for inline scripts
• Any other workflows with embedded code

Acceptance Criteria

• Zero inline script: blocks in workflow YAML files
• All extracted scripts have corresponding test files
• Workflows pass context via env vars, call scripts via run:
• Existing CI behavior unchanged (no regressions)

References

• PR feat(ci): automated comment spam protection — block spam accounts and auto-moderate PR comments #753: First extraction (comment moderation scoring)
• PR feat(ci): automated PR readiness checks — contributor feedback before review #752: PR readiness checks (still has inline JS)
• Issue docs: document changeset branch hygiene — prevent cross-PR changeset leaks #754: Changeset hygiene docs (related PR scope concern)