[jeffwall-curlewlabs]

Closes #4. Stacked on #3: it builds on #3's clock and is based on its branch, so this diff shows only the change below. When #3 merges, GitHub retargets this to main.

Why

Every tick downloaded the full text of every workflow file on the default branch and parsed each with yq, though the files change a few times a day and a clock ticks every few minutes. On a repository with 52 workflow files that is about 1.3 MB and 52 yq runs per tick, per host.

What changes

default_branch.py replaces the all-text read, for the clock and for missed:

• Every read asks for the id of the default branch's .github/workflows tree. That id changes only when a workflow file changes.
• When the tree was read before, its entries and each file's parse come from a cache keyed by content id, and nothing else is fetched. No yq process starts.
• When it changed, the entries are listed by the tree's id, so they describe exactly that tree. Only files whose blob is new are fetched, in one batched query, and parsed.
• The cache is only a cache. Every key is a content id, so it is never stale.
  • A cached text is re-hashed against its blob id on every read, and anything unreadable is a miss.
  • Deleting the cache costs one full read and changes no decision.
  • Entries unused for 30 days are pruned.
  • It lives under $XDG_CACHE_HOME/github-cron-trigger.
• Parses are keyed by blob id and PARSE_FORMAT, not yq's version. The yq floor exists so supported releases read workflows alike, and an idle tick should start no process.

Checked

• Unit tests, with canned GraphQL answers and real yq:

  • an idle read is one query and no parse;
  • a changed file is the only one fetched and parsed;
  • a lost cache costs a full read with the same result;
  • corrupted texts, listings and parses are misses;
  • pruning keeps what is in use.
  • 157 tests pass, and ruff, strict mypy and actionlint are clean.

• The live check now reads this repository twice and requires the second read to be one query with no parse.

• Measured against a real repository with 52 workflow files:

  Read	Queries	Downloaded	Time	yq
  Cold	4	1.3 MB	3.1 s	runs
  Idle	1	79 bytes	0.6 s	none

  The cache held 1.9 MB.

[jeffwall-curlewlabs]

Merged with main's branch protection removed for the merge and restored straight after, on the maintainer's call. One required check, test (ubuntu-24.04, 3.10), has been waiting for a GitHub-hosted runner since the first attempt, when GitHub reported it could not assign one. Every other required check passed on this head: lint, actionlint, live, and the ubuntu-24.04, ubuntu-24.04-arm and macos-15 test legs. The suite also passes on Python 3.10 locally (157 tests). This merges #3's commit too.

[jeffwall-curlewlabs]

Branch protection on main is restored. The re-read configuration matches the one saved before the merge, field for field: the same seven required checks, admins included, 0 approvals, no force pushes, no deletions.