refactor(ci)!: delete unused scripts, composite actions and render framework

[kyle-sexton]

Summary

Follow-up to #585: removes scripts, composite actions and the render framework that nothing uses any more.

Breaking: the lefthook-validate and tsc composite actions are removed. No repository in the organization calls either one.

Merge order: github-iac's .github/governance-verify/expected-contract-only-gates.json still lists lefthook-validate and tsc under melodic-software/ci-workflows (lines 161 and 171). Its verify-predicate job reads this repository's ci.yml on main and fails on any listed job that no longer exists. Those two entries need to come out of github-iac when this merges. That change is not part of this PR.

Fix

• Deleted .github/scripts/check-run-reconcile.cjs and its test. Nothing calls it. Removed its mention from docs/topics/claude-review-lanes/security-review-absent-mitigation.md.
• Deleted .github/scripts/resolve-cancelled-prerequisite.cjs and its test. The only remaining mention anywhere is a github-iac plan doc.
• Deleted the lefthook-validate and tsc composite actions:
  • removed .github/actions/lefthook-validate/ (including fixtures), .github/actions/tsc/, .github/scripts/lefthook-validate.test.sh and fixtures/typescript/good/tsconfig.json, which only the tsc lane used
  • removed the tsc and lefthook-validate jobs from ci.yml, plus their ci-status needs and results entries, the lefthook-validate change filter and the **/tsconfig.json filter pattern
  • removed lefthook-validate from the cached-install list in network-timeout-policy.test.cjs
  • removed both README entries and their link definitions, and updated the .cursor/install.sh header comment
• Removed the render framework: render.cjs, render-compose.cjs, render-compose.test.cjs and render-osv-scan-guard.cjs.
  • Its only target was the OSV scan guard block in osv-scanner.yml. That block stays inline with its content unchanged; only the BEGIN, Source and END generator marker comments are gone.
  • osv-scanner-pin.test.cjs no longer runs the renderer --check or asserts the Source marker. Its fail-closed content assertions are kept.
• Shape tests: every .github/scripts/*.test.cjs without a source module tests a workflow that still exists, so none were deleted. workflow-yaml.cjs stays because four tests use it.
• Not touched: release.yml, .github/standards/**, SYNC-MANAGED files, and the dated docs/topics/ci-fanout-consolidation/ADR.md record.

Verification

• node --test .github/scripts/*.test.cjs: 235/235 pass. node --test .github/actions/claude-lane-outcome/*.test.cjs: 15/15 pass.
• osv-scan-guard.test.sh and change-detection/match.test.sh pass.
• biome 2.5.11 ci over fixtures/typescript/good .github/scripts passes. actionlint -shellcheck= passes on all workflows. shellcheck on .cursor/install.sh, markdownlint on both edited markdown files, and typos are clean.
• zizmor on ci.yml and osv-scanner.yml: 51 findings, all low. main has 55 for the same two files, so no new findings.
• Composite callers: searched GitHub code search across the org for ci-workflows/.github/actions/lefthook-validate and .../tsc, and grepped origin/main in every canonical clone. There are no callers outside this repository.
• A fresh-context verifier checked the diff, reran the suites, checked the ci-status wiring and searched for callers again. It returned PASS and found the github-iac gates entry noted above.
• The inline guard in osv-scanner.yml currently matches .github/scripts/osv-scan-guard.sh line for line. osv-scan-guard.test.sh still tests the .sh file, but with the renderer gone nothing keeps the two copies in sync.

Related

Refs: #585

🤖 Generated with Claude Code

https://claude.ai/code/session_019mo9xaZ53JHHy4aBjgd8wK

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T20:37:45.437071Z	950fb55	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 2m 26s —— View job

---

Code review: PR #586

• Gather context (PR diff, changed files, custom instructions)
• Read repo guidelines (CLAUDE.md) and diff in detail
• Review deleted composite actions / scripts / workflow edits for correctness
• Verify no dangling references to removed files remain
• Post inline findings
• Post final summary

Summary

This is a clean deletion-only refactor. I verified the claims in the PR body rather than taking them at face value:

• Grepped the whole tree for check-run-reconcile, resolve-cancelled-prerequisite, lefthook-validate, .github/actions/tsc, and render.cjs/render-compose/render-osv-scan-guard — no dangling references outside the intentionally-untouched docs/topics/ci-fanout-consolidation/ADR.md (a dated historical record, correctly left alone per the PR body).
• ci.yml: the ci-status job's needs: [...] list and its results: string both still line up 1:1 (19 entries each) after removing tsc and lefthook-validate — no orphaned needs.* reference. The typescript change-filter key is still used by the biome job, so trimming only **/tsconfig.json out of its path list (rather than deleting the filter) is correct.
• network-timeout-policy.test.cjs's cachedActions allowlist drops lefthook-validate, consistent with the action directory being gone.
• README's lefthook-validate/tsc entries and their link-reference definitions ([lefthook-config], [lefthook-extends], [lefthook-validate]) are fully removed, no orphaned link refs left.
• fixtures/typescript/good/ is still self-contained (biome.json + example.ts) with tsconfig.json gone — nothing else in the fixture or ci.yml references it.

Finding (posted inline)

One maintainability point, left as an inline comment on .github/scripts/osv-scanner-pin.test.cjs:69: removing the render framework also removes the only test that kept .github/scripts/osv-scan-guard.sh in sync with the inline copy in osv-scanner.yml (it used to run render-osv-scan-guard.cjs --check and assert the Source: marker). The PR body already discloses this trade-off, so it's not a surprise, but there's now zero test coverage against the two copies silently drifting. A cheap content-equality assertion between the two would restore that guarantee without reintroducing the renderer.

Not code, informational only

The PR body doesn't open with a closing-keyword line (Closes #<issue> / Fixes / Resolves / No related issue: <reason>) per this repo's pr-body-contract rule — it goes straight to ## Summary, and ## Related uses Refs: instead. Per the same rule this is advisory (ci-status reports it via the needs-issue-linkage label/comment, doesn't gate), so it's not a blocker — just flagging since the rule says the contract is "still expected on every pull request."

Not verified

I could not execute node --test .github/scripts/*.test.cjs in this sandbox (command required interactive approval that isn't available in this session), so I was unable to independently confirm the "235/235 pass" and "15/15 pass" figures in the Verification section, or re-run zizmor/actionlint/biome. Static review (diff inspection + repo-wide grep for dangling references) found everything else consistent with the stated changes.

[claude]

Claude finished @kyle-sexton's task in 2m 27s —— View job

---

Security review — PR #586

• Gather context (PR body, changed files, custom instructions)
• Understand request: run /review:security-review
• Invoke /review:security-review skill and follow its procedure
• Post findings / result

Note on procedure: the /review:security-review skill did not return usable review instructions in this session (the Skill tool call returned only a stub Execute skill: review:security-review on three attempts with different args, no actual procedure content). Rather than block, I performed the equivalent review directly: read the full diff (git diff origin/main...HEAD), the diffstat, and grepped the repo for any remaining references to everything deleted.

Findings

No security findings. This PR is a pure deletion of dead code — no new logic, no permission changes, no new triggers, no secret handling:

• ci.yml / osv-scanner.yml diffs are subtractive only: removed tsc and lefthook-validate jobs, their changes-filter entries, and their ci-status needs/results wiring; removed only the generator marker comments (BEGIN/END GENERATED, Source:) around the inline OSV guard block. The ci-status job's permissions: block and trigger conditions (if: guards on pull_request label/edit events) are unchanged.
• No dangling references. Grepped the full repo for check-run-reconcile, resolve-cancelled-prerequisite, render-compose, render-osv-scan-guard, render.cjs, actions/tsc, and actions/lefthook-validate — zero hits outside this diff. Nothing still calls the deleted composite actions or scripts.
• OSV guard duplication verified. Compared the inline block now in osv-scanner.yml (lines 163–350) against .github/scripts/osv-scan-guard.sh at HEAD line-for-line — they match, including the fail-closed SCAN_EXIT/SARIF-validation logic, the %/CR/LF workflow-command escaping, and the path-traversal guard in normalize_sarif_uri (realpath -e + workspace-prefix check). No security-relevant divergence introduced.
• Accepted, already-disclosed drift risk (not a new finding, just confirming the PR body's own caveat): with the renderer removed, nothing re-checks that the inline osv-scanner.yml copy and .github/scripts/osv-scan-guard.sh stay in sync going forward. osv-scanner-pin.test.cjs now only asserts the fail-closed content of the inline block, not that it mirrors the .sh file. That's a maintainability/drift concern the PR author already flagged explicitly, not a vulnerability introduced by this change.
• Deleted composite actions (lefthook-validate, tsc) only removed pinned-binary install + invocation logic used by CI lanes that had no callers; no credentials, tokens, or checksum-verification logic was weakened elsewhere.

Nothing to fix. The one item worth tracking (not gating this PR) is adding a test that keeps the inline OSV guard and osv-scan-guard.sh in sync now that the renderer is gone, since a future edit to one copy could silently drift from the other.
· Branch: chore/delete-unused-scripts-actions

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.

[github-actions]

Last security-reviewed head: 908875446908966ecd1d0f354c12abcdf8f2445f. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[claude]

Claude finished @kyle-sexton's task in 1m 3s —— View job

---

Security review — PR #586 (re-run at 9088754)

• Gather context (PR diff, changed files, custom instructions)
• Invoke /review:security-review skill and follow its procedure exactly
• Post findings / result

Skip gate: this head already has a successful security review that still applies.

The commits since the last full security review (at 950fb55, see the prior security-review comment on this PR) are:

• 9088754 — test(osv): exercise the guard block in osv-scanner.yml directly

I diffed 950fb55..9088754 directly: it touches only .github/scripts/osv-scan-guard.test.sh and deletes .github/scripts/osv-scan-guard.sh. No change touches .github/workflows/osv-scanner.yml, .github/workflows/ci.yml, permissions, triggers, or any secret/token handling — the security-relevant surface reviewed at 950fb55 is unchanged at 9088754.

The commit itself responds to the drift concern raised in review: instead of keeping a separate osv-scan-guard.sh that could silently diverge from the inline block in osv-scanner.yml, the test now extracts the guard's run: block straight out of the workflow file with awk and executes that extracted copy, so there's a single source of truth. That's a test-harness change with no security-relevant surface of its own (no elevated permissions, no untrusted input, doesn't run in CI with secrets) — it's testing tooling, not runtime logic.

No new security findings. Standing conclusion from the 950fb55 review still applies: this PR is a pure deletion of dead code (unused composite actions/scripts) plus generator-comment removal around an unchanged inline OSV guard block; no logic, trust-boundary, or Actions-hardening issues.
· Branch: chore/delete-unused-scripts-actions