[thlwt]

Summary

Scope the daily-triage workflow-health check to main, so startup failures on automated/* bot PR branches no longer read as dogfood gate failures.

Related issue

Relates to the long-standing **2** dogfood workflow(s) failing — investigate validate-patterns / audit item in STATE.md (carried since 2026-10-02).

Root cause

gh run list --workflow=<wf>.yml --limit 1 had no branch filter, so it picked up the newest run regardless of branch. Automated branches (automated/star-history-*, automated/daily-triage-*) are pushed with GITHUB_TOKEN, and their PR runs end in ~21s with jobs: [] and GitHub's "This run likely failed because of a workflow file issue." Repeated checks showed:

• main: last 3 runs of both validate-patterns.yml and audit.yml are success (push and schedule).
• automated/*: every PR run is a startup failure, with no logs (log not found).
• Workflow file content is identical between main and the failing branch heads.

The gates that matter already run inside daily-triage.yml / update-star-history.yml before any PR is opened, so the bot PR's own check runs carry no signal. They were counted anyway, which kept a permanent false "2 failing" line in STATE.md.

Changes

• Other

• .github/workflows/daily-triage.yml: add --branch main to the workflow-health gh run list.

• STATE.md: drop the stale "2 dogfood workflow(s) failing" bullet (the generator only emits it when the count is > 0).

Checklist (from CONTRIBUTING)

• Links work from README or the relevant index (n/a, no docs changed)
• No secrets, tokens, or internal company URLs
• STATE.md* examples use .example suffix (n/a)
• Safety-related content references docs/safety.md (n/a)
• If you touched a package under tools/<pkg>: n/a
• If you touched the registry: n/a

Testing / Dogfood

• YAML parses: python -c "import yaml; yaml.safe_load(open('.github/workflows/daily-triage.yml'))" → jobs: ['triage']
• Simulated the new check against the live repo: validate-patterns: success, audit: success, failing=0
• node scripts/validate-registry.mjs → Registry valid: 8 patterns
• node scripts/check-loop-init-sync.mjs → loop-init pattern sync OK (8 patterns)
• node scripts/sync-untrusted-input.mjs --check → untrusted-input guidance OK (55 files)
• node --test scripts/github-triage.test.mjs scripts/append-run-log.test.mjs scripts/sync-untrusted-input.test.mjs → 36 pass, 0 fail

---

Opened from a fork (thlwt:fix/triage-workflow-health-main-only) because this account has no write access to the upstream repo.

[github-actions]

This PR changes paths that must run the real validate and audit workflows (tools, patterns, scripts, or CI).

Fork PRs from first-time contributors start with those workflows waiting for approval. A maintainer needs to open the Checks tab and click Approve and run workflows. Until that happens, branch protection will show the PR as blocked even after a review.

Content-only PRs (docs/, examples/, stories/, skills/, root markdown) skip this step — required checks are posted from this workflow instead.

— loop-engineering fork-pr-gate