[thlwt]

Summary

Extract the daily-triage workflow-health rule into scripts/workflow-health.mjs and pin it with node tests, so the main-branch scope can't silently regress again.

Related issue

Relates to the **2** dogfood workflow(s) failing item that sat in STATE.md since 2026-10-02: the rule was inline bash, untested, and the bug was a missing branch filter.

Context

The check used gh run list --workflow=<wf>.yml --limit 1 with no branch filter. Automated branches are pushed with GITHUB_TOKEN, and their PR runs end as startup failures (jobs: [], "workflow file issue"), so those runs were counted as validate-patterns / audit failures while main was green. The same gates already run inside the automation before the PR opens, so a bot PR's own run carries no signal.

Branch scoping alone is a one-line fix (separate PR). This PR makes the rule testable so the next edit can't quietly drop it.

Changes

• Tool / CLI change under tools/ — n/a; scripts/ only

• scripts/workflow-health.mjs

  • argsFor(workflow, branch = 'main') always includes --branch main and --limit 1.
  • evaluate(rows) classifies failure / timed_out / startup_failure as failing, queued / in_progress as pending, missing or unreadable as unknown (never a failure).
  • collect({ exec }) is injectable, so tests pin the gh argv without touching the network.
  • CLI prints one line per workflow plus failing=N, and appends failing= to $GITHUB_OUTPUT.

• scripts/workflow-health.test.mjs: 10 tests, including the regression pin on --branch main and "gh errors become unknown, never failures".

• daily-triage.yml: the step becomes node scripts/workflow-health.mjs (same GH_TOKEN, same failing output).

• ci-validate-gates.sh + package.json (npm run test:scripts): the new tests run in the validate gate.

Checklist (from CONTRIBUTING)

• Links work from README or the relevant index (n/a)
• No secrets, tokens, or internal company URLs
• STATE.md* examples use .example suffix (n/a)
• Safety-related content references docs/safety.md (n/a)
• If you touched a package under tools/<pkg>: n/a
• Registry untouched

Testing / Dogfood

• node --test scripts/workflow-health.test.mjs → 10 pass, 0 fail
• node scripts/workflow-health.mjs against the live repo → validate-patterns: success, audit: success, failing=0
• node --test scripts/workflow-health.test.mjs scripts/github-triage.test.mjs scripts/append-run-log.test.mjs scripts/sync-untrusted-input.test.mjs → 46 pass, 0 fail
• npm run validate:registry → Registry valid: 8 patterns
• YAML parses (yaml.safe_load) with the new step

---

Opened from a fork (thlwt:fix/workflow-health-script) because this account has no write access to the upstream repo.

[github-actions]

This PR changes paths that must run the real validate and audit workflows (tools, patterns, scripts, or CI).

Fork PRs from first-time contributors start with those workflows waiting for approval. A maintainer needs to open the Checks tab and click Approve and run workflows. Until that happens, branch protection will show the PR as blocked even after a review.

Content-only PRs (docs/, examples/, stories/, skills/, root markdown) skip this step — required checks are posted from this workflow instead.

— loop-engineering fork-pr-gate