@@ -33,7 +33,8 @@ concurrency:
 
 jobs:
   ingest:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 90
     env:
       CATEGORY: ${{ inputs.category }}
       LIMIT: ${{ inputs.limit }}
@@ -52,7 +53,10 @@ jobs:
           ref: develop
           path: TechAPI
           submodules: true
-          fetch-depth: 0
+          # The Tier 0 diff compares the new commit with develop's tip only.
+          fetch-depth: 1
+          # The write token is handed to the push step alone.
+          persist-credentials: false
 
       - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
@@ -139,9 +143,15 @@ jobs:
             > "$GITHUB_WORKSPACE/verify-report.md" 2>&1 \
             || echo "_Tier 0 report unavailable._" > "$GITHUB_WORKSPACE/verify-report.md"
 
+      # github-actions[bot] writes the body, so scraped text must not mention
+      # anyone or cross-reference an issue: drop "@", break "#123"/"GH-123" and
+      # URLs with a zero-width space. Colours such as #3fb950 are untouched.
       - name: Build PR body
         if: steps.commit.outputs.changed == 'true'
         run: |
+          zw=$(printf '\342\200\213')
+          ref="s/(#|[Gg][Hh]-)([0-9]+)(\$|[^0-9A-Za-z_])/\1$zw\2\3/g"
+          scrub() { tr -d '@' | sed -E -e "$ref" -e "$ref" -e "s#://#:$zw//#g" -e "s/www\./www$zw./g"; }
           {
             echo "Closes #295"
             echo
@@ -154,18 +164,28 @@ jobs:
             echo
             echo "## Tier 0 verification (changed records)"
             echo
-            cat verify-report.md
+            scrub < verify-report.md
             echo
             echo "## Ingest summary"
             echo
-            cat ingest-summary.md 2>/dev/null || true
+            if [ -f ingest-summary.md ]; then scrub < ingest-summary.md; fi
             if [ -f enrich-summary.md ]; then
               echo
               echo "## Enrich summary"
               echo
-              cat enrich-summary.md
+              scrub < enrich-summary.md
             fi
-          } > pr-body.md
+          } > pr-body.full.md
+          # GitHub rejects a PR body over 65,536 characters.
+          python - <<'PY'
+          from pathlib import Path
+          body = Path("pr-body.full.md").read_text(encoding="utf-8", errors="replace")
+          limit = 60000
+          if len(body) > limit:
+              note = "\n\n_Truncated; the full summaries are in the run's artifact._\n"
+              body = body[: limit - len(note)] + note
+          Path("pr-body.md").write_text(body, encoding="utf-8")
+          PY
 
       # One open PR per task: the fixed branch is cut from develop and
       # force-pushed each run; an open PR is edited in place. No comments.
@@ -176,7 +196,9 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          git push --force origin "HEAD:refs/heads/$BRANCH"
+          auth=$(printf 'x-access-token:%s' "$GH_TOKEN" | base64 -w0)
+          git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic $auth" \
+            push --force origin "HEAD:refs/heads/$BRANCH"
           number=$(gh pr list --repo GetTechAPI/TechAPI --head "$BRANCH" --base develop \
             --state open --json number --jq '.[0].number // empty')
           if [ -n "$number" ]; then
 
@@ -26,7 +26,7 @@ concurrency:
 
 jobs:
   refresh:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # A job that runs into GitHub's 6h ceiling is reported as *cancelled*,
     # not failed, so it never surfaces as a broken run. Stop short of it.
     timeout-minutes: 330
@@ -46,7 +46,10 @@ jobs:
           ref: develop
           path: TechAPI
           submodules: true
-          fetch-depth: 0
+          # The Tier 0 diff compares the new commit with develop's tip only.
+          fetch-depth: 1
+          # The write token is handed to the push step alone.
+          persist-credentials: false
 
       - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
@@ -157,9 +160,15 @@ jobs:
             > "$GITHUB_WORKSPACE/verify-report.md" 2>&1 \
             || echo "_Tier 0 report unavailable._" > "$GITHUB_WORKSPACE/verify-report.md"
 
+      # github-actions[bot] writes the body, so scraped text must not mention
+      # anyone or cross-reference an issue: drop "@", break "#123"/"GH-123" and
+      # URLs with a zero-width space. Colours such as #3fb950 are untouched.
       - name: Build PR body
         if: steps.commit.outputs.changed == 'true'
         run: |
+          zw=$(printf '\342\200\213')
+          ref="s/(#|[Gg][Hh]-)([0-9]+)(\$|[^0-9A-Za-z_])/\1$zw\2\3/g"
+          scrub() { tr -d '@' | sed -E -e "$ref" -e "$ref" -e "s#://#:$zw//#g" -e "s/www\./www$zw./g"; }
           {
             echo "Closes #296"
             echo
@@ -172,19 +181,29 @@ jobs:
             echo
             echo "## Tier 0 verification (changed records)"
             echo
-            cat verify-report.md
+            scrub < verify-report.md
             echo
             echo "## Enrichment summaries"
             for f in enrich-*.md; do
               [ -f "$f" ] || continue
               echo
               echo "<details><summary>$f</summary>"
               echo
-              cat "$f"
+              scrub < "$f"
               echo
               echo "</details>"
             done
-          } > pr-body.md
+          } > pr-body.full.md
+          # GitHub rejects a PR body over 65,536 characters.
+          python - <<'PY'
+          from pathlib import Path
+          body = Path("pr-body.full.md").read_text(encoding="utf-8", errors="replace")
+          limit = 60000
+          if len(body) > limit:
+              note = "\n\n_Truncated; the full summaries are in the run's artifact._\n"
+              body = body[: limit - len(note)] + note
+          Path("pr-body.md").write_text(body, encoding="utf-8")
+          PY
 
       # One open PR per task: the fixed branch is cut from develop and
       # force-pushed each run; an open PR is edited in place. No comments.
@@ -195,7 +214,9 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          git push --force origin "HEAD:refs/heads/$BRANCH"
+          auth=$(printf 'x-access-token:%s' "$GH_TOKEN" | base64 -w0)
+          git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic $auth" \
+            push --force origin "HEAD:refs/heads/$BRANCH"
           number=$(gh pr list --repo GetTechAPI/TechAPI --head "$BRANCH" --base develop \
             --state open --json number --jq '.[0].number // empty')
           if [ -n "$number" ]; then
 
@@ -43,12 +43,13 @@ jobs:
       - name: Validate seed JSON (§9.3, §15.3)
         env:
           TECHAPI_DATA_DIR: ${{ github.workspace }}/TechAPI/data
+          BASE_SHA: ${{ inputs.base-sha }}
         run: |
-          if [ -n "${{ inputs.base-sha }}" ]; then
-            git -C TechAPI fetch --no-tags --depth=100 origin "${{ inputs.base-sha }}"
-            git -C TechAPI merge-base "${{ inputs.base-sha }}" HEAD >/dev/null 2>&1 \
+          if [ -n "$BASE_SHA" ]; then
+            git -C TechAPI fetch --no-tags --depth=100 origin "$BASE_SHA"
+            git -C TechAPI merge-base "$BASE_SHA" HEAD >/dev/null 2>&1 \
               || git -C TechAPI fetch --no-tags --unshallow origin
-            python -m app.validate --changed-since "${{ inputs.base-sha }}"
+            python -m app.validate --changed-since "$BASE_SHA"
           else
             python -m app.validate
           fi
@@ -40,9 +40,13 @@ concurrency:
 
 jobs:
   promote:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 240
     env:
       PYTHONIOENCODING: utf-8
+      MAX_URLS: ${{ inputs.max_urls }}
+      MAX_WIKIDATA: ${{ inputs.max_wikidata }}
+      MAX_CROSSREF: ${{ inputs.max_crossref }}
       DRAFT_FLAG: ""
       BRANCH: collect/promote
       TITLE: "data(verify): promote records to verified"
@@ -57,7 +61,10 @@ jobs:
           ref: develop
           path: TechAPI
           submodules: true
-          fetch-depth: 0
+          # The Tier 0 diff compares the new commit with develop's tip only.
+          fetch-depth: 1
+          # The write token is handed to the push step alone.
+          persist-credentials: false
 
       - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
@@ -79,20 +86,28 @@ jobs:
 
       - name: Tier 1 source-URL liveness
         working-directory: TechAPI/TechEngine
-        run: python -m app.verify check-urls --max "${{ inputs.max_urls }}"
+        run: python -m app.verify check-urls --max "$MAX_URLS"
 
       - name: Batched Wikidata source liveness
         working-directory: TechAPI/TechEngine
-        run: python -m app.verify check-wikidata --max "${{ inputs.max_wikidata }}"
+        run: python -m app.verify check-wikidata --max "$MAX_WIKIDATA"
 
       - name: Tier 2 external cross-reference
         working-directory: TechAPI/TechEngine
-        run: python -m app.verify crossref --max "${{ inputs.max_crossref }}"
+        run: python -m app.verify crossref --max "$MAX_CROSSREF"
 
       - name: Tier 3 promote (dry-run)
         working-directory: TechAPI/TechEngine
         run: python -m app.verify promote | tee "$GITHUB_WORKSPACE/promote-dry-run.md" >> "$GITHUB_STEP_SUMMARY"
 
+      - name: Upload promotion output
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: promote-output
+          path: promote-dry-run.md
+          if-no-files-found: ignore
+
       - name: Tier 3 promote (apply)
         if: inputs.apply
         working-directory: TechAPI/TechEngine
@@ -165,9 +180,15 @@ jobs:
             > "$GITHUB_WORKSPACE/verify-report.md" 2>&1 \
             || echo "_Tier 0 report unavailable._" > "$GITHUB_WORKSPACE/verify-report.md"
 
+      # github-actions[bot] writes the body, so scraped text must not mention
+      # anyone or cross-reference an issue: drop "@", break "#123"/"GH-123" and
+      # URLs with a zero-width space. Colours such as #3fb950 are untouched.
       - name: Build PR body
         if: steps.commit.outputs.changed == 'true'
         run: |
+          zw=$(printf '\342\200\213')
+          ref="s/(#|[Gg][Hh]-)([0-9]+)(\$|[^0-9A-Za-z_])/\1$zw\2\3/g"
+          scrub() { tr -d '@' | sed -E -e "$ref" -e "$ref" -e "s#://#:$zw//#g" -e "s/www\./www$zw./g"; }
           {
             echo "Closes #296"
             echo
@@ -180,14 +201,24 @@ jobs:
             echo
             echo "## Tier 0 verification (changed records)"
             echo
-            cat verify-report.md
+            scrub < verify-report.md
             echo
             echo "## Promotion run"
             echo
             echo '```'
-            cat promote-dry-run.md
+            scrub < promote-dry-run.md
             echo '```'
-          } > pr-body.md
+          } > pr-body.full.md
+          # GitHub rejects a PR body over 65,536 characters.
+          python - <<'PY'
+          from pathlib import Path
+          body = Path("pr-body.full.md").read_text(encoding="utf-8", errors="replace")
+          limit = 60000
+          if len(body) > limit:
+              note = "\n\n_Truncated; the full summaries are in the run's artifact._\n"
+              body = body[: limit - len(note)] + note
+          Path("pr-body.md").write_text(body, encoding="utf-8")
+          PY
 
       # One open PR per task: the fixed branch is cut from develop and
       # force-pushed each run; an open PR is edited in place. No comments.
@@ -198,7 +229,9 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          git push --force origin "HEAD:refs/heads/$BRANCH"
+          auth=$(printf 'x-access-token:%s' "$GH_TOKEN" | base64 -w0)
+          git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic $auth" \
+            push --force origin "HEAD:refs/heads/$BRANCH"
           number=$(gh pr list --repo GetTechAPI/TechAPI --head "$BRANCH" --base develop \
             --state open --json number --jq '.[0].number // empty')
           if [ -n "$number" ]; then
 
@@ -90,7 +90,7 @@ Spins up Postgres 16, seeds from the mounted TechAPI checkout, serves on `:8000`
 
 - [x] Split out from TechAPI; sibling-checkout data pipeline
 - [x] **Coverage gap detector** - diff curated dataset vs upstream catalogs
-  and surface missing SKUs as a sticky weekly issue
+  and list missing SKUs in an on-demand report (`coverage-report.yml`)
   ([#1](https://github.com/GetTechAPI/TechEngine/issues/1))
 - [x] **Ingestion crawler** - scrape canonical sources and draft new SKUs for
   a TechAPI PR ([#2](https://github.com/GetTechAPI/TechEngine/issues/2));
 
@@ -2003,14 +2003,14 @@ TechAPI의 **핵심 목표 중 하나**. TechPicks 외에 다양한 앱·플랫
   3. 레포 간 `repository_dispatch` 중계와 서브모듈 자동 bump(`notify-*`, `bump-*`)는 없앤다.
   4. `verify-status`는 TechAPI `dump-develop`에 합치고, `dump-refresh`는 `dump-develop`의 수동 전체 재생성으로 대체한다. 커버리지 리포트는 주 1회, TechEngine 레포 이슈만 갱신한다.
   5. 스크레이핑 워크플로(`weekly-data.yml`)는 수동 실행으로 검증한 뒤에 cron을 켠다.
-  6. **예외 — TechEngineBot 최종 확인**: TechEngineBot 계정은 중요한 PR의 최종 확인자 역할로만 쓴다. 쓰기 권한이 있는 메인테이너(OWNER/MEMBER/COLLABORATOR)가 `/final-review` 댓글을 달 때만 TechAPI `final-review.yml`이 돌고, PR 하나에 댓글 하나(재실행 시 같은 댓글 수정)만 남긴다. 조회는 `GITHUB_TOKEN`으로 하고, `TECHENGINEBOT_TOKEN`(TechAPI 레포 한정 fine-grained 토큰, Pull requests: write)은 그 댓글에만 쓴다. 스케줄·push·PR 이벤트로 TechEngineBot이 움직이는 워크플로는 만들지 않는다.
+  6. **예외 — TechEngineBot 최종 확인**: TechEngineBot 계정은 중요한 PR의 최종 확인자 역할로만 쓴다. 메인테이너가 PR에 `final-check` 라벨을 붙일 때만 TechAPI `final-check.yml`이 돌고, PR 하나에 댓글 하나(재실행 시 같은 댓글 수정)만 남긴다. 조회는 `GITHUB_TOKEN`으로 하고, `TECHENGINEBOT_TOKEN`(TechAPI 레포 한정 fine-grained 토큰, Pull requests: write)은 그 댓글에만 쓴다. 스케줄·push·PR 이벤트로 TechEngineBot이 움직이는 워크플로는 만들지 않는다.
 - **개정 (2026-11-01)**: TechAPI는 PR 검증을 자체 검증기로 직접 돌리므로, 2·4·5번을 다음으로 대체한다.
   - PR 댓글 워크플로(`techapi-pr-validation-comment`, `techapi-verify-comment`)와 `refresh-data`를 삭제한다. `coverage-report`는 수동 실행·읽기 전용으로 바꾼다.
   - 수집·검증(`weekly-ingest`, `weekly-refresh`, `verify-network`)은 `ingest.yml`, `refresh.yml`, `verify-promote.yml`로 바꾼다. TechAPI `collect.yml`이 `workflow_dispatch`로만 호출하는 PR 생성기다. 작업마다 고정 브랜치(`collect/*`)에 열린 PR을 최대 1개만 두고 제자리에서 갱신한다. 댓글은 달지 않으며, 게이트(`app.validate`, `integrity_check.py --strict`) 결과와 Tier 0 보고서는 PR 본문에 남긴다. 덤프는 커밋하지 않는다. 실행되는 엔진은 TechAPI가 서브모듈로 고정한 TechEngine 커밋이다.
   - 크롤러는 브라우저를 흉내 내지 않는 `TechEngine-*` User-Agent로 자신을 밝힌다. 안티봇 챌린지는 "알 수 없음"으로 두고 `verified` 승급 근거로 쓰지 않는다. 검색엔진 결과 스크레이핑(GSMArena 후보 탐색용 DuckDuckGo/Bing)은 없앤다.
   - 모든 action은 GitHub 소유 action을 SHA로 고정해 쓴다. TechEngineBot 최종 확인(6번)은 TechAPI 쪽에서 관리한다.
 - **트레이드오프**: `GITHUB_TOKEN`이 만든 PR은 다른 워크플로를 트리거하지 않으므로, 주간 PR은 생성 전에 같은 작업 안에서 검증을 끝낸다. 포크 PR에는 토큰이 읽기 전용이라 댓글 대신 Job Summary로 결과를 남긴다. Projects 보드 필드 자동 입력(`pr-metadata`)은 없애고 GitHub Projects 내장 Auto-add를 쓴다.
-- **필요 설정**: 두 레포 Settings → Actions → General에서 "Allow GitHub Actions to create and approve pull requests"를 켜야 PR 생성이 된다.
+- **필요 설정**: PR은 TechAPI에서 TechAPI 토큰으로 만들어지므로 TechAPI만 Settings → Actions → General의 "Allow GitHub Actions to create and approve pull requests"를 켠다. TechEngine은 끈 채로 둔다.
 
 ---