These are inherited from upstream Cinny and target GitHub (CLA assistant, Netlify previews, GHCR docker pushes, PR title lint). None of them run on code.lotusguild.org, but they make the repo look like it enforces a CLA, PR-title conventions, and lockfile checks when it does not. lockfile.yml in particular is a check worth keeping — as a Gitea workflow.
Suggested fix
Delete the GitHub-only workflows. Port lockfile.yml's intent (fail if package-lock.json is out of sync with package.json, e.g. npm ci --dry-run or lockfile-lint) into .gitea/workflows/ci.yml. If upstream syncs keep re-adding them, add .github/ to the merge script's exclusion list.
Filed from the September 2026 client audit (CI pipeline review, branch lotus @ 4bea4895).
**Location:** `.github/workflows/{build-pull-request,cla,deploy-pull-request,docker-pr,lockfile,netlify-dev,prod-deploy,pr-title}.yml`
### Problem
These are inherited from upstream Cinny and target GitHub (CLA assistant, Netlify previews, GHCR docker pushes, PR title lint). None of them run on code.lotusguild.org, but they make the repo look like it enforces a CLA, PR-title conventions, and lockfile checks when it does not. `lockfile.yml` in particular is a check worth keeping — as a Gitea workflow.
### Suggested fix
Delete the GitHub-only workflows. Port `lockfile.yml`'s intent (fail if `package-lock.json` is out of sync with `package.json`, e.g. `npm ci --dry-run` or `lockfile-lint`) into `.gitea/workflows/ci.yml`. If upstream syncs keep re-adding them, add `.github/` to the merge script's exclusion list.
---
_Filed from the September 2026 client audit (CI pipeline review, branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · Medium & Low milestone 2026-09-12 01:57:47 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Location:
.github/workflows/{build-pull-request,cla,deploy-pull-request,docker-pr,lockfile,netlify-dev,prod-deploy,pr-title}.ymlProblem
These are inherited from upstream Cinny and target GitHub (CLA assistant, Netlify previews, GHCR docker pushes, PR title lint). None of them run on code.lotusguild.org, but they make the repo look like it enforces a CLA, PR-title conventions, and lockfile checks when it does not.
lockfile.ymlin particular is a check worth keeping — as a Gitea workflow.Suggested fix
Delete the GitHub-only workflows. Port
lockfile.yml's intent (fail ifpackage-lock.jsonis out of sync withpackage.json, e.g.npm ci --dry-runorlockfile-lint) into.gitea/workflows/ci.yml. If upstream syncs keep re-adding them, add.github/to the merge script's exclusion list.Filed from the September 2026 client audit (CI pipeline review, branch
lotus@4bea4895).