ci.yml holds machine-specific-paths alone at c2654182 while its other sixteen ci-workflows references sit at the v0.19.0 wave tag. This issue tracks closing that gap once the detector can tell a machine-specific path from a description of one.
Upstream report: melodic-software/ci-workflows#549.
Why the pin is held
At the wave tag the action detects five classes, and on this repository all five fire on content that is not a machine-specific path: 40 hits across 22 files in ten plugins. Every one is prose naming the form the surrounding code parses, a published CHANGELOG entry, or a fixture whose assertion subject is the path.
| Class |
Hits |
Files |
| Windows user path |
6 |
5 |
| macOS user path |
4 |
4 |
| Linux user path |
3 |
2 |
| Windows repo path |
22 |
17 |
| Escaped Windows repo path |
5 |
3 |
The 22 files:
plugins/ai-slop/skills/audit/scripts/detect.sh
plugins/claude-config/CHANGELOG.md
plugins/claude-config/lib/state-key.test.sh
plugins/claude-ops/skills/plugins/context/gotchas.md
plugins/claude-ops/skills/plugins/scripts/fleet-state.sh
plugins/disk-hygiene/skills/clean/evals/evals.json
plugins/disk-hygiene/skills/clean/scripts/test_guard_launch_monitor.py
plugins/disk-hygiene/skills/clean/scripts/ (the clean module and its test module, 2 files)
plugins/guardrails/CHANGELOG.md
plugins/knowledge/skills/video-digest/extraction/lib/run-args.test.js
plugins/machine-health/skills/audit/tests/windows/lib/ConvertFrom-Jsonc.Tests.ps1
plugins/markdown-format/hooks/markdown-format.sh
plugins/repo-fleet-hygiene/skills/audit/scripts/audit-fleet.sh
plugins/repo-hygiene/CHANGELOG.md
plugins/repo-hygiene/skills/clean/context/clean-batch.md
plugins/repo-hygiene/skills/clean/scripts/git-tree-reset-batch.test.sh
plugins/repo-hygiene/skills/clean/scripts/lib/batch-common.sh
plugins/session-flow/skills/retro/scripts/test_parse_transcript.py
plugins/source-control/scripts/landed-work.sh
plugins/source-control/skills/pull-request/scripts/fetch-annotations.test.sh
plugins/source-control/skills/pull-request/scripts/fetch-failed-logs.test.sh
Two disk-hygiene script paths are written descriptively because quoting them verbatim trips that plugin's own guardrail hook.
Why rewording is not the remedy
Three categories cannot be reworded at any price.
Published CHANGELOG history, four hits across three plugins. These entries already shipped. One of them, in guardrails, is itself documenting a previous fix to this very detector, so it necessarily quotes the path forms that fix began catching; rewriting it makes the entry describe nothing.
Fixtures whose assertion subject is the path. A case-folding test comparing two spellings of a home directory, a cwd-parsing fixture, an environment-variable expansion test, a Pester case asserting a JSONC reader preserves an escaped path. Changing the literal changes what the test proves.
Prose naming the form the surrounding code parses. A comment saying what git answers on Git Bash, sitting directly above the code that handles that answer.
Why not exclude them
The action's only lever is a file-level exclude. Silencing 40 phrases would take 22 files and ten plugins out of the scan entirely, which costs more than the finding is worth. An earlier revision of this issue proposed exactly that for a five-file subset; that estimate was wrong, and the exclusions it produced have been removed.
Done when
ci-workflows#549 lands a detector that recognises placeholder forms and fixture contexts, or offers a per-phrase opt-out, and this repository's ci.yml repins machine-specific-paths to the wave tag with no new exclusions. Phase 6b's ci-workflows convergence work carries this reference in its input set alongside the eight in other workflow files.
ci.ymlholdsmachine-specific-pathsalone atc2654182while its other sixteen ci-workflows references sit at thev0.19.0wave tag. This issue tracks closing that gap once the detector can tell a machine-specific path from a description of one.Upstream report: melodic-software/ci-workflows#549.
Why the pin is held
At the wave tag the action detects five classes, and on this repository all five fire on content that is not a machine-specific path: 40 hits across 22 files in ten plugins. Every one is prose naming the form the surrounding code parses, a published CHANGELOG entry, or a fixture whose assertion subject is the path.
The 22 files:
Two
disk-hygienescript paths are written descriptively because quoting them verbatim trips that plugin's own guardrail hook.Why rewording is not the remedy
Three categories cannot be reworded at any price.
Published CHANGELOG history, four hits across three plugins. These entries already shipped. One of them, in
guardrails, is itself documenting a previous fix to this very detector, so it necessarily quotes the path forms that fix began catching; rewriting it makes the entry describe nothing.Fixtures whose assertion subject is the path. A case-folding test comparing two spellings of a home directory, a cwd-parsing fixture, an environment-variable expansion test, a Pester case asserting a JSONC reader preserves an escaped path. Changing the literal changes what the test proves.
Prose naming the form the surrounding code parses. A comment saying what git answers on Git Bash, sitting directly above the code that handles that answer.
Why not exclude them
The action's only lever is a file-level
exclude. Silencing 40 phrases would take 22 files and ten plugins out of the scan entirely, which costs more than the finding is worth. An earlier revision of this issue proposed exactly that for a five-file subset; that estimate was wrong, and the exclusions it produced have been removed.Done when
ci-workflows#549 lands a detector that recognises placeholder forms and fixture contexts, or offers a per-phrase opt-out, and this repository's
ci.ymlrepinsmachine-specific-pathsto the wave tag with no new exclusions. Phase 6b's ci-workflows convergence work carries this reference in its input set alongside the eight in other workflow files.