github-pipeline-audit

GitHub + Build Pipeline Audit

Confirm that nothing is outstanding across GitHub and CI, and that everything that should be current is current.

Outcome

Produce a clean-state report: one row per surface, each either CLEAN or with a precise, actionable finding. The audit is only complete when every surface in the checklist below has been positively checked — "I didn't see anything" is not a result, CLEAN requires having run the query.

The governing principle: a green PR check is not the same as a healthy pipeline. Several of the most damaging conditions this repo has hit are invisible from the PR and issue lists — the Dependabot updater silently failing so no security PRs are ever raised, a stale dependency-graph snapshot generating dozens of phantom alerts, a local checkout hundreds of commits behind. Sections 2, 5 and 6 exist specifically to catch the failures that do not announce themselves.

Prerequisites

gh auth status --hostname github.com     # needs repo scope
bk api "user" >/dev/null && echo "bk CLI ok"

• gh CLI authenticated (or GITHUB_TOKEN with repo scope).
• The locally-authenticated bk CLI for Buildkite. Do not use the Buildkite API tokens in AWS Secrets Manager for logs — they deliberately lack the read_build_logs scope and return "doesn't have the read_build_logs scope". They are fine for build state, triggering and retrying.
• The gh token typically lacks read:project, so projectsV2 GraphQL queries fail. That is expected — report Projects as "not checkable with current token scopes" rather than as clean.

Set once:

R=mock-server/mockserver-monorepo

---

0. Check the checkout is current — do this FIRST

Every subsequent version claim depends on it. A stale checkout produces confident, wrong answers: it will report already-fixed vulnerabilities as open, and validating a merged fix against it yields a false negative.

git fetch origin
git rev-list --count master..origin/master   # MUST be 0
git status -sb | head -3