review: stop recommending gh aw update in the consumer README by jwbron · Pull Request #371 · Khan/actions

jwbron · 2026-08-21T17:57:05Z

Follow-up to #357's gh aw update ban. Most of this PR's original diff (the README and onboarding-skill rewording) landed on main via #357 itself, so what remains is the residue that PR did not carry, plus hardening from the review rounds:

the consumer-config checker's source-missing warning no longer frames gh aw update as the update mechanism; it cites the reason source: still matters (the manual bump flow reads it to tell which release the install was copied from)
the onboarding skill's update block carries an explicit stop comment between the merge instructions and gh aw compile, telling the reader to run the 3-way merge and commit it before compiling (advisory; the first round's <STOP: ...> pseudo-tag form was not valid shell)
the README's ban names the observed gh-aw version (v0.85.4) and the revisit condition (neither failure is filed upstream; re-test both on a scratch install before trusting a newer release), and the same condition now lives in the review-consumer-bump skill the bump operator actually follows
a new workflows/review/gh-aw-update-ban.test.ts pins every tracked gh aw update mention to the files that ban it, so re-recommending the tool anywhere fails CI
this repo's own installed review.md picks up the frontmatter comment fix (the observability local-edit note no longer names gh aw update as the merger); lock recompiled with gh-aw v0.85.4, comment-only, no behavior change

KORE-2498

…pdate in the consumer README The README told consumers to pull updates with gh aw update in 4 places. The review-consumer-bump skill (#357) documents it failing twice against this repo's tag scheme, both observed live on 2026-08-20: it treats review-v<version> as a branch and repins to main's head SHA, and its 3-way merge emptied a consumer's installed review.md to 0 bytes (gh-aw v0.85.4). All 4 spots now describe the maintainer-driven bump flow (a manual git merge-file 3-way merge, one PR per consumer) and the install section names the failure modes so nobody rediscovers them. Follow-up from the #357 review; lands independently of #357, the skill-path reference just dangles for whichever merges first.

changeset-bot · 2026-08-21T17:57:11Z

🦋 Changeset detected

Latest commit: fa9ee8f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
review	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

github-actions · 2026-08-21T17:57:34Z

Review live A/B

No reviewable delta: review.md is byte-identical in both arms (baseline origin/main, sha 1a6020971f11), so the extracted prompts and the orchestrator body match and no arms were run. Pass --force-arms for a deliberate wobble control.

github-actions

Changes requested — see inline comments.

_{review details}

_{review-v1.17.1 | schema 2 | depth full | re-review scoped blocking-only | enable holistic,completeness,test-adequacy,first-principles,conventions,documentation}

…re, not just the README The review on #371 found the onboarding skill still recommended gh aw update in 4 places and the shipped review.md observability comment in 1 more, so fixing the README alone relocated the inconsistency instead of removing it. Port #357's wording for the skill's 4 spots and the shipped comment verbatim (its rebase then collapses to just the new consumer-bump skill), fix the same comment in this repo's own install and recompile the lock with gh-aw v0.85.4 (the diff is the frontmatter hash line only), point the dangling skill path at #357, and give the README ban a revisit condition: neither failure is filed upstream (searched github/gh-aw issues, no reports), so re-test on a scratch install before trusting a newer gh-aw release.

jwbron · 2026-08-21T18:36:04Z

All four review findings addressed in 9c901e3:

skill still prescribing gh aw update (blocking): fixed all 4 spots in review-onboarding/SKILL.md, using review-consumer-bump: a skill for rolling reviewer releases out to consumers #357's wording for those hunks verbatim so its rebase collapses to just the new skill file.
dangling skill path: the README now says the playbook lands via review-consumer-bump: a skill for rolling reviewer releases out to consumers #357, so a reader arriving before it merges has somewhere to go.
shipped review.md comment: fixed in the template, this repo's own install, and the recompiled lock (gh-aw v0.85.4, diff is the frontmatter hash line only), so the stale wording no longer reaches consumers on the next bump.
unconditional ban: turns out neither failure is filed upstream (searched github/gh-aw issues for the tag-as-branch repin and the 0-byte merge, no reports), so the README now states that and gives the revisit condition: re-test both on a scratch install before trusting a newer gh-aw release. Filing the two upstream issues is a follow-up, not blocking here.

github-actions

All 4 prior review threads are resolved.
Note: divergence tripwire re-armed a full review (unreviewed share 0.78).

_{review details}

_{review-v1.17.1 | schema 2 | depth full | re-review scoped blocking-only | enable holistic,completeness,test-adequacy,first-principles,conventions,documentation}

…block a stop line Two review catches: check-consumer-config's source-missing warning still framed gh aw update as the update mechanism (the one place a consumer met the stale recommendation at runtime rather than in prose), and the onboarding skill's update block had lost its only merge step, so following it literally recompiled an unmerged install and every later step silently passed on an empty diff. The warning now cites the reason source: still matters (the manual bump flow reads it), and the block carries an explicit unrunnable stop line where the merge command used to be.

# Conflicts: # .github/workflows/review.lock.yml

github-actions

Approved — no blocking issues found.
4 of 6 prior review threads resolved; 2 still unaddressed as of 7d260c3:

2 non-blocking threads still open

note (non-blocking) .claude/skills/review-onboarding/SKILL.md:172: Every replaced recommendation points at .claude/skills/review-consumer-bump/SKILL.md, which does not exist on this bra...
suggestion (non-blocking) workflows/review/README.md:184: PR citations elsewhere in the docs are bare Khan/actions#NNN, not markdown links. Every tracked-markdown PR reference...

Non-blocking observations (4)

.claude/skills/review-onboarding/SKILL.md:431 suggestion (non-blocking): Manual step written as <STOP: ...> inside a ```sh block rather than as prose between blocks. _{(conventions)}
workflows/review/README.md:183 question (non-blocking): The bump playbook the SKILL.md pointers name does not exist in the repo yet, and those pointers don't name #357. _{(completeness)}
workflows/review/lib/check-consumer-config.ts:540 suggestion (non-blocking): Changeset says "Docs only" but this PR also changes a shipped checker warning string. _{(completeness)}
workflows/review/lib/check-consumer-config.ts:540 suggestion (non-blocking): The ban is enforced only in prose, in the same shipped file that could detect the failure it warns about. _{(first-principles)}

Note: 1 finding(s) not re-posted (already tracked in open review threads). Note: re-review ran at scoped depth (re-review mode scoped, blocking-only).

_{review details}

_{review-v1.18.0 | schema 2 | depth scoped | re-review scoped blocking-only | enable holistic,completeness,test-adequacy,first-principles,conventions,documentation}

# Conflicts: # .claude/skills/review-onboarding/SKILL.md # workflows/review/README.md

…ine a comment Two findings from a reviewer run the dispatch gate blocked before posting (run 32758584548; the gate report carries them). The changeset still described the repo-wide sweep #357 already landed, crediting this release with edits it did not make; it now describes only this PR's remaining diff. And the <STOP: ...> line inside the sh fence was shell-hostile: bash parses it as a redirect, so a paste errors on that line and runs gh aw compile anyway. It is now a # comment, paste-safe and matching the two comment lines above it.

github-actions · 2026-08-24T18:33:56Z

Guidance for reviewers

Triage notes for reviewers: risky files by owning team, repeated changes, and files excluded from review.

github-actions (3 files)

File	Reason
`review.md`	This repo's own workflow file, where frontmatter defines the install's permission and secret surfaces; the hunk is a comment-only reword and leaves triggers, secrets, and pins untouched.
`check-consumer-config.ts`	Shared enforcement code that runs in every consuming repo's CI; this hunk changes only the `source-missing` warning string, and the test asserts the warning code rather than its text.
`SKILL.md`	Agent-executable instruction that steers how a consumer's reviewer install gets bumped; this hunk only inserts a stop marker ahead of `gh aw compile`.

Common patterns

4 files: Replace gh aw update references with the manual 3-way-merge bump-flow wording throughout docs, skill, and code.

- a local edit `gh aw update` preserves
+ a local edit the 3-way merge update flow preserves

Excluded from review (1 file)

Not individually reviewed — generated, formatting-only, or
fully explained by a common pattern above:

.github/workflows/review.lock.yml — generated

_{review details}

_{review-v1.18.0 | schema 2 | depth full | re-review scoped blocking-only | enable holistic,completeness,test-adequacy,first-principles,conventions,documentation}

github-actions

All 2 prior review threads are resolved.
Note: divergence tripwire re-armed a full review (unreviewed share 0.60).

_{review details}

_{review-v1.18.0 | schema 2 | depth full | re-review scoped blocking-only | enable holistic,completeness,test-adequacy,first-principles,conventions,documentation}

…he bump skill, guard the ban in CI Three from the latest round plus the earlier fold: the changeset claimed a shell comment makes running the block straight through impossible (it cannot; the claim ships verbatim as the CHANGELOG entry, so it is softened to what the comment does), the no-expiry/re-test-on-scratch-install condition now lives in the bump skill the operator actually follows rather than only the consumer README, and a new test pins every tracked gh aw update mention to the files that ban it, so re-recommending the tool anywhere fails red.

github-actions

Changes requested — see inline comments.
All 5 prior review threads are resolved.
Note: divergence tripwire re-armed a full review (unreviewed share 0.43).

_{review details}

_{review-v1.18.0 | schema 2 | depth full | re-review scoped blocking-only | enable holistic,completeness,test-adequacy,first-principles,conventions,documentation}

The blocking catch: changeset version copies changeset bodies verbatim into workflows/review/CHANGELOG.md, so excluding .changeset/ but not the file it concatenates into just deferred the failure to the release PR. Also from the round: the eval corpus is excluded (case fixtures quote arbitrary text), the extension glob is gone entirely (the residue has turned up in .md, .ts, and a compiled .lock.yml, so an extension list is a bet on where the next one lands; reading a binary as utf8 cannot match), the ALLOWED docstring names all five entries including this file's own search string, and the header states the file-granularity limit so nobody over-trusts the backstop.

github-actions

Approved — no blocking issues found.
All 5 prior review threads are resolved.

Non-blocking observations (4)

workflows/review/gh-aw-update-ban.test.ts:68 suggestion (non-blocking): The sweep matches the literal substring, so a line-wrapped mention slips past the ban. _{(correctness-reviewer)}
workflows/review/gh-aw-update-ban.test.ts:76 suggestion (non-blocking): The stale-allowlist detector's custom message never renders for the missing-file case. _{(correctness-reviewer)}
workflows/review/gh-aw-update-ban.test.ts:70 suggestion (non-blocking): the sweep has no positive control, so a broadened exclusion would pass silently. _{(test-adequacy)}
workflows/review/gh-aw-update-ban.test.ts:51 suggestion (non-blocking): git grep -l does this sweep in the one subprocess the test already spawns. _{(first-principles)}

Note: re-review ran at scoped depth (re-review mode scoped, blocking-only).

_{review details}

_{review-v1.18.0 | schema 2 | depth scoped | re-review scoped blocking-only | enable holistic,completeness,test-adequacy,first-principles,conventions,documentation}

…ce (#375) Run 32758584548 (PR #371) was blocked by rule 7 on a fully conforming review: the staged plan quoted <STOP: ...> entity-escaped in a footer, the ingest sanitizer decoded it and parenthesised the resulting pseudo-tag, and the normalized comparison saw different bodies. Entity decoding was on the documented-not-absorbed residual list; this absorbs it by mirroring sanitize_content_core.cjs's decodeHtmlEntities (v0.85.4) on both sides of the comparison, before the invisible strips, in the sanitizer's order.

The consequential one is sequencing: the dispatcher-death prose said 'report the run incomplete, then continue at Step 9', and reporting incomplete can end the turn, so the cache compensation the death path exists to trigger could be skipped with it. Step 9 now runs first, and the guidance-repost claim is scoped to the next full-depth run. The ban test folds whitespace before matching (a wrapped 'gh aw update' counted as no mention), gains a positive control so a broadened exclusion fails rather than passing vacuously, and checks existence before reading so the stale-allowlist message renders; git grep -l was considered and declined in a comment, since line-based matching is exactly what misses the wrapped form. foldToken's three length thresholds are documented and the empty-subject-tokens early return is pinned.

khan-actions-bot requested review from a team, jeresig and somewhatabstract and removed request for a team August 21, 2026 17:57

github-actions Bot requested changes Aug 21, 2026

View reviewed changes

Comment thread workflows/review/README.md Outdated

Comment thread workflows/review/README.md Outdated

Comment thread workflows/review/README.md Outdated

Comment thread workflows/review/README.md Outdated

khan-actions-bot requested a review from a team August 21, 2026 18:36

This comment has been minimized.

Sign in to view

github-actions Bot approved these changes Aug 21, 2026

View reviewed changes

jeresig approved these changes Aug 21, 2026

View reviewed changes

jwbron added 3 commits August 24, 2026 09:30

Merge remote-tracking branch 'origin/main' into HEAD

b1ec70d

Merge remote-tracking branch 'origin/main' into HEAD

7d260c3

# Conflicts: # .github/workflows/review.lock.yml

github-actions Bot approved these changes Aug 24, 2026

View reviewed changes

jwbron added 2 commits August 24, 2026 10:46

Merge remote-tracking branch 'origin/main' into HEAD

6954124

# Conflicts: # .claude/skills/review-onboarding/SKILL.md # workflows/review/README.md

jwbron mentioned this pull request Aug 24, 2026

review: absorb HTML entity decoding into the gate's sanitizer tolerance #375

Merged

github-actions Bot approved these changes Aug 24, 2026

View reviewed changes

Comment thread .changeset/readme-no-gh-aw-update.md Outdated

Comment thread .claude/skills/review-onboarding/SKILL.md

Comment thread .changeset/readme-no-gh-aw-update.md Outdated

Comment thread workflows/review/README.md

Comment thread workflows/review/README.md

jwbron added 2 commits August 24, 2026 11:38

Merge remote-tracking branch 'origin/main' into HEAD

1410e5b

github-actions Bot requested changes Aug 24, 2026

View reviewed changes

github-actions Bot approved these changes Aug 24, 2026

View reviewed changes

jwbron merged commit 1dde4d3 into main Aug 24, 2026
10 checks passed

jwbron deleted the jwbron/review-readme-manual-merge branch August 24, 2026 19:35

khan-actions-bot mentioned this pull request Aug 24, 2026

Version Packages #374

Merged

khan-actions-bot mentioned this pull request Aug 25, 2026

Version Packages #385

Merged

Uh oh!

Conversation

jwbron commented Aug 21, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

github-actions Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review live A/B

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jwbron commented Aug 21, 2026

Uh oh!

This comment has been minimized.

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Aug 24, 2026

Guidance for reviewers

Common patterns

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jwbron commented Aug 21, 2026 •

edited by atlassian Bot

Loading

changeset-bot Bot commented Aug 21, 2026 •

edited

Loading

github-actions Bot commented Aug 21, 2026 •

edited

Loading