fix: prevent unsafe Safe Settings full sync

[yvonnedevlinrh]

Summary

Fixes #52

• Pin Safe Settings to the immutable commit containing the rename-race fix
• Wait for Probot 14 readiness before initializing full sync
• Preserve and test the narrow check_suite workaround
• Quote the ci label color as a string
• Preserve undeclared labels through additive configuration

How to Test

go test -race -count=1 ./config
make safe-settings-validate
make test-unit
openspec validate fix-safe-settings-full-sync --strict

## How to Demo
Run a Safe Settings dry run and confirm:

• No cross-repository renames are proposed
• Undeclared labels are not deleted
• The ci label color remains 5319e7
• Full sync initializes successfully with Probot 14

Key Files Changed

• .github/workflows/safe_settings_sync.yml — dependency pin and Probot initialization
• safe-settings/settings.yml — additive labels and quoted ci color
• safe-settings/repos/*.yml — additive repository labels
• config/workflow_test.go — workflow and workaround regression tests
• config/safe_settings_labels_test.go — label preservation tests
• openspec/changes/fix-safe-settings-full-sync/ — approved planning artifacts

This PR was generated by /uf.finale (AI-assisted).

[marcusburghardt]

PR Review: #58 — fix: prevent unsafe Safe Settings full sync

Summary

The PR correctly fixes a set of documented problems — safe-settings rename race (PR #943), Probot 14 init ordering (#955), destructive label behavior, and the unquoted ci color — with solid test coverage and appropriate planning artifacts.

Cross-Org Context

The complytime/.github repo manages the same safe-settings workflow with the same three upstream blocking issues (#955, #818, #901) but chose to stay at v2.1.18 (Probot v13). This PR takes a different approach: upgrade to v2.1.19 and work around Probot v14 with await probot.ready(). Both approaches are defensible; the upgrade resolves the name mutation issue (#901, fix PR #943 is included in v2.1.19) but requires validating the custom Probot v14 workaround via live dry-run.

Upstream issue status (verified live):

• #955 (Probot v14 null logger): open — upstream fix PR #961 not merged
• PR #1018 (check_suite crash fix): open — workaround still needed
• PR #943 (name mutation fix): merged — included in v2.1.19

Findings

Severity	Category	Finding
MEDIUM	Alignment	Version description omits concrete version number; stale v2.1.18 reference in workaround comment (line 128)
MEDIUM	Security	Probot v14 workaround needs live dry-run validation before non-dry-run use
MEDIUM	Alignment	Pinned SHA includes 3 additional upstream PRs beyond the rename-race fix (notably PR #949 octokit .rest migration)
LOW	Constitution	Missing testing.Short() guard on Node.js subprocess tests (pre-existing pattern gap)

Verdict

APPROVE — The change is correct and well-tested. Residual findings are MEDIUM-severity documentation and validation gaps. Recommend updating the stale v2.1.18 comment and performing a dry-run before non-dry-run application.

This review was generated by /uf.review-pr (AI-assisted).

[jflowers]

The PR addresses unsafe Safe Settings full-sync behavior and has passing CI with no critical or high-severity defects. Two medium concerns duplicate existing inline comments and relate to documenting the pinned upstream revision and recording a real Safe Settings dry-run validation.

This review was generated by /uf.review-pr (AI-assisted).