fix(operations): restack runner JSON integrity on current main

[seonghobae]

Purpose

Harden runner-assignment GitHub API evidence so malformed UTF-8 and duplicate decoded JSON object keys cannot alter workflow-run or job identity before the operator audit evaluates runner assignment.

Exact identities

• protected/live base: 966eccfe32f612bc78037a78ccde8647de0119c4
• predecessor head before current-main convergence: 8c6ccf38bf07beb29730d1de68aeb2b57a0ecf54
• current restacked head: 0f94dd872abeefbab8381035b8006b332f8e5eef
• branch: fix/runner-assignment-json-integrity-f1846

Integrity and authority contract

• gh api stdout remains bounded raw bytes until fatal UTF-8 decoding succeeds;
• duplicate decoded JSON keys, including escape-equivalent names, fail before JSON.parse;
• the shell-free gh subprocess receives only PATH, a read-only GitHub token, GitHub Cloud host identity, and no-color configuration;
• repository, model, Maintainer/Reviewer App, proxy, HOME, and other ambient credentials do not cross the child boundary;
• run and job evidence is collected from explicit read-only endpoints with complete pagination;
• the report is published through an owner-only temporary file and atomic rename;
• runner assignment remains evidence only and cannot satisfy required-check, review, merge, release, or deployment authority.

The current-main convergence overlays only the audit module, two focused test files, and the one-line production coverage inventory addition while preserving the protected orphan-workflow planner and all other current bytes.

Verification boundary

Historical checks and reviews do not transfer. The unchanged current head must obtain fresh terminal-success application ci, reviewer-ci, protected-base central Security Scan, exact configured 100% owned-production statement/branch/function/line coverage, and zero valid unresolved findings before merge. Pending, queued, skipped, absent, stale, status-only, model-only, or predecessor evidence is non-passing.

No force update, gate weakening, reviewer or secret invention, repair/self-modifying workflow, release, deployment, KPI, or acquisition-readiness claim is introduced.

Supersedes #338/#330/#312/#287. Related: #30.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 33 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: aef8054d-9976-469a-bcaf-c0753c53dbe1

📥 Commits

Reviewing files that changed from the base of the PR and between 9bc56ac and b0c6005.

📒 Files selected for processing (5)

• scripts/actions-runner-assignment-audit.mjs
• test/actions-runner-assignment-cli.test.ts
• test/actions-runner-assignment-coverage.test.ts
• test/actions-runner-assignment-production-branches.test.ts
• vitest.config.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}