fix(scheduler): isolate central Actions inventory quota

.github/workflows/exact-artifact-sbom-attestation.yml

@@ -334,13 +334,13 @@ jobs:
           EOF
           {
             printf '\n## Exact signed identity\n\n'
-            printf -- '- Source repository: `%s`\n' "$SOURCE_REPOSITORY"
-            printf -- '- Source SHA: `%s`\n' "$SOURCE_SHA"
-            printf -- '- Signer repository: `%s`\n' "$SIGNER_REPOSITORY"
-            printf -- '- Signer workflow: `%s`\n' "$signer_workflow"
-            printf -- '- Predicate type: `%s`\n' "$PREDICATE_TYPE"
-            printf -- '- Wheel: `%s`\n' "$WHEEL_FILENAME"
-            printf -- '- Source distribution: `%s`\n' "$SDIST_FILENAME"
+            printf -- "- Source repository: \`%s\`\n" "$SOURCE_REPOSITORY"
+            printf -- "- Source SHA: \`%s\`\n" "$SOURCE_SHA"
+            printf -- "- Signer repository: \`%s\`\n" "$SIGNER_REPOSITORY"
+            printf -- "- Signer workflow: \`%s\`\n" "$signer_workflow"
+            printf -- "- Predicate type: \`%s\`\n" "$PREDICATE_TYPE"
+            printf -- "- Wheel: \`%s\`\n" "$WHEEL_FILENAME"
+            printf -- "- Source distribution: \`%s\`\n" "$SDIST_FILENAME"
             cat <<EOF
 
           ## Online verification commands
@@ -382,11 +382,14 @@ jobs:
           } >> offline-attestation-evidence/README.md
           (
             cd offline-attestation-evidence
+            evidence_file_list="$(mktemp "${RUNNER_TEMP}/offline-attestation-files.XXXXXX")"
             LC_ALL=C find . -maxdepth 1 -type f ! -name SHA256SUMS -printf '%f\n' \
-              | LC_ALL=C sort \
-              | while IFS= read -r evidence_file; do
-                  sha256sum "$evidence_file"
-                done > SHA256SUMS
+              | LC_ALL=C sort > "$evidence_file_list"
+            mapfile -t evidence_files < "$evidence_file_list"
+            rm -f "$evidence_file_list"
+            for evidence_file in "${evidence_files[@]}"; do
+              sha256sum "$evidence_file"
+            done > SHA256SUMS
           )
           chmod 0444 \
             offline-attestation-evidence/README.md \

.github/workflows/opencode-review-dispatch.yml

@@ -962,9 +962,11 @@ jobs:
           }
 
           append_command() {
-            printf '$ ' >>"$summary_file"
-            printf '%q ' "$@" >>"$summary_file"
-            printf '\n' >>"$summary_file"
+            {
+              printf '$ '
+              printf '%q ' "$@"
+              printf '\n'
+            } >>"$summary_file"
           }
 
           emit_captured_log() {
@@ -1237,13 +1239,17 @@ jobs:
                       --command-json "$configured_command_json"
                 done <<<"$configured_commands_json"
             else
+              # The child shell expands its own cwd and PYTHONPATH.
+              # shellcheck disable=SC2016
               run_and_capture "Python coverage with missing-line report (${project_dir})" \
                 bash -c 'cd "$1" && PYTHONPATH="$([ -d src ] && printf src:. || printf .)" python3 -m coverage run -m pytest tests && python3 -m coverage report --show-missing' bash "$project_dir"
             fi
             done < <(tracked_python_projects_with_tests)
 
             if [ "$measured_projects" -eq 0 ]; then
               if has_tracked_files '*.py'; then
+                # The child shell resolves the checked-out source layout.
+                # shellcheck disable=SC2016
                 run_and_capture "Python coverage with missing-line report" \
                   bash -c 'PYTHONPATH="$([ -d src ] && printf src:. || printf .)" python3 -m coverage run -m pytest && python3 -m coverage report --show-missing'
               elif python3 -I -c 'import pytest_cov' >/dev/null 2>&1; then
@@ -1395,6 +1401,8 @@ jobs:
             while IFS= read -r project_dir; do
               if [ -f "${project_dir}/tests/test_docstrings.py" ]; then
                 measured_projects=1
+                # The child shell expands its own positional cwd.
+                # shellcheck disable=SC2016
                 run_and_capture "Python docstring coverage (${project_dir})" \
                   bash -c 'cd "$1" && PYTHONPATH="$([ -d src ] && printf src:. || printf .)" python3 -m pytest tests/test_docstrings.py' bash "$project_dir"
               fi
@@ -1764,20 +1772,26 @@ jobs:
                 if [ -n "$package_name" ] && jq -e '.workspaces // empty' package.json >/dev/null 2>&1; then
                   run_and_capture "Tauri frontendDist build (${package_dir})" corepack npm run build --workspace "$package_name"
                 else
+                  # The child shell expands its own positional cwd.
+                  # shellcheck disable=SC2016
                   run_and_capture "Tauri frontendDist build (${package_dir})" bash -c 'cd "$1" && corepack npm run build' bash "$package_dir"
                 fi
                 ;;
               pnpm)
                 if [ -n "$package_name" ] && [ -f pnpm-workspace.yaml ]; then
                   run_and_capture "Tauri frontendDist build (${package_dir})" corepack pnpm --filter "$package_name" run build
                 else
+                  # The child shell expands its own positional cwd.
+                  # shellcheck disable=SC2016
                   run_and_capture "Tauri frontendDist build (${package_dir})" bash -c 'cd "$1" && corepack pnpm run build' bash "$package_dir"
                 fi
                 ;;
               yarn)
                 if [ -n "$package_name" ] && jq -e '.workspaces // empty' package.json >/dev/null 2>&1; then
                   run_and_capture "Tauri frontendDist build (${package_dir})" yarn workspace "$package_name" build
                 else
+                  # The child shell expands its own positional cwd.
+                  # shellcheck disable=SC2016
                   run_and_capture "Tauri frontendDist build (${package_dir})" bash -c 'cd "$1" && yarn build' bash "$package_dir"
                 fi
                 ;;
@@ -1894,8 +1908,14 @@ jobs:
             # coverage command still runs and reports any uncovered GPU lines
             # exactly as before, so Rust repositories without GPU code are
             # unaffected and no gate is weakened.
-            if ls /usr/share/vulkan/icd.d/lvp_icd*.json >/dev/null 2>&1; then
-              lvp_icd="$(ls /usr/share/vulkan/icd.d/lvp_icd*.json | head -n1)"
+            lvp_icd=""
+            for candidate in /usr/share/vulkan/icd.d/lvp_icd*.json; do
+              if [ -f "$candidate" ]; then
+                lvp_icd="$candidate"
+                break
+              fi
+            done
+            if [ -n "$lvp_icd" ]; then
               export VK_ICD_FILENAMES="$lvp_icd"
               export VK_DRIVER_FILES="$lvp_icd"
               export WGPU_BACKEND=vulkan
@@ -3065,12 +3085,17 @@ jobs:
               language_signal="Match changed prose"
             fi
 
+            # Markdown backticks are literal; the format argument is intentional.
+            # shellcheck disable=SC2016
             printf -- '- Preferred review language: `%s`\n' "$language_signal"
             printf -- '- Rule: write human-readable review prose in the preferred language; keep file paths, identifiers, logs, quoted source, error text, and protocol literals unchanged.\n'
+            # shellcheck disable=SC2016
             printf -- '- PR title: `%s`\n' "$(printf '%s' "$title" | tr '\r\n`' '   ' | cut -c 1-240)"
             if [ -n "$body" ]; then
+              # shellcheck disable=SC2016
               printf -- '- PR body excerpt: `%s`\n' "$(printf '%s' "$body" | tr '\r\n`' '   ' | cut -c 1-360)"
             else
+              # shellcheck disable=SC2016
               printf -- '- PR body excerpt: `[empty]`\n'
             fi
           }
@@ -3350,6 +3375,8 @@ jobs:
             shift
 
             if ! git -C "$OPENCODE_SOURCE_WORKDIR" diff "$@"; then
+              # Markdown backticks are literal; the format arguments are intentional.
+              # shellcheck disable=SC2016
               printf 'Unable to collect %s from `%s` to `%s`; continue review from available changed-file evidence and direct file inspection.\n' "$description" "$PR_MERGE_BASE" "$PR_HEAD_SHA"
             fi
           }
@@ -3360,12 +3387,14 @@ jobs:
             printf -- "- Base SHA: \`%s\`\n" "$PR_BASE_SHA"
             printf -- "- Head SHA: \`%s\`\n\n" "$PR_HEAD_SHA"
             if ! PR_MERGE_BASE="$(git -C "$OPENCODE_SOURCE_WORKDIR" merge-base "$PR_BASE_SHA" "$PR_HEAD_SHA")"; then
+              # shellcheck disable=SC2016
               printf 'Merge-base discovery failed for `%s` and `%s`; falling back to base SHA for bounded diff evidence.\n\n' "$PR_BASE_SHA" "$PR_HEAD_SHA"
               PR_MERGE_BASE="$PR_BASE_SHA"
             fi
             printf -- "- Merge base SHA: \`%s\`\n\n" "$PR_MERGE_BASE"
             printf '## Current-head authority order\n\n'
             printf 'Treat current-head sections in this file as authoritative for this run: Other unresolved review thread evidence, Failed GitHub Check evidence, Coverage execution evidence, Changed files, and Focused changed hunks.\n'
+            # shellcheck disable=SC2016
             printf 'All PR reviews and comments evidence is historical context only and may contain stale bot conclusions. Do not infer active failed checks, unresolved threads, or missing changed files from those comments unless current-head evidence corroborates the same claim for Head SHA `%s`.\n\n' "$PR_HEAD_SHA"
             if ! git -C "$OPENCODE_SOURCE_WORKDIR" diff --name-only --find-renames "$PR_MERGE_BASE" "$PR_HEAD_SHA" |
               awk 'NF > 0 && $0 !~ /^\// && $0 !~ /(^|\/)\.\.($|\/)/ { print }' >"$OPENCODE_CHANGED_FILES_FILE"; then
@@ -4377,6 +4406,8 @@ jobs:
               "$@"
           }
 
+          # jq expands its own variables inside this literal program.
+          # shellcheck disable=SC2016
           self_check_filter='
             def self_check:
               (.name // "") as $n
@@ -5044,6 +5075,8 @@ jobs:
             if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
               {
                 printf '## OpenCode %s review body\n\n' "$event"
+                # Markdown backticks are literal; the format argument is intentional.
+                # shellcheck disable=SC2016
                 printf -- '- Head SHA: `%s`\n' "$HEAD_SHA"
                 printf -- '- Workflow run: %s\n' "$RUN_ID"
                 printf -- '- Workflow attempt: %s\n\n' "$RUN_ATTEMPT"
@@ -5398,6 +5431,8 @@ jobs:
               printf '## Summary\n\n'
               printf '%s\n\n' "$summary"
               printf '## Adversarial validation\n\n'
+              # Markdown fences are literal; the format argument is intentional.
+              # shellcheck disable=SC2016
               printf '```json\n%s\n```\n\n' "$adversarial_evidence"
               printf -- '- Result: REQUEST_CHANGES\n'
               printf -- '- Reason: %s\n\n' "$reason"
@@ -6195,6 +6230,8 @@ jobs:
 
             case "$mode" in
               failed)
+                # jq expands its own variables inside this literal program.
+                # shellcheck disable=SC2016
                 jq_filter='
                   [.[].check_runs[]?]
                   | sort_by((.started_at // .completed_at // .created_at // ""), (.id // 0))
@@ -6211,6 +6248,8 @@ jobs:
                 '
                 ;;
               pending)
+                # jq expands its own variables inside this literal program.
+                # shellcheck disable=SC2016
                 jq_filter='
                   [.[].check_runs[]?]
                   | sort_by((.started_at // .completed_at // .created_at // ""), (.id // 0))
@@ -6275,6 +6314,8 @@ jobs:
             local owner="${GH_REPOSITORY%%/*}"
             local name="${GH_REPOSITORY#*/}"
 
+            # GraphQL variables are expanded by GitHub, not Bash.
+            # shellcheck disable=SC2016
             timeout "$(check_lookup_api_timeout_seconds)s" gh api graphql \
               -f owner="$owner" \
               -f name="$name" \
@@ -6428,6 +6469,8 @@ jobs:
             commit_check_runs_file="$(mktemp)"
             filtered_rollup_file="$(mktemp)"
             successful_check_names_file="$(mktemp)"
+            # GraphQL variables are expanded by GitHub, not Bash.
+            # shellcheck disable=SC2016
             if ! pr_node_id="$(timeout "$(check_lookup_api_timeout_seconds)s" gh api graphql \
               -f owner="$owner" \
               -f name="$name" \
@@ -6871,6 +6914,8 @@ jobs:
             head_ref="$(printf '%s\n' "$pr_json" | jq -r '.headRefName // empty')"
             [ -n "$head_ref" ] || return 1
             lookup_error_file="$(mktemp)"
+            # jq expands its own variables inside this literal program.
+            # shellcheck disable=SC2016
             if ! GH_TOKEN="$scan_token" timeout "$(check_lookup_api_timeout_seconds)s" \
               gh api -X GET "repos/${GH_REPOSITORY}/code-scanning/alerts" \
                 -f "ref=refs/heads/${head_ref}" \
@@ -6938,6 +6983,8 @@ jobs:
                 printf 'OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.\n\n'
                 printf '## Findings\n\n'
                 printf '### 1. HIGH Current-head GitHub Checks - Fix failed required checks before approval\n'
+                # Markdown backticks are literal; the format argument is intentional.
+                # shellcheck disable=SC2016
                 printf -- '- Problem: Failed same-head checks remain for `%s`.\n' "$HEAD_SHA"
                 printf -- '- Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.\n'
                 printf -- '- Fix: Read and fix the failed check logs below, then rerun the current-head checks.\n'
@@ -6994,10 +7041,14 @@ jobs:
               if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
                 {
                   printf '## OpenCode required check satisfied by existing same-head approval\n\n'
+                  # Markdown backticks are literal in these format strings.
+                  # shellcheck disable=SC2016
                   printf -- '- Result: `EXISTING_CURRENT_HEAD_APPROVAL`\n'
+                  # shellcheck disable=SC2016
                   printf -- '- Head SHA: `%s`\n' "$HEAD_SHA"
                   printf -- '- Workflow run: %s\n' "$RUN_ID"
                   printf -- '- Workflow attempt: %s\n' "$RUN_ATTEMPT"
+                  # shellcheck disable=SC2016
                   printf -- '- Model-pool outcome: `%s`\n' "${OPENCODE_MODEL_POOL_OUTCOME:-unknown}"
                   printf -- '- Reason: a prior real-model OpenCode APPROVED review with passed structured adversarial probes already targets this exact head, and the fallback rechecked coverage, peer checks, code-scanning alerts, and unresolved review threads before accepting it.\n'
                   printf -- '- Review state: unchanged; no duplicate APPROVE review was posted from model-output-unavailable evidence.\n\n'
@@ -7702,6 +7753,7 @@ jobs:
           SCHEDULER_ACTIONS_TOKEN: ${{ github.token }}
           SCHEDULER_READ_TOKEN: ${{ (github.event_name == 'pull_request_target' || needs.validate-pr-metadata.outputs.target_repository == github.repository) && github.token || secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token }}
           SCHEDULER_MUTATION_TOKEN_SOURCE: ${{ secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || steps.opencode_app_token.outputs.available == 'true' && 'opencode-app' || 'github-token' }}
+          SCHEDULER_WORKFLOW_TOKEN: ${{ github.token }}
           GH_REPOSITORY: ${{ needs.validate-pr-metadata.outputs.target_repository }}
           PR_BASE_REF: ${{ needs.validate-pr-metadata.outputs.base_ref }}
           PR_NUMBER: ${{ needs.validate-pr-metadata.outputs.pr_number }}

.github/workflows/pr-review-autofix.yml

@@ -551,8 +551,27 @@ jobs:
           if [ "${#changed_python_files[@]}" -gt 0 ]; then
             python3 -m py_compile "${changed_python_files[@]}"
           fi
-          if [ "${#changed_workflows[@]}" -gt 0 ] && command -v actionlint >/dev/null 2>&1; then
-            actionlint "${changed_workflows[@]}"
+          if [ "${#changed_workflows[@]}" -gt 0 ]; then
+            actionlint_archive="${RUNNER_TEMP}/actionlint.tar.gz"
+            actionlint_path="${RUNNER_TEMP}/actionlint"
+            shfmt_path="${RUNNER_TEMP}/shfmt"
+            curl -fsSL \
+              -o "$actionlint_archive" \
+              https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz
+            printf '%s  %s\n' \
+              '8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8' \
+              "$actionlint_archive" | sha256sum -c -
+            tar -xzf "$actionlint_archive" -C "$RUNNER_TEMP" actionlint
+            curl -fsSL \
+              -o "$shfmt_path" \
+              https://github.com/mvdan/sh/releases/download/v3.13.1/shfmt_v3.13.1_linux_amd64
+            printf '%s  %s\n' \
+              'fb096c5d1ac6beabbdbaa2874d025badb03ee07929f0c9ff67563ce8c75398b1' \
+              "$shfmt_path" | sha256sum -c -
+            chmod 0755 "$actionlint_path" "$shfmt_path"
+            PATH="${RUNNER_TEMP}:${PATH}" \
+              ruby "$GITHUB_WORKSPACE/trusted-autofix-source/scripts/ci/lint_github_workflows.rb" \
+              "${changed_workflows[@]}"
           fi
 
       - name: Commit and push autofix

.github/workflows/pr-review-merge-scheduler.yml

@@ -496,6 +496,7 @@ jobs:
           SCHEDULER_DISPATCH_TOKEN: ${{ github.token }}
           SCHEDULER_READ_TOKEN: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.target_repository != '' && github.event.client_payload.target_repository != github.repository && (secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.scheduler_app_token.outputs.token) || github.token }}
           SCHEDULER_MUTATION_TOKEN_SOURCE: ${{ secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || steps.scheduler_app_token.outputs.available == 'true' && 'opencode-app' || 'github-token' }}
+          SCHEDULER_WORKFLOW_TOKEN: ${{ github.token }}
           SCHEDULER_REQUIRED_WORKFLOW_REPOSITORY: ContextualWisdomLab/.github
           SCHEDULER_ALLOW_CROSS_REPO_REPOSITORY_DISPATCH: ${{ (secrets.PR_REVIEW_MERGE_TOKEN != '' || secrets.OPENCODE_APPROVE_TOKEN != '') && 'true' || 'false' }}
         run: |