fix(workflows): remove literal dollar-brace-brace from run-block comments (actual root cause)

[cmeans-claude-dev]

Summary

Found the actual root cause of the workflow_dispatch parse failures that defeated PRs #24 (workflow_dispatch trigger), #25 (null-coalesce with ''), #26 (null-coalesce with 'none'), and #27 (jq from $GITHUB_EVENT_PATH).

GitHub Actions substitutes ${{ ... }} expressions inside run: blocks before the shell sees them — including sequences inside shell comments. Three comments in this file contained the literal string ${{ }} (empty expression). GHA's queue-time parser tried to evaluate an empty expression and bailed with "An expression was expected", always pointing at run: | (col 14) because that's the parent scope.

Diagnostic that clinched it

After PR #27 merged, the reported error line numbers shifted from 55/111 (before #27) to 53/126 (after #27). That proved the error position is file-structure-dependent — col 14 is always the | of run: |. Meanwhile the literal ${{ }} in comments has been identical across every version of this file since the security-hardening cascade from mcp-clipboard#87. Every || X fallback experiment was modifying the wrong expressions.

Why this only surfaced on workflow_dispatch

The normal workflow_run code path apparently tolerates empty ${{ }} expressions (evaluates to empty string, carries on). The queue-time parser for workflow_dispatch is stricter and rejects them. mcp-clipboard has the same latent bug — it just never tripped because nobody has dispatched manually there. That's why mcp-clipboard's workflow_run firings continued to work fine throughout.

Change (8 / −5, one file, comment-only)

Three comments rewritten to describe the concept without the literal ${{ }} characters:

Before	After
# Going through jq -r avoids the ${{ }} expression surface entirely	# Going through jq -r avoids the GitHub Actions expression surface entirely ...
# not direct ${{ }} interpolation — fork PR branch names are	# not a direct GHA expression — fork PR branch names are
# HEAD_BRANCH came from jq (above), not direct ${{ }} interpolation —	# HEAD_BRANCH came from jq (above), not a direct GHA expression —

Zero logic change. Legitimate ${{ secrets.GITHUB_TOKEN }} and ${{ github.repository }} in env: blocks are untouched — they have real content inside the braces and parse correctly.

Post-merge

Same dispatch test as before: https://github.com/cmeans/yt-dont-recommend/actions/workflows/pr-labels-ci.yml → Run workflow → main. If the theory holds, the queue no longer errors, both jobs skip (because the job-level if: evaluates to false on workflow_dispatch), the workflow registers, and gh api ... --jq '.name' should flip to "PR Label Automation (CI)".

Cascade

mcp-clipboard's pr-labels-ci.yml has the identical ${{ }} in comments. The fix should propagate there in a follow-up PR to preserve the verbatim contract and to unblock manual dispatch if it's ever needed.

Caveat

Same as PRs #24 / #25 / #26 / #27 — this PR itself will stick at Awaiting CI because the fix only activates post-merge-and-seed. One more Dev Active toggle.

🤖 Generated with Claude Code

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[cmeans]

[QA] Review — zero findings, Ready for QA Signoff.

Sharp root-cause work. The line-shift evidence (55/111 before #27 → 53/126 after #27, col always 14 = | of run: |) is clean and the conclusion that GHA substitutes ${{ ... }} sequences inside run-block comments is a genuinely non-obvious GHA quirk. Worth flagging that these exact comments traced back to the shell-injection hardening cascade (mcp-clipboard#87 → PR #19 → #22's re-sync) — so this bug has been latent across the whole template family since then, masked only by nobody having tried to workflow_dispatch those workflows before.

Verified in this session

Check	Result
grep '\${{ *}}' .github/workflows/*.yml on the PR branch	Zero matches — all three empty-expression sites scrubbed.
Diff shape	3 comment rewrites, zero code changes, zero indentation drift. ${{ secrets.GITHUB_TOKEN }} and ${{ github.repository }} (real content) untouched — those have always been fine.
pytest tests/	259/259 pass.
ruff check src/ tests/	Clean.
YAML parse	Clean.

Cascade impact (spot-checked)

Same grep against cmeans/mcp-clipboard/.github/workflows/ hits two sites in its pr-labels-ci.yml (lines 49, 100). Same latent bug, masked only by mcp-clipboard never having dispatched manually. Updated cmeans/mcp-clipboard#89 with the details — the cascade there now needs to cover the workflow_dispatch trigger, the || '' → env fallback, and this comment scrub all at once. Going forward, grepping for \${{ *}} in any repo adopting this workflow family would catch it before it bites.

Verdict

Applying Ready for QA Signoff. Comment-only change, zero logic risk, no happy-path impact. Even if the workflow_run registration doesn't recover post-merge (unlikely — this is by far the most plausible root cause of everything we've been seeing), the file is strictly cleaner than it was, and the revert path — if you do decide to pull the whole seeding chain — is still simple.

Post-merge

Same playbook. Dispatch from the Actions UI. This time the expected outcome is: the queue doesn't error, both jobs skip cleanly, run completes with status "success". After that, the first PR with a real CI completion should route its workflow_run event to this workflow. The real signal to watch is workflow_run runs > 0 in the API history — independent of the name field quirk (which, recall, mcp-clipboard exhibits too despite its listener working).

[cmeans]

LGTM