fix(ci): harden repository reconciliation drift detection

[Copilot]

Canonical issue

Outcome

Repository reconciliation stops flagging valid PRs as missing a canonical issue when they use repo-qualified closing refs or when the linked issue has already been closed. The drift report also refreshes on the repository events that actually change reconciliation state instead of waiting for the daily cron.

Scope

• Included:
  • Trigger coverage
    • Run reconciliation on pull_request_target lifecycle changes, issues open/close changes, and branch create / delete.
  • Canonical issue parsing
    • Accept both Closes #123 and Closes owner/repo#123.
    • Treat validated issues as canonical regardless of open/closed state; still exclude PR references and missing issues.
  • Regression coverage
    • Add workflow contract tests for trigger wiring.
    • Add behavioral tests that execute the inline github-script against stubbed GitHub API responses for the two false-positive cases.
  • Example

    Closes #1669
    Closes groupthinking/EventRelay#900

• Explicitly excluded:
  • branch cleanup or deletion policy
  • report formatting changes beyond corrected classification behavior
  • broader governance/remediation changes outside repository reconciliation

Risk

• Risk level: low
• Failure mode:
  • Over-broad trigger wiring could run the report more often than intended.
  • An overly permissive closing-ref regex could misclassify non-canonical text, though issue validation remains the backstop.
• Rollback:
  • Revert .github/workflows/repository-reconciliation.yml and tests/unit/test_repository_reconciliation_workflow.py.

Verification

List exact automated and manual checks, tied to the current head SHA.

• Automated:
  • python -m pytest tests/unit/test_repository_reconciliation_workflow.py -q --override-ini=addopts=''
  • behavioral workflow tests cover repo-qualified refs and closed canonical issues
  • parallel validation reported no review findings and no CodeQL alerts
• Manual:
  • inspected the generated workflow diff to confirm the change is limited to trigger wiring and canonical-issue classification
• Focused tests
• Required CI
• Review threads resolved

Production evidence

Not applicable. This change is limited to GitHub workflow automation and its regression tests; there is no runtime, Vercel, or production-surface change.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue
• Acceptance criteria are satisfied
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

• Fixes [automation] Repository drift report #1584

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Building	Preview, v0	Sep 8, 2026 11:13pm UTC

[vercel]

Additional Suggestion:

Broadened closing-reference regex accepts foreign owner/repo#N references and silently maps them onto local issue numbers, mis-binding PRs and fabricating duplicate groups.