feat(ci): org-control plane quality pass — security, tests, DRY, observability - #2

Merged

dnplkndll merged 9 commits into

mainfrom

chore/document-pat-workflows-scope

May 20, 2026

Commits on May 19, 2026

docs(ci): clarify PAT needs Workflows:write — distributor writes .github/workflows/*
dnplkndll
committed

Commits on May 20, 2026

fix(digest): treat 404 "Branch not found" as skipped, not failed
dnplkndll
committed
sec: pin 3rd-party actions to commit SHAs
dnplkndll
committed
ci: add concurrency lock + heredoc \$GITHUB_OUTPUT
dnplkndll
committed
refactor(scripts): extract shared github HTTP helper + friendlier missing-token error
dnplkndll
committed
feat(digest): surface distributor outcomes in the email body
dnplkndll
committed
test: pytest coverage for parser + sync state mapping + renderer
dnplkndll
committed
docs: repo-root README + clarify PAT resource-owner trap
dnplkndll
committed
fix(forks): stop syncing OpenUpgrade's `ledoent` CI overlay branch
dnplkndll
committed