fix(actions): reconcile already-absent legacy workflow identities

[seonghobae]

Root cause

Protected-main registry retirement run 33596622523, job 100141255712, proved the runner-capacity repair from #1684 worked: the ubuntu-slim job was admitted and entered the registry transaction. It then failed before any mutation because the complete paginated Actions workflow inventory contained zero entries for the first removed legacy path, .github/workflows/accounting-information-platform-hourly-review-repair.yml.

The one-shot migration incorrectly collapsed two different states into one fatal condition: zero matches (the removed legacy identity is already absent from the repository workflow registry) and multiple matches (ambiguous and unsafe). There is no registry object to disable in the zero-match case.

Fix

• Keep the consolidated replacement and the migration workflow itself on an exact-one identity requirement.
• For each of the 18 removed legacy paths, treat zero matches in the complete paginated inventory as terminally absent, exactly one match as requiring the existing active/disabled-manually disable-and-read-back path, and duplicate matches as fail-closed.
• Preserve replacement-active-before-mutation, replacement recheck, self-disable-last, protected-main-push-only, actions: write + contents: read, no checkout/model/provider credentials, and ubuntu-slim admission.
• Add regression contracts for zero/one/many semantics and document the exact hosted failure that established the distinction.

Exact source identity

• base: main@0f56950ff6cb780d7a8a89c979e5822c88c9cb3f
• head: 265b5fa00c968dc0071c5a1cc14c8681654ca821
• compare: 0 behind / 3 ahead
• scope: exactly the one-shot workflow, its focused contract test, and its doctoring record

No predecessor check/review evidence transfers. Merge only on the exact unchanged head unless the same verified queue-capacity circularity prevents the migration repair from landing; do not bypass substantive test/security/review findings.

---

[coderabbitai]

Warning

Review limit reached

Next included review available in 58 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: e4c26e7d-5574-45d2-b17e-db28c660fc98

📥 Commits

Reviewing files that changed from the base of the PR and between 0f56950 and 265b5fa.

📒 Files selected for processing (3)

• .github/workflows/hourly-review-repair-registry-retirement.yml
• docs/doctoring/hourly-review-repair-registry-retirement.md
• tests/test_hourly_review_repair_registry_retirement.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.