feat(cicd): estate census over GraphQL — 4% of a quota nobody was using

[hyperpolymath]

CICD-SIGNAL-DISCIPLINE says to run the census on a schedule, not once — a one-off audit is archaeology and stale within a week. The REST implementation made that impractical.

Measured, same estate, same data

	REST	GraphQL
cost	~4,000 calls — 80% of core	214 points — 4% of graphql
wall clock	died halfway, twice	3m50s, complete
phantoms reported	59 across 21 repos	56 across 14

GraphQL has a separate 5,000/hour budget that was sitting entirely unused — it read 5000/5000 at the exact moment core hit zero. Requirements cost one point per 25 repositories; emissions one per repo, and only for repos that require something, since a repo requiring nothing cannot have a phantom.

It is also more correct, not merely cheaper

Requirements live in either branch protection or a ruleset. The REST scan read those through different endpoints, so a repo using branch protection was reported as "no ruleset required CodeQL" and its fix silently skipped — which is precisely what happened to knot-rider, neurophone and recon-silly-ation during this campaign. One query returns both, so they cannot drift apart.

statusCheckRollup returns CheckRun names and StatusContext contexts together. Reading only the Actions API brands every external check — SonarCloud and friends — a phantom.

Ruleset target is recorded. Required status checks on a ruleset targeting tags are inert: tags have no pull request to gate. There are 88 such requirements across 16 repos, one carrying 30+. They neither gate nor block, which makes them the hardest of the three species to notice — a fake gate passes without checking, a phantom blocks without reporting, an inert requirement does nothing in either direction.

Disabled rulesets are skipped — enforcement != ACTIVE gates nothing.

Cross-validated, not asserted

Both methods independently find 131 repositories requiring something, differing by one repo that postdates the REST run's repo list. The GraphQL version reports fewer phantoms because its wider sampling (8 commits + 5 PRs, vs 12 runs + 3 commits) produces fewer false positives.

The known limit is in the header, not left to be discovered

A context appearing only on a rare trigger can be missed by any sample. Measured case: Dependabot appears only on Dependabot pull requests, so it is absent unless one falls in the sampled window — and would be wrongly reported as a phantom.

So "phantom" is a candidate requiring confirmation, never a verdict — the same discipline this document already sets for fake gates. --commits and --prs widen the window.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
4 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

⚠️ Edge Case: Fixed connection limits silently truncate requirements/emissions

Every nested GraphQL connection uses a hardcoded page size with no pagination: branchProtectionRules(first: 3), rulesets(first: 5), rules(first: 20) in REQ_QUERY and contexts(first: 100) in EMIT_QUERY. A repo with more than 5 rulesets, more than 20 rules in a ruleset, or more than 3 branch-protection rules will have its extra requirements dropped, and a busy commit with >100 checks will drop emitted contexts — exactly the kind of silent under-reporting this script was written to eliminate (a dropped requirement looks like it doesn't exist; a dropped emission fabricates a phantom). Either raise the caps well above the estate maximum and assert hasNextPage is false, or paginate these connections.

_{Was this helpful? React with 👍 / 👎}

[gitar-bot]

💡 Bug: Cursor passed via -F may be coerced from string to non-string

The pagination cursor is passed with -F cursor="$CURSOR", and gh api's -F/--field performs automatic type coercion (numbers, booleans, null). GitHub cursors are base64 strings that can resemble those types, in which case the wrong type is sent for the $cursor: String variable, breaking pagination for that login and silently ending the scan early. Use the raw-field flag for the non-null branch: -f cursor="$CURSOR" (the null branch must stay -F cursor=null).

Send the cursor as a raw string to avoid type coercion.:

if [ -z "$CURSOR" ]; then
  RESP=$(gh api graphql -F login="$LOGIN" -F cursor=null -f query="$REQ_QUERY" 2>/dev/null)
else
  RESP=$(gh api graphql -F login="$LOGIN" -f cursor="$CURSOR" -f query="$REQ_QUERY" 2>/dev/null)
fi

_{Was this helpful? React with 👍 / 👎}

[gitar-bot]

💡 Edge Case: --commits/--prs crash on missing or non-numeric value

Under set -u, invoking --commits or --prs as the final argument makes $2 an unbound variable, aborting the script with a cryptic error rather than a usage message. There is also no validation that the value is numeric, so --commits foo is passed to the Int! GraphQL variable, causing every emission query to error out and return no data. Validate that the option has a numeric argument before assigning.

Reject missing or non-numeric option values with a clear message.:

--commits) [ "${2:-}" -ge 0 ] 2>/dev/null || { echo "--commits needs a number" >&2; exit 2; }; COMMITS="$2"; shift 2 ;;
--prs)     [ "${2:-}" -ge 0 ] 2>/dev/null || { echo "--prs needs a number" >&2; exit 2; }; PRS="$2"; shift 2 ;;

_{Was this helpful? React with 👍 / 👎}

[gitar-bot]

💡 Quality: Temporary $OUT.repos file is never cleaned up

The intermediate repo list written to "$OUT.repos" is left on disk after the run completes. It is harmless but clutters the output directory and can go stale across runs. Remove it at the end (e.g. rm -f "$OUT.repos") or register a trap.

_{Was this helpful? React with 👍 / 👎}

[gitar-bot]

⚠️ This PR is blocked due to unresolved code review findings.

_{Configure merge blocking · Maintainers can dismiss this review.}

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review ⚠️ Changes requested 0 resolved / 4 findings

Migrates the estate census from REST to GraphQL to drastically reduce quota consumption and correct branch protection drift. However, the implementation needs fixes for unpaginated nested connections, string coercion on pagination cursors, missing argument validation for flags, and cleanup of the temporary repo file.

⚠️ Edge Case: Fixed connection limits silently truncate requirements/emissions

📄 scripts/cicd-census.sh:71-76 📄 scripts/cicd-census.sh:140

Every nested GraphQL connection uses a hardcoded page size with no pagination: branchProtectionRules(first: 3), rulesets(first: 5), rules(first: 20) in REQ_QUERY and contexts(first: 100) in EMIT_QUERY. A repo with more than 5 rulesets, more than 20 rules in a ruleset, or more than 3 branch-protection rules will have its extra requirements dropped, and a busy commit with >100 checks will drop emitted contexts — exactly the kind of silent under-reporting this script was written to eliminate (a dropped requirement looks like it doesn't exist; a dropped emission fabricates a phantom). Either raise the caps well above the estate maximum and assert hasNextPage is false, or paginate these connections.

💡 Bug: Cursor passed via -F may be coerced from string to non-string

📄 scripts/cicd-census.sh:113-115

The pagination cursor is passed with -F cursor="$CURSOR", and gh api's -F/--field performs automatic type coercion (numbers, booleans, null). GitHub cursors are base64 strings that can resemble those types, in which case the wrong type is sent for the $cursor: String variable, breaking pagination for that login and silently ending the scan early. Use the raw-field flag for the non-null branch: -f cursor="$CURSOR" (the null branch must stay -F cursor=null).

Send the cursor as a raw string to avoid type coercion.

if [ -z "$CURSOR" ]; then
  RESP=$(gh api graphql -F login="$LOGIN" -F cursor=null -f query="$REQ_QUERY" 2>/dev/null)
else
  RESP=$(gh api graphql -F login="$LOGIN" -f cursor="$CURSOR" -f query="$REQ_QUERY" 2>/dev/null)
fi

💡 Edge Case: --commits/--prs crash on missing or non-numeric value

📄 scripts/cicd-census.sh:50-56

Under set -u, invoking --commits or --prs as the final argument makes $2 an unbound variable, aborting the script with a cryptic error rather than a usage message. There is also no validation that the value is numeric, so --commits foo is passed to the Int! GraphQL variable, causing every emission query to error out and return no data. Validate that the option has a numeric argument before assigning.

Reject missing or non-numeric option values with a clear message.

--commits) [ "${2:-}" -ge 0 ] 2>/dev/null || { echo "--commits needs a number" >&2; exit 2; }; COMMITS="$2"; shift 2 ;;
--prs)     [ "${2:-}" -ge 0 ] 2>/dev/null || { echo "--prs needs a number" >&2; exit 2; }; PRS="$2"; shift 2 ;;

💡 Quality: Temporary $OUT.repos file is never cleaned up

📄 scripts/cicd-census.sh:127 📄 scripts/cicd-census.sh:171

The intermediate repo list written to "$OUT.repos" is left on disk after the run completes. It is harmless but clutters the output directory and can go stale across runs. Remove it at the end (e.g. rm -f "$OUT.repos") or register a trap.

🤖 Prompt for agents

Code Review: Migrates the estate census from REST to GraphQL to drastically reduce quota consumption and correct branch protection drift. However, the implementation needs fixes for unpaginated nested connections, string coercion on pagination cursors, missing argument validation for flags, and cleanup of the temporary repo file.

1. ⚠️ Edge Case: Fixed connection limits silently truncate requirements/emissions
   Files: scripts/cicd-census.sh:71-76, scripts/cicd-census.sh:140

   Every nested GraphQL connection uses a hardcoded page size with no pagination: branchProtectionRules(first: 3), rulesets(first: 5), rules(first: 20) in REQ_QUERY and contexts(first: 100) in EMIT_QUERY. A repo with more than 5 rulesets, more than 20 rules in a ruleset, or more than 3 branch-protection rules will have its extra requirements dropped, and a busy commit with >100 checks will drop emitted contexts — exactly the kind of silent under-reporting this script was written to eliminate (a dropped requirement looks like it doesn't exist; a dropped emission fabricates a phantom). Either raise the caps well above the estate maximum and assert hasNextPage is false, or paginate these connections.

2. 💡 Bug: Cursor passed via -F may be coerced from string to non-string
   Files: scripts/cicd-census.sh:113-115

   The pagination cursor is passed with `-F cursor="$CURSOR"`, and `gh api`'s `-F/--field` performs automatic type coercion (numbers, booleans, null). GitHub cursors are base64 strings that can resemble those types, in which case the wrong type is sent for the `$cursor: String` variable, breaking pagination for that login and silently ending the scan early. Use the raw-field flag for the non-null branch: `-f cursor="$CURSOR"` (the null branch must stay `-F cursor=null`).

   Fix (Send the cursor as a raw string to avoid type coercion.):
   if [ -z "$CURSOR" ]; then
     RESP=$(gh api graphql -F login="$LOGIN" -F cursor=null -f query="$REQ_QUERY" 2>/dev/null)
   else
     RESP=$(gh api graphql -F login="$LOGIN" -f cursor="$CURSOR" -f query="$REQ_QUERY" 2>/dev/null)
   fi

3. 💡 Edge Case: --commits/--prs crash on missing or non-numeric value
   Files: scripts/cicd-census.sh:50-56

   Under `set -u`, invoking `--commits` or `--prs` as the final argument makes `$2` an unbound variable, aborting the script with a cryptic error rather than a usage message. There is also no validation that the value is numeric, so `--commits foo` is passed to the `Int!` GraphQL variable, causing every emission query to error out and return no data. Validate that the option has a numeric argument before assigning.

   Fix (Reject missing or non-numeric option values with a clear message.):
   --commits) [ "${2:-}" -ge 0 ] 2>/dev/null || { echo "--commits needs a number" >&2; exit 2; }; COMMITS="$2"; shift 2 ;;
   --prs)     [ "${2:-}" -ge 0 ] 2>/dev/null || { echo "--prs needs a number" >&2; exit 2; }; PRS="$2"; shift 2 ;;

4. 💡 Quality: Temporary $OUT.repos file is never cleaned up
   Files: scripts/cicd-census.sh:127, scripts/cicd-census.sh:171

   The intermediate repo list written to `"$OUT.repos"` is left on disk after the run completes. It is harmless but clutters the output directory and can go stale across runs. Remove it at the end (e.g. `rm -f "$OUT.repos"`) or register a trap.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

---

Important

Your trial ends in 4 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

_{Was this helpful? React with 👍 / 👎 | Gitar}