ci: open an issue when the weekly integration run fails

[rubas-agent]

Before

.github/workflows/integration.yml at main ends with one step. Nothing reports a failed weekly run, so it shows only as a GitHub e-mail.

      - name: Run integration tests
        run: task test:integration

The fixture cache in .github/actions/setup/action.yml lists a file that no longer exists, and misses the VAD model:

        path: |
          test/fixtures/ggml-tiny.en.bin
          test/fixtures/ggml-tiny.bin
          test/fixtures/jfk.wav
        key: ${{ runner.os }}-fixtures-v1

Problem

The integration run exists to catch upstream model and audio rot within a week. A failure opens no issue, so nobody hears of it. security.yml already opens and closes an issue, but its 50 lines of JS live inline in that workflow.

After

The new composite action .github/actions/report-failure holds the JS. security.yml and integration.yml both call it. On failure it opens or comments on the issue Integration Tests Failed (labels integration, automated). On the next green run it comments and closes the issue.

The dispatch run on this branch is green, and the resolve step ran without an error: https://github.com/rubas/whisper_cpp/actions/runs/38914300860

✓ End-to-end transcription in 1m39s
  ✓ Run integration tests
  - Report integration failure
  ✓ Resolve integration issue on success
##[end-action id=__self_3.__actions_github-script;outcome=success;conclusion=success;duration_ms=573]

The fixture cache now saves the VAD model, and its key changes when test/support/fixtures.ex changes:

Cache saved with key: Linux-fixtures-44c1e533420052c0c20ac28eb5a1319b49711bcc935338bc1f6ed5114cbb697c

security.yml passes the same title, labels, and issue text as before. This is the diff of the moved JS, from the two steps of security.yml at main to the action (whitespace ignored):

@@ -1,10 +1,9 @@
 const owner = context.repo.owner;
 const repo = context.repo.repo;
-const title = 'Security Audit Failed';
-const labels = [
-  { name: 'security', color: 'd73a4a', description: 'Security-relevant' },
-  { name: 'automated', color: 'ededed', description: 'Created by automation' },
-];
+const { RESULT: result, TITLE: title, SUBJECT: subject } = process.env;
+const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
+if (result === 'failure') {
+  const labels = JSON.parse(process.env.LABELS);
 for (const label of labels) {
   try {
     await github.rest.issues.getLabel({ owner, repo, name: label.name });
@@ -14,8 +13,7 @@
   }
 }
 const date = new Date().toISOString().split('T')[0];
-const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
-const body = `The security audit failed on ${date}. See the [workflow run](${runUrl}).`;
+  const body = `The ${subject} failed on ${date}. See the [workflow run](${runUrl}).`;
 const { data: open } = await github.rest.issues.listForRepo({
   owner, repo, state: 'open', labels: labels.map(label => label.name).join(','), per_page: 100,
 });
@@ -31,10 +29,8 @@
     title, body, labels: labels.map(label => label.name),
   });
 }
-const owner = context.repo.owner;
-const repo = context.repo.repo;
-const title = 'Security Audit Failed';
-const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
+} else if (result === 'success') {
+  const passed = subject.charAt(0).toUpperCase() + subject.slice(1);
 const { data: open } = await github.rest.issues.listForRepo({
   owner, repo, state: 'open', per_page: 100,
 });
@@ -42,10 +38,13 @@
   await github.rest.issues.createComment({
     owner, repo,
     issue_number: issue.number,
-    body: `Security audit passed. Closing. See the [workflow run](${runUrl}).`,
+      body: `${passed} passed. Closing. See the [workflow run](${runUrl}).`,
   });
   await github.rest.issues.update({
     owner, repo,
     issue_number: issue.number, state: 'closed',
   });
 }
+} else {
+  throw new Error(`result must be 'failure' or 'success', got '${result}'`);
+}

Details

Cause. .github/workflows/integration.yml:jobs.integration has no if: failure() step. .github/actions/setup/action.yml step Cache integration fixtures still lists test/fixtures/jfk.wav, which moved to test/support/, and misses test/fixtures/ggml-silero-v5.1.2.bin, which test/support/fixtures.ex downloads.

Design. One composite action instead of a second copy of the JS. It takes result (failure or success), title, subject, and labels (a JSON array of {name, color, description}). subject keeps the issue text of security.yml word for word ("The security audit failed on ...", "Security audit passed. Closing."). All inputs reach the script through env:, so zizmor finds no template injection. actions/github-script stays pinned to 3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0. The integration job gets issues: write.

Tests.

• zizmor --offline --persona=pedantic .github/workflows .github/actions/report-failure: "No findings to report".
• actionlint 1.7.12 reports only findings that main already has: it does not know the same-repository uses: $/... syntax, and SC2209 on the existing MIX_ENV=test mix hex.audit line.
• A Bun run of the script with a mocked github client covered four cases: failure with an open issue (creates the missing label, comments), failure without an issue (creates it with labels), success (comments and closes), and a bad result (throws).
• The dispatch run above exercised the success path and the $/ action ref on GitHub.