ci(health): run only by hand and write nothing

The health check no longer runs on a schedule, updates the Org health
report issue, or mentions anyone. A person starts it from the Actions tab
and the report goes to the run's step summary. An account here was
suspended over automation, so nothing in this repository acts on its own.

The workflow keeps GITHUB_TOKEN with read-only permissions. Every action
in health.yml and test.yml is a GitHub-owned action pinned by full SHA.

TechAPI's label-triggered final check is the one sanctioned use of
TechEngineBot's token, so it is allowed for that repository only.

Author: Seungpyo1007

.github/workflows/health.yml

@@ -1,13 +1,13 @@
 name: health
 
+# Manual only. Automation under a personal account got it suspended, so
+# nothing here runs on a schedule or writes to GitHub: the report goes to
+# this run's step summary.
 on:
-  schedule:
-    - cron: "0 0 * * *"   # daily, 09:00 KST
   workflow_dispatch:
 
 permissions:
   contents: read
-  issues: write     # keeps the single "Org health report" issue current
   actions: read
 
 concurrency:
@@ -19,11 +19,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7.1.0
         with:
           python-version: "3.12"
       - name: Check every repo and public endpoint
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: python -m machine.health --issue
+        run: python -m machine.health

.github/workflows/test.yml

@@ -5,13 +5,16 @@ on:
   push:
     branches: [develop, main]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7.1.0
         with:
           python-version: "3.12"
       - run: |

README.md

@@ -6,8 +6,8 @@ TechMachine looks after the repositories that hold it.
 
 ## Health check
 
-`machine/health.py` runs daily and keeps one issue, **Org health report**,
-up to date. For every repository in [`machine/repos.json`](machine/repos.json)
+`machine/health.py` runs when a person starts it — the `health` workflow's
+*Run workflow* button, or locally. For every repository in [`machine/repos.json`](machine/repos.json)
 it reads the newest completed run of each active workflow on each tracked
 branch, and it fetches the public endpoints the TechAPI homepage depends on.
 
@@ -25,21 +25,21 @@ other than `GITHUB_TOKEN`. Automation here must act as `github-actions[bot]`,
 never as a person: workflows running under a personal token are how a
 maintainer's account got suspended. Disabling the workflow in the Actions
 settings clears the finding; a non-token secret a repository genuinely needs
-goes in that repository's `allowed_secrets` in `repos.json`.
+goes in that repository's `allowed_secrets` in `repos.json` — TechAPI's
+label-triggered final check is the one place TechEngineBot's token is allowed.
+
+It only reads. The report goes to stdout and the run's step summary; it
+writes nothing to GitHub, mentions nobody, and runs on no schedule — an
+account here was suspended over automation, and a report nobody asked for is
+how that starts.
 
 ```bash
-python -m machine.health            # print the report
-python -m machine.health --issue    # also update the issue (needs GITHUB_TOKEN)
+python -m machine.health            # print the report (GITHUB_TOKEN raises the rate limit)
 python -m pytest -q
 ```
 
 Adding a repository or endpoint is one entry in `machine/repos.json`.
 
-When the set of problems changes, the check comments on the issue and
-@-mentions `notify` from that file — editing an issue body notifies nobody.
-It stays quiet when the same failure recurs (the fingerprint is
-workflow + result, not the run link) and never pings for an all-clear.
-
 ## Satellite repositories
 
 Categories that do not belong in TechAPI live in their own repository (games:

machine/health.py

@@ -6,7 +6,11 @@
 by an environment rule leaves no log at all. Each of those went unnoticed for
 days. This treats anything other than success/skipped as a problem.
 
-Run with: python -m machine.health [--issue]
+It only reads. The report goes to stdout and the run's step summary; nothing
+is written to GitHub and nobody is mentioned, so it runs only when a person
+starts it.
+
+Run with: python -m machine.health
 """
 
 from __future__ import annotations
@@ -24,7 +28,6 @@
 
 API = "https://api.github.com"
 CONFIG = Path(__file__).with_name("repos.json")
-ISSUE_TITLE = "Org health report"
 
 # Conclusions that mean the run did its job. Everything else is surfaced —
 # `cancelled` and `timed_out` included, because that is how silent failures look.
@@ -178,58 +181,8 @@ def render(findings: list[Finding], config: dict[str, Any]) -> str:
     return "\n".join(lines) + "\n"
 
 
-def fingerprint(findings: list[Finding]) -> str:
-    """Stable identity of a problem set: what is broken, not when it was checked."""
-    return ",".join(sorted(f"{f.where}={f.what}" for f in findings))
-
-
-def alert_needed(previous_body: str, current: str) -> bool:
-    """Alert only when the set of problems changed — and never for all clear.
-
-    A daily ping about the same known failure trains people to ignore the
-    ping; the point is to hear about the *new* one.
-    """
-    if not current:
-        return False
-    return f"<!-- fingerprint:{current} -->" not in previous_body
-
-
-def publish(body: str, token: str, repo: str, findings: list[Finding], mention: str) -> None:
-    """Keep one open issue up to date instead of opening one per run."""
-    def call(method: str, path: str, payload: dict[str, Any] | None = None) -> Any:
-        data = json.dumps(payload).encode("utf-8") if payload is not None else None
-        request = urllib.request.Request(f"{API}{path}", data=data, method=method, headers={
-            "Accept": "application/vnd.github+json",
-            "Authorization": f"Bearer {token}",
-            "Content-Type": "application/json",
-        })
-        with urllib.request.urlopen(request, timeout=30) as response:
-            return json.loads(response.read().decode("utf-8") or "null")
-
-    current = fingerprint(findings)
-    stamped = f"{body}\n<!-- fingerprint:{current} -->\n"
-
-    issues = call("GET", f"/repos/{repo}/issues?state=open&per_page=100")
-    existing = next((i for i in issues if i.get("title") == ISSUE_TITLE), None)
-    if existing:
-        number = existing["number"]
-        previous = existing.get("body") or ""
-        call("PATCH", f"/repos/{repo}/issues/{number}", {"body": stamped})
-    else:
-        number = call("POST", f"/repos/{repo}/issues", {"title": ISSUE_TITLE, "body": stamped})["number"]
-        previous = ""
-
-    # A comment, not an edit: editing an issue body notifies nobody.
-    if mention and alert_needed(previous, current):
-        lines = "\n".join(f"- {f.where}: **{f.what}**" for f in findings)
-        call("POST", f"/repos/{repo}/issues/{number}/comments",
-             {"body": f"@{mention} the org health report changed:\n\n{lines}"})
-
-
 def main() -> int:
-    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
-    parser.add_argument("--issue", action="store_true", help="update the health issue")
-    args = parser.parse_args()
+    argparse.ArgumentParser(description=__doc__.splitlines()[0]).parse_args()
 
     config = json.loads(CONFIG.read_text(encoding="utf-8"))
     token = os.environ.get("GITHUB_TOKEN")
@@ -240,9 +193,6 @@ def main() -> int:
     summary = os.environ.get("GITHUB_STEP_SUMMARY")
     if summary:
         Path(summary).write_text(report, encoding="utf-8")
-    if args.issue and token:
-        publish(report, token, os.environ.get("GITHUB_REPOSITORY", "GetTechAPI/TechMachine"),
-                findings, config.get("notify", ""))
     # The report is the output; a red run would only add a second alert.
     return 0
 

machine/repos.json

@@ -1,11 +1,13 @@
 {
-  "notify": "Seungpyo1007",
   "repos": [
     {
       "name": "GetTechAPI/TechAPI",
       "branches": [
         "develop",
         "main"
+      ],
+      "allowed_secrets": [
+        "TECHENGINEBOT_TOKEN"
       ]
     },
     {

tests/test_health.py

@@ -53,39 +53,6 @@ def test_render_all_clear_and_problem_table():
     assert "1 problem" in problems and "| cancelled |" in problems
 
 
-# --- alerts -----------------------------------------------------------------
-
-from machine.health import Finding, alert_needed, fingerprint  # noqa: E402
-
-BROKEN = [Finding("TechEngine@main · weekly-refresh", "cancelled")]
-
-
-def test_new_problem_alerts():
-    assert alert_needed("", fingerprint(BROKEN))
-
-
-def test_same_problem_twice_does_not_alert_again():
-    body = f"report\n<!-- fingerprint:{fingerprint(BROKEN)} -->\n"
-    assert not alert_needed(body, fingerprint(BROKEN))
-
-
-def test_a_different_problem_alerts():
-    body = f"report\n<!-- fingerprint:{fingerprint(BROKEN)} -->\n"
-    worse = BROKEN + [Finding("TechAPI@main · deploy-pages", "failure")]
-    assert alert_needed(body, fingerprint(worse))
-
-
-def test_all_clear_never_alerts():
-    body = f"report\n<!-- fingerprint:{fingerprint(BROKEN)} -->\n"
-    assert not alert_needed(body, fingerprint([]))
-
-
-def test_fingerprint_ignores_order_and_links():
-    a = [Finding("x", "failure", "https://run/1"), Finding("y", "cancelled", "https://run/2")]
-    b = [Finding("y", "cancelled", "https://run/9"), Finding("x", "failure", "https://run/8")]
-    assert fingerprint(a) == fingerprint(b)
-
-
 # --- automation must not run as a person -----------------------------------
 
 from pathlib import Path  # noqa: E402