feat(ci): sweep every default branch we own, file one issue

[abrichr]

The finding, verified against origin/main and the live organisation today

It held, and it is worse than stated.

openadapt-grounding, openadapt-retrieval and openadapt-viewer all had Release and PyPI Publish failing on main from 2026-02-18. All three failed again on a push at 2026-07-28T00:04Z — five months later. All three were switched to workflow_dispatch-only at 2026-07-28T02:22Z, roughly two hours before this branch was written.

The cross-repository gap is real too. Four repositories carry a release-health workflow — openadapt-flow, openadapt-capture, openadapt-desktop, OpenAdapt — and each .github/release-health.json hardcodes exactly one repository ("repository": "OpenAdaptAI/openadapt-flow" and siblings). They ask a different question: is releasable work unpublished? None of them reads another repository's Actions API, and none asks whether a default branch is green. bin/oa-green asks exactly the right question and is a local script that nothing runs on a schedule.

No existing general mechanism was found to extend.

What this adds

One scheduled job, here, because this repository already owns repos.yml and already files and updates one issue on a daily cron in published-version-claims.yml.

• scripts/sweep_default_branch_ci.py — standard library only, no dependency install.
• .github/workflows/default-branch-sweep.yml — cron: '11 7 * * *', offset from the 06:41 version-claims job.
• tests/test_sweep_default_branch_ci.py — 21 tests that prove the classifier fires on the real incidents and stays quiet on the noise.

Classification is ported from bin/oa-green, not re-derived. cancelled, timed_out, startup_failure and "still running" are not green. A red newest run is interrogated before it is believed: deleted, disabled, or no longer push/pull_request-triggered means retired, which is frozen history and is never reported as a failure. A green run on a head SHA that is not current is a note.

Two corrections to oa-green, both from evidence

1. Retirement only excuses a failure that predates it. oa-green documents this limit itself: "switching a workflow to workflow_dispatch quiets this tool about it". The three release repositories above are exactly that case. A red run that started after the commit that retired the workflow ran under the current configuration and is live. Costs one extra read, only for a workflow that is already red.
2. An in-flight run gets a 6-hour grace period. oa-green is a point-in-time check a human runs before acting, so any in-flight run correctly fails it. A daily cron alerting on every in-flight run would flap for a reason that is not a defect.

Two smaller rules keep the report readable: a dynamic/ workflow path is GitHub's own synthesised workflow (Dependabot, CodeQL default setup) so the file questions do not apply to it, and a stale green run is only worth reporting for a workflow that is actually push-gated — a nightly workflow is supposed to have last run on an older commit. Without that second rule the report today carried 35 meaningless lines.

Design choices

Repository list: the live organisation listing, not repos.yml. repos.yml is the docs-site registry — 13 entries that deliberately omit internal tooling "so a product evaluator sees the product, not the toolshed". It is correct for its purpose and wrong for this one: it omits roughly 20 repositories we own, including this one. Archived repositories are excluded (frozen history, unrepairable) and forks are excluded — AGENTS.md is explicit that a red branch on an upstream we forked is not our business.

One issue, updated in place. Reopened if closed, closed with a comment when everything is green. No "all green" post.

Permissions: no new secret. A public repository's Actions API is readable with no authentication at all, so the default repository-scoped GITHUB_TOKEN covers all 26 public repositories. The 8 private ones return 404 to it and are listed as "not readable", never as failures. An optional OA_SWEEP_TOKEN with actions:read covers them if it is ever set; the job works without it.

Cost. Standard library, no uv sync, no lockfile, no cache. Measured today: 72 seconds and 159 API reads for 34 repositories, against a 1000/hour budget. Every list call sets an explicit per_page; the only pagination loop is the organisation listing. This repository is public, so the Actions minutes are free.

Proof it works — real run against the live organisation, 2026-07-28

swept 34 repositories in 159 API reads; 1 not green

1 of 34 repositories we own do not have a genuinely green default branch.

OpenAdaptAI/openadapt-wright (main)

• Deploy Worker — newest run concluded failure on e99cdbe; the workflow file changed afterwards (2026-07-28T02:22:22Z), so re-run it to find out whether the fix took

That one is real: Deploy Worker failed 9 for 9 from 2026-03-02 to 2026-03-19 because FLY_API_TOKEN does not exist, it is still push-gated on main, and no green run exists. It is path-filtered, so nothing has triggered it since.

The collapsed "green, with notes" section correctly records the three release workflows as not-push-gated with the retirement timestamp, so if the next dispatched release fails, this job reports it.