What
A static audit temper can run from workflow files alone: flag any workflow triggered by an event that the repo's own automation raises with GITHUB_TOKEN — because GitHub does not start workflow runs from GITHUB_TOKEN-raised events, so the workflow never fires. No error, no red check, no failed run. Just an absent artifact.
Check shape: for each workflow triggered on release: / push: tags:, is the event produced by another workflow in the same repo using GITHUB_TOKEN (rather than a PAT/App token or a human)? If yes, the downstream workflow is dead code.
Why — gale shipped three releases with no compliance report
gale's compliance.yml triggers on release: published; release.yml creates releases with GITHUB_TOKEN. The compliance workflow has run on a release once (v0.4.0) — v0.5.0, v0.6.0, and v0.7.0 all published without it, unnoticed (gale#333; reported in gale#323 and on #62).
"It fails silently, which is the worst property a gap can have, and it is the kind of cross-workflow invariant no single repo's CI will ever catch about itself" — which makes it exactly temper-shaped.
Acceptance
- Audit runs across all managed repos; gale's case is detected as the known-positive control.
- Report includes the fix options (App token, PAT,
workflow_call chaining, or explicit dispatch).
From the 2026-09 org feedback round (temper#62).
What
A static audit temper can run from workflow files alone: flag any workflow triggered by an event that the repo's own automation raises with
GITHUB_TOKEN— because GitHub does not start workflow runs fromGITHUB_TOKEN-raised events, so the workflow never fires. No error, no red check, no failed run. Just an absent artifact.Check shape: for each workflow triggered on
release:/push: tags:, is the event produced by another workflow in the same repo usingGITHUB_TOKEN(rather than a PAT/App token or a human)? If yes, the downstream workflow is dead code.Why — gale shipped three releases with no compliance report
gale's
compliance.ymltriggers onrelease: published;release.ymlcreates releases withGITHUB_TOKEN. The compliance workflow has run on a release once (v0.4.0) — v0.5.0, v0.6.0, and v0.7.0 all published without it, unnoticed (gale#333; reported in gale#323 and on #62)."It fails silently, which is the worst property a gap can have, and it is the kind of cross-workflow invariant no single repo's CI will ever catch about itself" — which makes it exactly temper-shaped.
Acceptance
workflow_callchaining, or explicit dispatch).From the 2026-09 org feedback round (temper#62).