ci(pm): make the half-state patrol callable instead of copied

[os-try-charles]

Part of #18471

Ruling on the card: batch #144 item 1, letter 只做②, comment 5713650969. Verbatim scope line:

「objectstack 建 reusable workflow / composite action;三姊妹仓 uses: 钉 sha,常量走 with:;删副本;#18466 并入」。Clause-②: no (CI wiring, no published contract).

This PR is the objectstack half only — the thing the sibling boards will call, plus this repo wired up as its first consumer. The cloud / objectui / hotcrm migrations live in repositories this session cannot reach, so the card stays open and Part of is deliberate.

The measurement that is the card's argument

scripts/pm/check-half-states.mjs is 36,176 lines, read at origin/main 24d0542e6 on 2026-09-20T01:17Z in this checkout. The ruling three days earlier cites 32,233. That is +12% in three days on a file every sibling board carried as a hand-made copy, and it is the whole case for the change: a copy of a file moving at that rate is behind by arithmetic, not by carelessness.

What a sibling had to copy and keep current, at that same tree:

file	lines
scripts/pm/check-half-states.mjs	36,176
scripts/invoked-as.mjs	394
.github/workflows/half-state-patrol.yml	473
total	37,043

After this lands, a sibling's install is the ~15-line caller shown below, and zero copied script lines.

Composite action, not a reusable workflow — and why

The ruling left the choice to the implementer. The repo holds exactly one precedent of each: .github/actions/setup-pnpm (its only composite action) and .github/workflows/docker-publish.yml (its only workflow_call file). Both were read before choosing. One mechanical property decides it:

• uses: OWNER/REPO/.github/actions/NAME@SHA makes the runner place the whole repository at that sha on disk and exposes it as github.action_path. GitHub documents that path as the way to "access other files in that action's repository". So the sweeper and the helper it imports arrive with the action, at the same sha, with no credential and no second checkout.
• workflow_call transfers the YAML file only. The repository's contents are not placed on the runner, so a reusable patrol would have to actions/checkout this repo itself — and then the ref a sibling pins and the ref a sibling executes become two things kept equal by hand. That is the copy problem again, one layer down.

The composite shape has no such seam, so the install list is deleted rather than lengthened. In its place the action's first step positively locates the sweeper and the helper under github.action_path/../../.. and fails by name when they are not there. A list of files to copy is a hand-kept mirror of an import graph; this repo measured that list wrong twice (two files until 2026-09-03 while the sweeper had imported a third for weeks, then short by four again a fortnight later). An assertion cannot be short from memory.

The input surface — the only thing a sibling migration has to read

.github/actions/half-state-patrol

input	required	default	what it carries
github-token	yes	—	the calling workflow's own secrets.GITHUB_TOKEN. Needs issues: write (the one anchor PATCH) and contents: read. ⛔ Never a cross-repo PAT.
anchor-issue	no, but enforced at runtime	''	the number of the tracking-labeled anchor issue in the calling repository. Empty makes the run say so loudly and fail; it never guesses a number.
closed-floor	no	''	passed through as PM_SWEEP_CLOSED_FLOOR, a YYYY-MM-DD floor for the sweeper's closed-card pass. Per-board by nature: a board's floor is a date in its own history. Empty means unset, the sweeper's own default.

Derived, deliberately not inputs:

• PM_SWEEP_REPO is github.repository, which inside an action invoked from another repo is the calling repository. A board identifier that can be typed is one that can be typed wrong, and a patrol sweeping the repo it was installed from would file a fully green report about the wrong board.
• write vs dry-run comes from github.event_name: a pull_request run proves the sweep and never touches the board. That is a safety property, not a per-board constant, so no caller can opt out of it.

Stays in the caller, by design: the on: triggers (the cron minute is per-board — it is offset against that board's healer cycle), permissions, concurrency, timeout-minutes, actions/checkout and actions/setup-node.

A sibling board's whole install:

name: Half-State Patrol
on:
  schedule:
    - cron: '37 1,7,13,19 * * *'
  workflow_dispatch: {}
permissions:
  contents: read
  issues: write
concurrency:
  group: half-state-patrol
  cancel-in-progress: false
jobs:
  patrol:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: '22'
      - uses: objectstack-ai/objectstack/.github/actions/half-state-patrol@PINNED_SHA
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          anchor-issue: ${{ vars.HALF_STATE_ANCHOR_ISSUE }}

plus one tracking-labeled anchor issue opened in that repo. ⛔ A sha, never @main — @main is this same drift re-entered from the other side, with no reviewed moment and nothing to roll back to.

Two steps that deliberately did NOT move, and the gates that decide it

Both are cases of the trap .github/actions/setup-pnpm already records for the same reason: a gate whose population comes from .github/workflows/ keeps printing OK while auditing less.

1. actions/setup-node. scripts/check-node-version.mjs scans .github/workflows/*.yml only and reports how many setup-node steps it audited. A step moved into the action would drop out of that census silently. Callers keep their own step with its literal pin — exactly what the setup-pnpm header prescribes. Because that gate cannot reach a sibling repo at all, the action reads the .nvmrc that travelled with it and refuses a runner below that floor, naming the remedy. No second hand-written Node pin was introduced.
2. The closed-card sweep. scripts/check-self-test-wired.mjs builds its population from the scripts a workflow names, and this workflow holds CI's only invocation of node scripts/pm/sweep-closed-cards.mjs --self-test (lint.yml runs check:pm-half-states but not check:pm-closed-card-sweep). Moving that step into the action would have left the gate green while auditing one script fewer. It is also the one step of the old file that was never repo-agnostic — it writes to cards under a ruling only this board has taken — so leaving it in the objectstack caller states plainly what its if: github.repository == ... used to state obliquely.

The one behaviour change

The closed-card sweep now runs after the patrol instead of before it, guarded by !cancelled() rather than an implicit success(). The anchor's content is unaffected — the half-state sweep still reads the board before this step touches it — and the patrol's product, the anchor write, can no longer be starved by anything this step does, which is what the old placement's own comment asked for and did not get.

Verification

Measured here:

• Both files parse as YAML, and the parsed structure is what was intended: the action is using: composite with 7 steps and 3 inputs; the workflow keeps its three triggers, permissions, concurrency and 4 steps. The folded anchor-issue scalar collapses to one line, which is the property its comment warns about.
• The pull_request paths: list gained .github/actions/half-state-patrol/**, so an edit to the patrol's body is exercised before it merges. That row is load-bearing: without it, moving the body out of the workflow would have moved it out of its own PR-time proof.
• The gate family for these two paths was derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands ... and run; results are in the report on the card.

NOT MEASURED — no runner executed any of this from a sibling repository, and nothing below should be read as a pass:

• That the runner places the whole objectstack tree at github.action_path for a cross-repo composite action. This is documented behaviour and is the premise of the whole design; it is not verifiable from inside this repo. It is asserted at runtime instead: the action's first step fails by name, naming the resolved root and the missing file, rather than proceeding into a patrol whose sweeper is absent.
• That a private sibling repo can uses: this public repo's action pinned to a sha with no credential. The card and the ruling both measured the public/private fact behind it; the call itself is unexercised until a sibling migrates.
• The anchor PATCH and the sibling-side with: plumbing.

This PR's own pull_request trigger runs the patrol on a real runner through the local action path, which is the closest available exercise of the composite body (step ordering, always(), the step outputs, the sweep and the rendered summary) and writes nothing to the board.

Landing

Kept draft on purpose. auto_merge is measured permanently 422 on the .github/workflows/** surface, so this wants a human merge; the PM decides arming after reading the green predicate. No changeset: nothing under .github/** is shipped by any package's files[].

#18466 is not addressed here and remains open; the ruling absorbs it and a pointer is already on it.

---

Generated by Claude Code