Extract executable GitHub Actions logic into tested helpers

[cv]

Goal

Move substantial executable programs out of GitHub Actions YAML and into directly testable helpers, while leaving YAML responsible for triggers, permissions, job topology, environment wiring, and short invocations.

This is a behavior-preserving maintainability effort. It does not authorize changes to CI policy, supported platforms, release behavior, E2E coverage, permissions, or product scope.

Audit snapshot

Snapshot: 6a813d44c3b0e8b40a00c07d54117bd3af031223.

• .github contains 53 YAML files and 13,800 lines.
• Those files contain 462 run: or script: blocks with 5,437 body lines, 4,935 of them nonblank.
• .github/workflows/e2e.yaml contains 1,749 nonblank executable lines across 217 blocks.
• .github/workflows/codebase-growth-guardrails.yaml contains 638 nonblank executable lines; two embedded Node programs account for 581.
• .github/workflows/pr-review-advisor.yaml contains 353 nonblank executable lines.
• .github/workflows/label-merged-pr-release-target.yaml contains a deliberate 343-line inline JavaScript trust-boundary exception.
• .github/workflows/platform-vitest-main.yaml and .github/workflows/wsl-e2e.yaml contain 362 nonblank executable lines combined.
• The two base-image resolver composite actions contain 184 nonblank shell lines.

The broader repository contains 142 YAML files and about 20.8k lines, but blueprint, policy, manifest, test-manifest, issue-form, and documentation-navigation YAML is declarative data and is not an extraction target.

Categorization

Category	Examples	Disposition
Existing helper can own more behavior	tools/e2e/workflow-plan.mts, tools/e2e/pr-e2e-gate.mts, tools/pr-review-advisor/, scripts/check-test-file-size-budget.*, scripts/find-test-conditionals.*, scripts/scorecard/	Extend the existing owner and leave a thin workflow invocation.
Cohesive new helper is justified	ShellCheck SARIF conversion, WSL provisioning drivers, base-image resolver primitives, Brev lifecycle operations	Add one direct helper per current responsibility with focused tests.
Privileged or secret-bearing extraction needs a pinned trust boundary	E2E PR publishing, Docker authentication, host setup, branch-validation reporting	Execute only a trusted workflow revision or immutable first-party action; never execute PR-controlled helper code with write tokens, secrets, Docker privileges, or sudo.
Keep inline	Short commands, expressions, action wiring, job-specific environment, ordering, and permissions	YAML remains the orchestration layer.
Deliberate exception	label-merged-pr-release-target.yaml	Keep the exact inline actions/github-script program unless maintainers separately approve a pinned-action deployment model. Its current tests require no checkout and no repository-file execution.

Scope rules

• Preserve stdout/stderr, exit codes, outputs, summaries, artifacts, retries, timeouts, and ordering.
• Preserve every permission and trust boundary. A refactor must not turn PR data into executable code.
• Prefer existing helpers and owners. Add a new helper only for a concrete current consumer and protect it with direct tests.
• Replace source-extraction tests that execute code copied from YAML with direct helper tests; retain small workflow-boundary tests for wiring, source trust, permissions, and ordering.
• Do not introduce a workflow generator, generalized CI framework, compatibility layer, or configuration surface.
• Do not extract one-to-three-line commands merely to reduce a line count.
• Re-run the executable-YAML inventory after each workstream and report the reduction without setting a numeric quota that encourages opaque compression.

Dependencies and active work

• PR chore(scripts): migrate source and test analysis tools to .mts #6935 / issue Migrate source and test analysis tools to .mts #6922 is renaming the analysis helpers that the growth-guardrail extraction should reuse.
• Issue Migrate E2E scorecard modules to .mts #6927 owns the .mts migration of the existing E2E scorecard modules; the scorecard-orchestration task below follows it without duplicating it.
• Issue ci: auto-retrigger branch-validation E2E on every commit and run advisors on fork PRs via workflow_run #6145 is actively changing branch-validation and advisor workflow behavior; affected tasks must rebase their inventory before implementation.
• Issue Run speculative compatibility tests against candidate OpenShell, OpenClaw, Hermes, and DCode versions #6691 owns candidate-compatibility behavior. Its workflow is already mostly a thin wrapper around tools/candidate-compat.mts and is not a separate extraction workstream here.

Completion

• All attached sub-issues are complete or explicitly closed with a maintainer rationale.
• Remaining inline programs longer than 20 nonblank lines have a concrete trust-boundary or orchestration rationale.
• Workflow-boundary tests assert security and wiring; helper tests assert behavior.
• The final audit records before/after executable-line and block counts and confirms no CI behavior or permissions changed.

Sub-issue tracker

• Extract codebase growth guardrails into a trusted TypeScript tool #6953 — Extract codebase growth guardrails into a trusted TypeScript tool
• Move E2E plan validation and output generation into tools/e2e #6955 — Move E2E plan validation and output generation into tools/e2e
• Move E2E PR result reporting into a trusted helper #6954 — Move E2E PR result reporting into a trusted helper
• Move E2E scorecard orchestration into the scorecard modules #6963 — Move E2E scorecard orchestration into the scorecard modules
• Move PR Review Advisor workflow programs into tools/pr-review-advisor #6956 — Move PR Review Advisor workflow programs into tools/pr-review-advisor
• Move PR E2E gate polling and evidence handling into tools/e2e #6960 — Move PR E2E gate polling and evidence handling into tools/e2e
• Share sandbox base-image resolver primitives outside composite-action YAML #6957 — Share sandbox base-image resolver primitives outside composite-action YAML
• Move WSL provisioning programs out of workflow YAML #6958 — Move WSL provisioning programs out of workflow YAML
• Move ShellCheck SARIF conversion into a tested helper #6959 — Move ShellCheck SARIF conversion into a tested helper
• Move Brev branch-validation lifecycle logic into trusted tools/e2e helpers #6962 — Move Brev branch-validation lifecycle logic into trusted tools/e2e helpers
• Consolidate repeated live E2E invocation and Docker-auth setup into pinned helper actions #6961 — Consolidate repeated live E2E invocation and Docker-auth setup into pinned helper actions