[WRONG BRANCH] security: restrict closed-PR branch cleanup to disposable namespaces

[luvs01]

Motivation

• A scheduled cleanup used closed-PR metadata to decide deletions and could remove an unrelated unprotected repository branch that shared a head name. This introduces a confused-deputy risk where PR management authority alone authorized destructive ref deletion.
• The change limits the cleanup planner so PR state cannot by itself delete arbitrary refs and confines deletion to explicitly disposable automation branches.

Description

• Added DISPOSABLE_BRANCH_PREFIXES and a new keep reason OUTSIDE_DISPOSABLE_NAMESPACE to the planner so only branches in the reserved codex/ and ingw/ namespaces are eligible. (.github/scripts/closed-pr-branch-cleanup.cjs).
• Early-return keep rule added to planClosedPrBranchDeletions to skip branches that do not start with an allowed disposable prefix and therefore never reach the deletion plan. (.github/scripts/closed-pr-branch-cleanup.cjs).
• Updated test fixtures to supply head OIDs and adjusted tests to assert SHA-aware behavior and the new namespace restriction, including a regression test that proves a persistent branch outside disposable namespaces is not deleted. (.github/scripts/closed-pr-branch-cleanup.test.cjs).
• Preserved existing safeguards (protected branch list, fork heads, open/merged PRs, base-of-open rule, grace period, and tip/sha checks) so deletion remains conservative.

Testing

• Ran node --test .github/scripts/closed-pr-branch-cleanup.test.cjs and the planner unit tests passed (12/12).
• Ran ./node_modules/.bin/bun test tests/ci-workflows.test.ts tests/repo-hygiene.test.ts and the targeted workflow/hygiene suites passed (147/147).
• Ran git diff --check with no issues detected.
• Ran PATH="$PWD/node_modules/.bin:$PATH" bun run prepush (full prepush flow); typecheck and GUI lint passed, but the full test stage exposed unrelated environment-sensitive failures (lab sandbox / proxy env) that prevented completing the full suite in this environment (warning-level).

---

Codex Task

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: bc17cba0-6ffa-4967-8c04-7841b625b9b9

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}