[PRESERVE — DO NOT MERGE] fix/node24-actions-and-daily-summary: 9 rescued commits, triaged - #260

⛔ DO NOT AUTO-MERGE — DRAFT, HUMAN REVIEW REQUIRED

This PR touches .github/workflows/, a protected path under config/policies.yaml.
It is opened as a draft for preservation and triage, not to be merged as-is.
It has 3 unresolved conflicts by design (see below).

Why this PR exists

The branch fix/node24-actions-and-daily-summary held 9 commits that existed in exactly one place — a single local ref on the m900, with its remote branch already deleted. It was pushed byte-identical (tip 598c354, no rebase) so the SHAs referenced in HANDOFF.md stay valid.

The commits date from a 2026-06-04 merge-base and the branch is now 257 commits behind main.

Triage verdict: this work is ~99% already on main

Every touched file was diffed against origin/main:

⚠️ The one item still live — and it is NOT a safe one-liner

security_scan.yml: this branch bumps gitleaks/gitleaks-action@v2 → v3. main is still on v2. That is the only unlanded change in all 9 commits — but do not cherry-pick it blind. The hunk changes two things, not one:

-        uses: gitleaks/gitleaks-action@v2
+        uses: gitleaks/gitleaks-action@v3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}

Verified against live repo state:

• GITLEAKS_LICENSE is not a secret on this repo (gh secret list — 11 secrets, not among them). The reference would expand to an empty string.
• The owner is a User, not an Organization (gh api .../owner.type), so gitleaks' license gate should not apply — v2 gates orgs only. Whether v3 kept that carve-out is unverified.
• v3.0.0 is the only v3 release, and this bump is ~2.5 months stale.
• security_scan.yml has no continue-on-error since the repo went public, so a wrong guess here fails the security scan on main, it does not warn.

Before adopting: read v3.0.0's release notes / migration guide, confirm the org-only license carve-out survived, and decide whether the GITLEAKS_LICENSE line should come along at all (on a User-owned repo it is probably noise). Validate on a branch with a real scan run before it reaches main.

(Unrelated straggler spotted while diffing: main still pins actions/github-script@v7 at deploy-landing.yml:75. Not this branch's scope — noting it for the backlog.)

Recommended disposition

1. Evaluate the gitleaks v2→v3 change per the caveats above; if it holds up, land it as its own small PR with a green scan.
2. Close this PR without merging and delete the branch.

Preservation is already satisfied by the remote ref itself — this PR is the readable record of what was in it and why it can go.

Conflicts are intentional — do not resolve here

.github/labeler.yml (add/add) · .gitleaks.toml (add/add) · autopilot/autopilot.py (content).

Resolving them would mean rebasing, which rewrites all 9 SHAs and destroys the artifact being preserved. "Not mergeable" is the correct signal.

Expected CI noise

CI will be red — a 257-behind branch against current main. That is expected, not a defect to chase. ai_agent_workflow self-skips on draft; dependabot-automerge is actor-gated to dependabot[bot] (no auto-merge path); stale-pr-handler sets exempt-draft-pr: true. elite_copilot has no draft guard and will post one bot comment below — ignore it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GipLwSamx8HJU2pHaScFB2