[zoeyrose]

Summary

Create new Sound update pull requests as drafts. The updater currently omits draft: true, so a fresh dependency PR opens as ready before independent review and required delivery checks.

Implementation / behavior

• Add draft: true only to the new-PR POST payload.
• Preserve the existing-PR PATCH payload and its review state.
• Exercise both actual shell payload branches with real jq and a fake GitHub client; verify the complete payload, title, body, target and branch.
• Preserve release verification, App ownership, narrow changed paths and branch lease checks.

Validation

• 78 focused tests passed; 3 unrelated CMake-prerequisite cases skipped.
• The new regression fails against the previous workflow.
• Imported histories, Python compilation, whitespace, actionlint and ShellCheck passed.
• Fresh-context independent review found no actionable defects; independent workflow tests also passed (57 passed, 3 environment skips).
• Required hosted CI passed on a5a2cbe5563a5917e26906d2715f5af1d68ea8ab, including Classic validation and CodeQL. The exact-head self-review receipt is posted.
• The current-head dependency-review summary reported no vulnerabilities or license issues; no dependency manifests changed.

Limitations / follow-up

This change does not delete the stale branch, run the updater, merge a PR or deploy anything. Once the owner merges this repair, the already-approved exact branch cleanup and current-main updater run can proceed, producing a draft Sound runtime PR.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Files

None

[zoeyrose]

Reviewed exact head a5a2cbe5563a5917e26906d2715f5af1d68ea8ab against base 6cacc0ddeba57f07b9ef7f8901ac9ae7ce628294.

Examined the complete two-file diff, surrounding Sound updater workflow, App token and permissions boundary, ownership and branch lease checks, new-versus-existing pull-request paths, and the executing-shell regression. Fresh-context independent reviewer classic_sound_draft_review (Sol high) found no actionable P0–P3 defects; there are no findings to fix or decline.

New PR creation sends JSON boolean draft: true. Existing PR updates still PATCH title/body only, preserving human review-state decisions. Artifact selection, verification, branch guards and runtime behavior remain unchanged.

Local validation: 81 focused workflow/Sound tests ran (78 passed; 3 unrelated CMake prerequisite skips); independent workflow validation ran 60 tests (57 passed; the same 3 environment skips). The old creation payload fails the new regression. Import-history verification (five components), Python compilation, diff whitespace, actionlint 1.7.12 and ShellCheck 0.11.0 passed. Native/hosted CI remains separately required and is not claimed by these local results.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!