[Vivswan]

Before

# action.yml
  rendered-file:
    description: >-
      mode: render only, and required there: the path the rendered settings
      document is written to (parent directories are created). The file holds
      exactly what apply would run: every section validated, each section that
      takes an undeclared policy in its policy-wrapper form with the policy
      made explicit, the other sections in their own shape, and the _layering
      directives dropped. Feed it to a later apply or check step as its
      settings-file. Must not name one of the settings-file layers (the render
      would overwrite it). Fails when set in apply or check.

After

# action.yml
  rendered-file:
    description: >-
      mode: render only, and required there: the path the rendered settings
      document is written to.

# .github/actions/setup/action.yml
description: |
  Installs the pinned bun and, unless told not to, the locked dependencies.

  The bun version is the one .bun-version pins.

  The install runs bun install --frozen-lockfile --ignore-scripts, so the lockfile never changes and the prepare script (lefthook, a git hook no runner uses) never runs.

  The caller keeps its own checkout and setup-node steps, whose options differ per job.

How

• Composite actions take the fleet shape: one orienting sentence, one fact per paragraph, one-sentence inputs and outputs, no workflow expression in any description.
• Root inputs and outputs drop to one sentence each in the declarations that generate action.yml and the inputs table.
• Dropped detail lives on the operate and reference pages that already owned it. The inputs reference and the multi-repo guide gain the few facts that had no page.
• CLI help reuses the declarations, so the clause-removal code shrinks to the one clause still needed plus the repository rewording.
• List inputs say comma- or newline-separated, matching the splitter; the inputs reference no longer claims every row names its scope.
• Root description stays one line: GitHub Marketplace caps it at 125 characters.

Proof

• Tests: 114 green across the seven suites the change touches.
• Gates: biome, tsc, and the docs probe clean; the cross-model review converged.

Technical details

• Line accounting: source +68 -195, tests +7 -16, docs +34 -30, composite actions +21 -14; the generated root action.yml (+54 -163) is left out.
• Why source rows on a docs change: the descriptions are TypeScript declarations in src/flows/inputs.ts and src/action/io.ts, and the CLI clause code followed the shortened text.
• Reviewer note (Copilot): the root action.yml inputs and outputs blocks and the table in docs/reference/inputs.md are generated by bun run build:action-docs and bun run build:inputs-table; edit the declarations, never the output.
• Deleted test: the init sections-flag clause test, since the clause it pinned no longer exists; declared( clause census in src/cli/inputs.ts: 6 before, 2 after.
• Refused: reshaping the root description into the block form. The Marketplace cap; the changelog's "shorter description" commit shortened it for the same reason.
• Files: .github/actions/{setup,site-build}/action.yml, action.yml, src/{flows/inputs.ts,action/io.ts,cli/inputs.ts}, test/cli/inputs.test.ts, docs/{reference/inputs.md,operate/multi-repo.md}.

[Copilot]

Copilot review overview

🟡 Changes recommended

The inputs reference incorrectly claims every shortened description identifies its scope.

Review effort: Balanced
Findings: 1

Open (1)

• Documented option rows omit mode restrictions · New

What changed in this PR

Shortens action metadata while moving detailed guidance into reference documentation.

Changes:

• Condenses root input/output descriptions and CLI clause handling.
• Expands composite-action descriptions.
• Preserves discovery details in operational docs.

File	Description
src/​flows/​inputs.ts	Shortens input declarations.
src/​action/​io.ts	Shortens output declarations.
src/​cli/​inputs.ts	Simplifies CLI help rewriting.
test/​cli/​inputs.test.ts	Updates CLI help tests.
action.yml	Regenerates action metadata.
docs/​reference/​inputs.md	Regenerates tables and adds scope guidance.
docs/​operate/​multi-repo.md	Restores discovery details.
.github/​actions/​setup/​action.yml	Reshapes composite-action descriptions.
.github/​actions/​site-build/​action.yml	Reshapes site-build metadata.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

File size check

0 over a hard cap (fails), 34 warning(s).

File	Size	Tier	Cap
.github/actions/setup/action.yml:7	169 chars	warn	150
.github/scripts/gen-inputs-table.ts:54	11 comment lines	warn	10
.github/scripts/generated.ts:28	191 chars	warn	150
.github/scripts/release-pipeline.ts:7	156 chars	warn	150
.github/scripts/release-pipeline.ts:458	151 chars	warn	150
.github/scripts/release-pipeline.ts:1252	153 chars	warn	150
.github/scripts/release-pipeline.ts:1	35 comment lines (header)	warn	25
.github/scripts/release-pipeline.ts:454	14 comment lines	warn	10
.github/workflows/post-green.yml:29	153 chars	warn	150
.github/workflows/update-release-pr.yml:110	14 comment lines	warn	10
docs/upgrading/v2-to-v3.md	1276 lines	warn	1040
src/engine/layers.ts:217	157 chars	warn	150
src/flows/settings-write.ts:142	159 chars	warn	150
src/flows/settings-write.ts:30	11 comment lines	warn	10
src/flows/snapshot.ts:189	13 comment lines	warn	10
src/github/secret-scan.ts:43	11 comment lines	warn	10
src/schema.ts:186	153 chars	warn	150
src/schema.ts:197	176 chars	warn	150
src/sections/contract/errors.ts:14	14 comment lines	warn	10
src/sections/contract/module.ts:963	185 chars	warn	150
src/sections/contract/module.ts:627	12 comment lines	warn	10
src/sections/contract/module.ts:897	12 comment lines	warn	10
src/sections/secret_scanning_custom_patterns/compilable-form.ts:382	161 chars	warn	150
src/sections/shared/roles.ts:43	13 comment lines	warn	10
src/types.ts:16	156 chars	warn	150
test/docs/guides.test.ts:451	155 chars	warn	150
test/e2e/generators.ts	2634 lines	warn	2560
test/e2e/generators.ts:1704	166 chars	warn	150
test/e2e/generators.ts:1858	161 chars	warn	150
test/e2e/generators.ts:1667	12 comment lines	warn	10
test/engine/execute.test.ts:617	152 chars	warn	150
test/flows/merge-parity.test.ts:63	164 chars	warn	150
test/scripts/auto-fix-allowlist.test.ts:12	12 comment lines	warn	10
test/sections/refusal-messages.test.ts:61	19 comment lines	warn	10

Split the file, wrap the line, shorten or exempt the comment, or list the path in .file-size-allow.local with a # reason.

5 managed file(s) skipped; repo-platform owns them.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Several shortened descriptions make claims contradicted by documented and tested runtime behavior.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Documented option rows omit mode restrictions

Previously missed (4)

In code that hasn't changed since last review

Redacted private targets do not use owner/name keys

src/​action/​io.ts:20

This says every key is an owner/name, but redacted private targets use placeholders. With private-repos: redact, a private o/r target produces {"private repository #1": {...}}, not an o/r key.

Central settings file overrides per-repository settings

src/​flows/​inputs.ts:139

This says every repos target uses its own settings file, but a central file overrides it. For repos: o/r with repos-dir containing o/r.yml, the central file wins and the remote .github/settings.yml is ignored.

Redaction does not hide the current private repository

src/​flows/​inputs.ts:170

This says redact hides private targets, but the current repository is never hidden. For a private target equal to GITHUB_REPOSITORY, private-repos: redact leaves its slug visible in logs and outputs.

Healthy targets may produce no report delivery

src/​flows/​inputs.ts:176

This promises a full report for each proven-private target, but issue-on-failure deliberately sends nothing for a healthy target with no open report issue. In that case the delivery result is nothing to deliver, not a full report.