From a3abc919459edccf8e5bcf19d51b706b6740de2e Mon Sep 17 00:00:00 2001
From: Chris Liao <33707455+liaochris@users.noreply.github.com>
Date: Thu, 2 Apr 2026 18:15:12 -0400
Subject: [PATCH 01/14] add contents read perm #150

---
 .github/workflows/checks.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 44e3cc6..ca9ce72 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -15,6 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 1
     permissions:
+      contents: read
       statuses: write
       pull-requests: write
 

From dbfa80b6fa5a1dab16f6a723ad095c5e758175e9 Mon Sep 17 00:00:00 2001
From: zhizhongpu <84325421+zhizhongpu@users.noreply.github.com>
Date: Mon, 6 Apr 2026 17:56:25 -0400
Subject: [PATCH 02/14] #150 bd infrastructure for making dag check exceptions
 [run-actions-all]

@liaochris
---
 .github/checks/check_sconscripts.py     | 10 +++++++---
 .github/checks/sconscript_exceptions.py |  7 +++++++
 2 files changed, 14 insertions(+), 3 deletions(-)
 create mode 100644 .github/checks/sconscript_exceptions.py

diff --git a/.github/checks/check_sconscripts.py b/.github/checks/check_sconscripts.py
index be10771..ef7dda2 100644
--- a/.github/checks/check_sconscripts.py
+++ b/.github/checks/check_sconscripts.py
@@ -4,8 +4,9 @@
 import sys
 from pathlib import Path
 
+from sconscript_exceptions import EXCLUDED_FILES, SKIP_DIRS
+
 ROOT       = Path("source")
-EXCLUDED   = {Path("source/lib"), Path("source/raw"), Path("source/scrape")}
 PAPER_DIR  = Path("source/paper")
 PAPER_EXTS = {".bib", ".tex", ".lyx"}
 
@@ -36,6 +37,7 @@ def Main():
 def CollectProblems():
     missing_dirs     = []
     missing_mentions = []
+    exceptions       = set(EXCLUDED_FILES)
     for dir_path, dir_names, file_names in os.walk(ROOT):
         dir_path = Path(dir_path)
         if IsExcluded(dir_path):
@@ -51,8 +53,10 @@ def CollectProblems():
             if parent_content is None:
                 missing_dirs.append(dir_path)
             continue
+        rel = dir_path.relative_to(ROOT).as_posix()
         for f in sorted(f for f in file_names if f != "SConscript"):
-            if ShouldCheck(dir_path, f) and not IsMentioned(content, f, dir_path):
+            path = f"source/{rel}/{f}"
+            if ShouldCheck(dir_path, f) and path not in exceptions and not IsMentioned(content, f, dir_path):
                 missing_mentions.append(f"{dir_path} -> {f}")
         for subdir in dir_names:
             if re.search(rf"\b{re.escape(subdir)}\b", content):
@@ -73,7 +77,7 @@ def CollectProblems():
 
 
 def IsExcluded(dir_path):
-    return any(dir_path == e or dir_path.is_relative_to(e) for e in EXCLUDED)
+    return any(dir_path == Path(d) or dir_path.is_relative_to(d) for d in SKIP_DIRS)
 
 
 def IsIgnored(name):
diff --git a/.github/checks/sconscript_exceptions.py b/.github/checks/sconscript_exceptions.py
new file mode 100644
index 0000000..1bf2965
--- /dev/null
+++ b/.github/checks/sconscript_exceptions.py
@@ -0,0 +1,7 @@
+# filepath: reason the checker skips this file
+EXCLUDED_FILES = {
+}
+
+# directories the checker skips
+SKIP_DIRS = [
+]

From b04db0d5781a7f8c7efed6e581a65f1b4eb6508c Mon Sep 17 00:00:00 2001
From: zhizhongpu <84325421+zhizhongpu@users.noreply.github.com>
Date: Mon, 6 Apr 2026 17:59:27 -0400
Subject: [PATCH 03/14] #150 bd pr closure post permission

---
 .github/workflows/pr-close-comment.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/pr-close-comment.yml b/.github/workflows/pr-close-comment.yml
index 5232e55..f0e372e 100644
--- a/.github/workflows/pr-close-comment.yml
+++ b/.github/workflows/pr-close-comment.yml
@@ -5,6 +5,7 @@ on:
     types: [closed]
 
 permissions:
+  contents: read
   issues: write
   pull-requests: write
 

From 71d3a50d759a61d1fa272e4d72ad142fe49ca9cc Mon Sep 17 00:00:00 2001
From: Chris Liao <33707455+liaochris@users.noreply.github.com>
Date: Mon, 6 Apr 2026 18:03:17 -0400
Subject: [PATCH 04/14] sconscript skip files in scons #150

---
 .github/checks/sconscript_exceptions.py    | 4 ++--
 .github/helper_scripts/pr_close_comment.py | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/checks/sconscript_exceptions.py b/.github/checks/sconscript_exceptions.py
index 1bf2965..dd62d68 100644
--- a/.github/checks/sconscript_exceptions.py
+++ b/.github/checks/sconscript_exceptions.py
@@ -1,7 +1,7 @@
 # filepath: reason the checker skips this file
-EXCLUDED_FILES = {
-}
+EXCLUDED_FILES = {}
 
 # directories the checker skips
 SKIP_DIRS = [
+    "source/lib",
 ]
diff --git a/.github/helper_scripts/pr_close_comment.py b/.github/helper_scripts/pr_close_comment.py
index 8685ff1..0f45ac4 100644
--- a/.github/helper_scripts/pr_close_comment.py
+++ b/.github/helper_scripts/pr_close_comment.py
@@ -2,7 +2,7 @@
 import re
 import sys
 from pathlib import Path
-from github import Github
+from github import Auth, Github
 
 ISSUE_TEMPLATE = Path(".github/post_template_issue_thread_pr_close.md")
 PR_TEMPLATE = Path(".github/post_template_pr_thread_pr_close.md")
@@ -16,7 +16,7 @@ def Main():
     branch_name     = os.environ["BRANCH_NAME"]
     last_commit_sha = os.environ["LAST_COMMIT_SHA"]
 
-    repo = Github(github_token).get_repo(repo_name)
+    repo = Github(auth=Auth.Token(github_token)).get_repo(repo_name)
     pr = repo.get_pull(pr_number)
 
     issue_comment_url = PostCommentOnIssueThread(repo, branch_name, last_commit_sha)

From 968b1e8af3254a712c9df6b9e1a5ff98e3a13efd Mon Sep 17 00:00:00 2001
From: zhizhongpu <84325421+zhizhongpu@users.noreply.github.com>
Date: Mon, 6 Apr 2026 18:24:31 -0400
Subject: [PATCH 05/14] #150 cl readability

---
 .github/checks/sconscript_exceptions.py | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/checks/sconscript_exceptions.py b/.github/checks/sconscript_exceptions.py
index dd62d68..735c531 100644
--- a/.github/checks/sconscript_exceptions.py
+++ b/.github/checks/sconscript_exceptions.py
@@ -1,7 +1,8 @@
-# filepath: reason the checker skips this file
-EXCLUDED_FILES = {}
+EXCLUDED_FILES = {
+    # "file/path": "reason the checker skips this file"
+}
 
-# directories the checker skips
 SKIP_DIRS = [
+    # directories the checker skips
     "source/lib",
 ]

From 0a54d949b07672a7c015ac1cb3f88e354da1470f Mon Sep 17 00:00:00 2001
From: zhizhongpu <84325421+zhizhongpu@users.noreply.github.com>
Date: Tue, 7 Apr 2026 13:13:05 -0400
Subject: [PATCH 06/14] #150 bd yaml version [run-actions-all]

---
 .github/checks/check_sconscripts.py       | 9 ++++++++-
 .github/checks/sconscript_exceptions.py   | 8 --------
 .github/checks/sconscript_exceptions.yaml | 5 +++++
 3 files changed, 13 insertions(+), 9 deletions(-)
 delete mode 100644 .github/checks/sconscript_exceptions.py
 create mode 100644 .github/checks/sconscript_exceptions.yaml

diff --git a/.github/checks/check_sconscripts.py b/.github/checks/check_sconscripts.py
index ef7dda2..f13ef70 100644
--- a/.github/checks/check_sconscripts.py
+++ b/.github/checks/check_sconscripts.py
@@ -3,8 +3,15 @@
 import re
 import sys
 from pathlib import Path
+import yaml
 
-from sconscript_exceptions import EXCLUDED_FILES, SKIP_DIRS
+_EXCEPTIONS_FILE = Path(__file__).parent / "sconscript_exceptions.yaml"
+
+def _LoadExceptions():
+    data = yaml.safe_load(_EXCEPTIONS_FILE.read_text(encoding="utf-8")) or {}
+    return data.get("excluded_files") or {}, data.get("skip_dirs") or []
+
+EXCLUDED_FILES, SKIP_DIRS = _LoadExceptions()
 
 ROOT       = Path("source")
 PAPER_DIR  = Path("source/paper")
diff --git a/.github/checks/sconscript_exceptions.py b/.github/checks/sconscript_exceptions.py
deleted file mode 100644
index 735c531..0000000
--- a/.github/checks/sconscript_exceptions.py
+++ /dev/null
@@ -1,8 +0,0 @@
-EXCLUDED_FILES = {
-    # "file/path": "reason the checker skips this file"
-}
-
-SKIP_DIRS = [
-    # directories the checker skips
-    "source/lib",
-]
diff --git a/.github/checks/sconscript_exceptions.yaml b/.github/checks/sconscript_exceptions.yaml
new file mode 100644
index 0000000..2a53a04
--- /dev/null
+++ b/.github/checks/sconscript_exceptions.yaml
@@ -0,0 +1,5 @@
+excluded_files:
+  # - "file/to/exclude.R": "reason for exclusion"
+
+skip_dirs:
+  - "source/lib"

From f52d0358ff7257df6a91a46d7a561c2255e9a0d3 Mon Sep 17 00:00:00 2001
From: zhizhongpu <84325421+zhizhongpu@users.noreply.github.com>
Date: Tue, 7 Apr 2026 13:15:56 -0400
Subject: [PATCH 07/14] #150 fx github bug yaml -> toml [run-actions-all]

---
 .github/checks/check_sconscripts.py       | 9 +++++----
 .github/checks/sconscript_exceptions.toml | 7 +++++++
 .github/checks/sconscript_exceptions.yaml | 5 -----
 3 files changed, 12 insertions(+), 9 deletions(-)
 create mode 100644 .github/checks/sconscript_exceptions.toml
 delete mode 100644 .github/checks/sconscript_exceptions.yaml

diff --git a/.github/checks/check_sconscripts.py b/.github/checks/check_sconscripts.py
index f13ef70..c2e2363 100644
--- a/.github/checks/check_sconscripts.py
+++ b/.github/checks/check_sconscripts.py
@@ -3,13 +3,14 @@
 import re
 import sys
 from pathlib import Path
-import yaml
+import tomllib
 
-_EXCEPTIONS_FILE = Path(__file__).parent / "sconscript_exceptions.yaml"
+_EXCEPTIONS_FILE = Path(__file__).parent / "sconscript_exceptions.toml"
 
 def _LoadExceptions():
-    data = yaml.safe_load(_EXCEPTIONS_FILE.read_text(encoding="utf-8")) or {}
-    return data.get("excluded_files") or {}, data.get("skip_dirs") or []
+    with open(_EXCEPTIONS_FILE, "rb") as f:
+        data = tomllib.load(f)
+    return data.get("excluded_files") or {}, data.get("settings", {}).get("skip_dirs") or []
 
 EXCLUDED_FILES, SKIP_DIRS = _LoadExceptions()
 
diff --git a/.github/checks/sconscript_exceptions.toml b/.github/checks/sconscript_exceptions.toml
new file mode 100644
index 0000000..fbdc63b
--- /dev/null
+++ b/.github/checks/sconscript_exceptions.toml
@@ -0,0 +1,7 @@
+[excluded_files]
+# "source/some/file.R" = "reason for exclusion"
+
+[settings]
+skip_dirs = [
+    "source/lib",
+]
diff --git a/.github/checks/sconscript_exceptions.yaml b/.github/checks/sconscript_exceptions.yaml
deleted file mode 100644
index 2a53a04..0000000
--- a/.github/checks/sconscript_exceptions.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-excluded_files:
-  # - "file/to/exclude.R": "reason for exclusion"
-
-skip_dirs:
-  - "source/lib"

From 5c841f1e1e63bf24b0cdb860a63a6ef309664a35 Mon Sep 17 00:00:00 2001
From: zhizhongpu <84325421+zhizhongpu@users.noreply.github.com>
Date: Tue, 7 Apr 2026 13:25:04 -0400
Subject: [PATCH 08/14] #150 test failure coi [run-actions-scons-dag]

---
 source/analysis/coi.txt | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 source/analysis/coi.txt

diff --git a/source/analysis/coi.txt b/source/analysis/coi.txt
new file mode 100644
index 0000000..ae97700
--- /dev/null
+++ b/source/analysis/coi.txt
@@ -0,0 +1 @@
+coi

From 9a6c44ad56ee7c8b87ca67ee92950f38158642a5 Mon Sep 17 00:00:00 2001
From: zhizhongpu <84325421+zhizhongpu@users.noreply.github.com>
Date: Tue, 7 Apr 2026 13:26:22 -0400
Subject: [PATCH 09/14] #150 [run-actions-dag]

---
 source/analysis/coi.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/source/analysis/coi.txt b/source/analysis/coi.txt
index ae97700..e5628b3 100644
--- a/source/analysis/coi.txt
+++ b/source/analysis/coi.txt
@@ -1 +1,2 @@
 coi
+

From 9b54f306dd996a87a6d4160821b025a795ec53a9 Mon Sep 17 00:00:00 2001
From: zhizhongpu <84325421+zhizhongpu@users.noreply.github.com>
Date: Tue, 7 Apr 2026 13:28:47 -0400
Subject: [PATCH 10/14] #150 [run-actions-all]

This reverts commit 9a6c44ad56ee7c8b87ca67ee92950f38158642a5.
---
 source/analysis/coi.txt | 1 -
 1 file changed, 1 deletion(-)

diff --git a/source/analysis/coi.txt b/source/analysis/coi.txt
index e5628b3..ae97700 100644
--- a/source/analysis/coi.txt
+++ b/source/analysis/coi.txt
@@ -1,2 +1 @@
 coi
-

From 1fc68d84a0819b2c11de1d87a17197d939382bf2 Mon Sep 17 00:00:00 2001
From: zhizhongpu <84325421+zhizhongpu@users.noreply.github.com>
Date: Tue, 7 Apr 2026 13:29:30 -0400
Subject: [PATCH 11/14] #150 test excluded_files [run-actions-all]

---
 .github/checks/sconscript_exceptions.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/checks/sconscript_exceptions.toml b/.github/checks/sconscript_exceptions.toml
index fbdc63b..f4cfd7b 100644
--- a/.github/checks/sconscript_exceptions.toml
+++ b/.github/checks/sconscript_exceptions.toml
@@ -1,5 +1,5 @@
 [excluded_files]
-# "source/some/file.R" = "reason for exclusion"
+"source/analysis/coi.txt" = "coi"
 
 [settings]
 skip_dirs = [

From fecf7c0cbe14afc0970b5097a17a9261d9c3b8dd Mon Sep 17 00:00:00 2001
From: zhizhongpu <84325421+zhizhongpu@users.noreply.github.com>
Date: Tue, 7 Apr 2026 14:13:34 -0400
Subject: [PATCH 12/14] #150 cl removing testing

---
 .github/checks/sconscript_exceptions.toml | 2 +-
 source/analysis/coi.txt                   | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)
 delete mode 100644 source/analysis/coi.txt

diff --git a/.github/checks/sconscript_exceptions.toml b/.github/checks/sconscript_exceptions.toml
index f4cfd7b..fbdc63b 100644
--- a/.github/checks/sconscript_exceptions.toml
+++ b/.github/checks/sconscript_exceptions.toml
@@ -1,5 +1,5 @@
 [excluded_files]
-"source/analysis/coi.txt" = "coi"
+# "source/some/file.R" = "reason for exclusion"
 
 [settings]
 skip_dirs = [
diff --git a/source/analysis/coi.txt b/source/analysis/coi.txt
deleted file mode 100644
index ae97700..0000000
--- a/source/analysis/coi.txt
+++ /dev/null
@@ -1 +0,0 @@
-coi

From ab955e9e2066d9027f8ecf670885132b7c2a3cbc Mon Sep 17 00:00:00 2001
From: zhizhongpu <84325421+zhizhongpu@users.noreply.github.com>
Date: Tue, 7 Apr 2026 17:59:20 -0400
Subject: [PATCH 13/14] #150 cl settings -> skip_dirs

---
 .github/checks/check_sconscripts.py       | 2 +-
 .github/checks/sconscript_exceptions.toml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/checks/check_sconscripts.py b/.github/checks/check_sconscripts.py
index c2e2363..d6f8287 100644
--- a/.github/checks/check_sconscripts.py
+++ b/.github/checks/check_sconscripts.py
@@ -10,7 +10,7 @@
 def _LoadExceptions():
     with open(_EXCEPTIONS_FILE, "rb") as f:
         data = tomllib.load(f)
-    return data.get("excluded_files") or {}, data.get("settings", {}).get("skip_dirs") or []
+    return data.get("excluded_files") or {}, data.get("skip_dirs", {}).get("skip_dirs") or []
 
 EXCLUDED_FILES, SKIP_DIRS = _LoadExceptions()
 
diff --git a/.github/checks/sconscript_exceptions.toml b/.github/checks/sconscript_exceptions.toml
index fbdc63b..b463afe 100644
--- a/.github/checks/sconscript_exceptions.toml
+++ b/.github/checks/sconscript_exceptions.toml
@@ -1,7 +1,7 @@
 [excluded_files]
 # "source/some/file.R" = "reason for exclusion"
 
-[settings]
+[skip_dirs]
 skip_dirs = [
     "source/lib",
 ]

From 2196f95b23823aee7a24327142ae8ba3cb630776 Mon Sep 17 00:00:00 2001
From: zhizhongpu <84325421+zhizhongpu@users.noreply.github.com>
Date: Tue, 7 Apr 2026 20:07:34 -0400
Subject: [PATCH 14/14] #150 bd unify exclusion architecture [run-actions-all]

---
 .github/checks/check_sconscripts.py       | 15 ++++++++++-----
 .github/checks/sconscript_exceptions.toml | 10 ++++------
 2 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/.github/checks/check_sconscripts.py b/.github/checks/check_sconscripts.py
index d6f8287..7afd8ca 100644
--- a/.github/checks/check_sconscripts.py
+++ b/.github/checks/check_sconscripts.py
@@ -1,4 +1,5 @@
 #!/usr/bin/env python3
+import fnmatch
 import os
 import re
 import sys
@@ -10,9 +11,9 @@
 def _LoadExceptions():
     with open(_EXCEPTIONS_FILE, "rb") as f:
         data = tomllib.load(f)
-    return data.get("excluded_files") or {}, data.get("skip_dirs", {}).get("skip_dirs") or []
+    return data.get("exceptions", {}).get("patterns") or []
 
-EXCLUDED_FILES, SKIP_DIRS = _LoadExceptions()
+EXCEPTIONS = _LoadExceptions()
 
 ROOT       = Path("source")
 PAPER_DIR  = Path("source/paper")
@@ -45,7 +46,6 @@ def Main():
 def CollectProblems():
     missing_dirs     = []
     missing_mentions = []
-    exceptions       = set(EXCLUDED_FILES)
     for dir_path, dir_names, file_names in os.walk(ROOT):
         dir_path = Path(dir_path)
         if IsExcluded(dir_path):
@@ -64,7 +64,7 @@ def CollectProblems():
         rel = dir_path.relative_to(ROOT).as_posix()
         for f in sorted(f for f in file_names if f != "SConscript"):
             path = f"source/{rel}/{f}"
-            if ShouldCheck(dir_path, f) and path not in exceptions and not IsMentioned(content, f, dir_path):
+            if ShouldCheck(dir_path, f) and not IsExcludedFile(path) and not IsMentioned(content, f, dir_path):
                 missing_mentions.append(f"{dir_path} -> {f}")
         for subdir in dir_names:
             if re.search(rf"\b{re.escape(subdir)}\b", content):
@@ -85,7 +85,12 @@ def CollectProblems():
 
 
 def IsExcluded(dir_path):
-    return any(dir_path == Path(d) or dir_path.is_relative_to(d) for d in SKIP_DIRS)
+    s = str(dir_path)
+    return any(fnmatch.fnmatch(s, p) or p.startswith(s + "/") for p in EXCEPTIONS)
+
+
+def IsExcludedFile(path):
+    return any(fnmatch.fnmatch(path, p) for p in EXCEPTIONS)
 
 
 def IsIgnored(name):
diff --git a/.github/checks/sconscript_exceptions.toml b/.github/checks/sconscript_exceptions.toml
index b463afe..bc5b5ce 100644
--- a/.github/checks/sconscript_exceptions.toml
+++ b/.github/checks/sconscript_exceptions.toml
@@ -1,7 +1,5 @@
-[excluded_files]
-# "source/some/file.R" = "reason for exclusion"
-
-[skip_dirs]
-skip_dirs = [
-    "source/lib",
+[exceptions]
+patterns = [
+    "source/lib/*",
+    # "source/some/file.R"
 ]