[PRESERVE — DO NOT MERGE] fix/node24-actions-and-daily-summary: 9 rescued commits, triaged

[labgadget015-dotcom]

⛔ DO NOT AUTO-MERGE — DRAFT, HUMAN REVIEW REQUIRED

This PR touches .github/workflows/, a protected path under config/policies.yaml.
It is opened as a draft for preservation and triage, not to be merged as-is.
It has 3 unresolved conflicts by design (see below).

Why this PR exists

The branch fix/node24-actions-and-daily-summary held 9 commits that existed in exactly one place — a single local ref on the m900, with its remote branch already deleted. It was pushed byte-identical (tip 598c354, no rebase) so the SHAs referenced in HANDOFF.md stay valid.

The commits date from a 2026-06-04 merge-base and the branch is now 257 commits behind main.

Triage verdict: this work is ~99% already on main

Every touched file was diffed against origin/main:

Commit	Verdict	Evidence
05214ef Node 24 bumps + daily-summary path	Superseded	main carries every bump; the autopilot.py path fix is on main verbatim (lines 327–347), comment text included
f43f2fa release → softprops/action-gh-release	Superseded	release-and-publish.yml byte-identical to main
ac5e8a4 Copilot autofix (autopilot.py)	Superseded	folded into main's version
575fca8 gitleaks allowlist	Superseded	main has both entries, better written (anchored regex + [extend] useDefault)
5928c36 black format autopilot.py	Moot
f2e87c2 · cb88bc9 · b057015 shellcheck fixes	Superseded	all 7 shell scripts byte-identical to main
598c354 add .github/labeler.yml	Superseded	main has its own labeler.yml → add/add conflict

⚠️ The one item still live — and it is NOT a safe one-liner

security_scan.yml: this branch bumps gitleaks/gitleaks-action@v2 → v3. main is still on v2. That is the only unlanded change in all 9 commits — but do not cherry-pick it blind. The hunk changes two things, not one:

-        uses: gitleaks/gitleaks-action@v2
+        uses: gitleaks/gitleaks-action@v3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}

Verified against live repo state:

• GITLEAKS_LICENSE is not a secret on this repo (gh secret list — 11 secrets, not among them). The reference would expand to an empty string.
• The owner is a User, not an Organization (gh api .../owner.type), so gitleaks' license gate should not apply — v2 gates orgs only. Whether v3 kept that carve-out is unverified.
• v3.0.0 is the only v3 release, and this bump is ~2.5 months stale.
• security_scan.yml has no continue-on-error since the repo went public, so a wrong guess here fails the security scan on main, it does not warn.

Before adopting: read v3.0.0's release notes / migration guide, confirm the org-only license carve-out survived, and decide whether the GITLEAKS_LICENSE line should come along at all (on a User-owned repo it is probably noise). Validate on a branch with a real scan run before it reaches main.

(Unrelated straggler spotted while diffing: main still pins actions/github-script@v7 at deploy-landing.yml:75. Not this branch's scope — noting it for the backlog.)

Recommended disposition

1. Evaluate the gitleaks v2→v3 change per the caveats above; if it holds up, land it as its own small PR with a green scan.
2. Close this PR without merging and delete the branch.

Preservation is already satisfied by the remote ref itself — this PR is the readable record of what was in it and why it can go.

Conflicts are intentional — do not resolve here

.github/labeler.yml (add/add) · .gitleaks.toml (add/add) · autopilot/autopilot.py (content).

Resolving them would mean rebasing, which rewrites all 9 SHAs and destroys the artifact being preserved. "Not mergeable" is the correct signal.

Expected CI noise

CI will be red — a 257-behind branch against current main. That is expected, not a defect to chase. ai_agent_workflow self-skips on draft; dependabot-automerge is actor-gated to dependabot[bot] (no auto-merge path); stale-pr-handler sets exempt-draft-pr: true. elite_copilot has no draft guard and will post one bot comment below — ignore it.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01GipLwSamx8HJU2pHaScFB2

[labgadget015-dotcom]

Closing unmerged — the one live item has landed on main

This draft was kept open for a single line: gitleaks/gitleaks-action@v2 → @v3 in security_scan.yml. Everything else in its 9 commits was already verified byte-identical to main.

That line is now on main via #264 (b99e5c80f, merged 2026-08-24).

The blocker that held it here was wrong

This PR was gated on:

"DO NOT cherry-pick it blind. v3 also injects GITLEAKS_LICENSE, a secret that does NOT exist on this repo… A blind bump reddens main."

Verified 2026-08-24 — the license is organization-only. The action's README: "If you are scanning repos that belong to a personal account, then no license key is required." gh api users/labgadget015-dotcom returns "type": "User".

And then confirmed empirically rather than by argument: #264's secret-scan job ran gitleaks v3 with no license and passed (run 32684718114, "Run Gitleaks" → success), with all 38 checks green.

One deliberate difference from this PR's version

#264 does not carry the GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} env line that this branch added. It's unnecessary on a personal account and would have resolved to an empty string.

Disposition

Nothing live remains here. Closing unmerged and deleting the branch — GitHub retains a closed PR's commits, so all 9 stay recoverable from this page, and the tip is 598c354.

Full per-commit triage stays in the PR body above for the record.

[labgadget015-dotcom]

Correction to the comment above: I did not delete the branch.

The title of this PR says [PRESERVE — DO NOT MERGE]. I honoured the "do not merge" half by closing it unmerged, but deleting the branch is the one irreversible act in this cleanup, and "PRESERVE" is an explicit instruction from the repo owner. That's not a call to make on inherited notes, so fix/node24-actions-and-daily-summary is left in place pending your decision.

Current state, verified just now:

• branch ref fix/node24-actions-and-daily-summary → still present, tip 598c3548766ee5f75f914d79eaea939b7c034d9c
• tip commit reachable via the API
• all 9 commits still listed on this closed PR

So the branch is safe to delete whenever you want it gone — GitHub retains a closed PR's commits, and they'd stay recoverable from this page. It's simply your call, not mine.