ci(todos): stop the scanner filing its own permission comment as a work item

[devantler]

Why

The to-do scanner opened issue #14, "tracking issues.", because the comment explaining the scanner's own permissions contained the exact marker word it searches for. The issue describes no real work and adds noise to the backlog and project board.

What

Rewords that comment in lowercase, the same convention the shared actions repository already uses in the scanner's own sources, so the scanner no longer treats it as a work item. The scanner's permissions and behaviour are unchanged; on merge the removed marker also lets the scanner close the stray issue.

Fixes #14

🤖 Generated with Claude Code

https://claude.ai/code/session_011Aut24ni8XbKPYyY5mYrbb

---

Generated by Claude Code

[devantler]

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Root cause. #14's body cites .github/workflows/todos.yaml#L13-L14 at 127b3f2: the scanner took the uppercase marker inside the job's issues: write permission comment as a work item, used the rest of that comment ("tracking issues.") as the title, and the next line's # v13.2.3 comment as the body. The comment exists only in this repository's hardened copy of the template-owned workflow (devantler-tech/go-template declares permissions at top level and carries no such comment), so the fix belongs here.

RED / GREEN (a whole-word search for the uppercase marker, the token the scanner keys on per devantler-tech/actions scan-for-todo-comments.yaml, which spells its own mentions in lowercase for exactly this reason):

• RED at ebe70b8 (main): git grep -n -w TODO -- . ':!*.sum' → exactly one hit, .github/workflows/todos.yaml:13: issues: write # Create and update TODO tracking issues., the line tracking issues. #14 was filed from.
• GREEN at 21f2e3d: the same search exits 1 with no hits. No other false-positive marker exists in the repository.

Validation. actionlint .github/workflows/todos.yaml exit 0; the job's permissions parse unchanged (contents: read, issues: write); git diff --check clean; yamllint config disables line-length, so the longer comment is within repository rules. Not runnable here: zizmor (not installed in this environment); the diff is a comment-only change, so no permission, trigger, or reference changed.

Behaviour. The runtime surface is the hosted scanner on pushes to main, which this environment cannot run (it is a container image). The observable effect after merge: the scanner's diff-based pass sees the marker removed and, with CLOSE_ISSUES: true, closes #14 rather than leaving it open, and no new stray issue is filed from this line.

---

Generated by Claude Code

[github-actions]

✅⚠️MegaLinter analysis: Success with warnings

Descriptor	Linter	Files	Fixed	Errors	Max errors	Warnings	Elapsed time
✅ ACTION	actionlint	6		0		0	0.09s
✅ ACTION	zizmor	6	0	0		0	1.37s
✅ BASH	bash-exec	13		0		0	0.1s
✅ BASH	shellcheck	13		0		0	1.12s
✅ BASH	shfmt	13	0	0		0	0.05s
✅ COPYPASTE	jscpd	yes		no		no	1.01s
✅ CSS	stylelint	2	0	0		0	1.78s
✅ DOCKERFILE	hadolint	2		0		0	0.09s
✅ EDITORCONFIG	editorconfig-checker	124		0		0	0.29s
✅ HTML	djlint	2		0		0	1.56s
✅ HTML	htmlhint	2		0		0	0.32s
✅ JSON	jsonlint	2		0		0	0.11s
✅ JSON	prettier	2	0	0		0	0.69s
✅ JSON	v8r	2		0		0	1.81s
⚠️ MARKDOWN	markdownlint	13	0	2		0	1.5s
✅ MARKDOWN	markdown-table-formatter	13	0	0		0	0.26s
✅ REPOSITORY	betterleaks	yes		no		no	1.01s
✅ REPOSITORY	checkov	yes		no		no	24.94s
✅ REPOSITORY	git_diff	yes		no		no	0.03s
✅ REPOSITORY	grype	yes		no		no	76.34s
✅ REPOSITORY	osv-scanner	yes		no		no	0.39s
✅ REPOSITORY	secretlint	yes		no		no	1.46s
✅ REPOSITORY	syft	yes		no		no	2.61s
✅ REPOSITORY	trivy	yes		no		no	13.73s
✅ REPOSITORY	trivy-sbom	yes		no		no	0.87s
✅ REPOSITORY	trufflehog	yes		no		no	3.81s
✅ SPELL	lychee	55		0		0	1.65s
✅ YAML	prettier	25	0	0		0	1.39s
✅ YAML	v8r	38		0		0	10.32s
✅ YAML	yamllint	29		0		0	0.95s

Detailed Issues

⚠️ MARKDOWN / markdownlint - 2 errors

CLAUDE.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "@AGENTS.md"]
GEMINI.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "@AGENTS.md"]

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

---

Generated by Claude Code

[coderabbitai]

@devantler I’ll review the changes in #93.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 6a7b42ef-fb88-496f-a6eb-08158f8b89b9

📥 Commits

Reviewing files that changed from the base of the PR and between ebe70b8 and 21f2e3d.

📒 Files selected for processing (1)

• .github/workflows/todos.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

🔇 Additional comments (1)

.github/workflows/todos.yaml (1)

13-13: LGTM!

---

📝 Walkthrough

Walkthrough

The workflow’s issues: write permission comment now describes creating and updating to-do tracking issues. It also notes that the scanner files the uppercase “TODO” marker. No functional or configuration changes were made.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 21f2e

The revised comment should no longer create a work item, and the scanner is configured to close the matching prior issue. Its live closure was not verified, but no material merge risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Issue #14 identifies the issues: write permission comment as the source of the tracking issue. The reviewed workflow changes that comment from TODO to to-do and does not include the uppercase ma…
Out of Scope Changes check	✅ Passed	The supplied change summary shows one modified line in .github/workflows/todos.yaml. The change updates only the comment that caused issue #14. No unrelated source, permission, or workflow behavior …
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Title check	✅ Passed	The title clearly identifies the main change: preventing the TODO scanner from treating its own permission comment as a work item.
Description check	✅ Passed	The description directly explains the scanner issue, the comment rewording, unchanged permissions, and the expected closure of issue #14.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}