Tracking: July 2026 maintenance audit (83 verified findings)

[mmcky]

Tracking issue for the July 2026 full-repository maintenance audit. Milestone: Maintenance audit 2026-07.

A multi-agent sweep of every tracked file across 14 dimensions, then two adversarial verification passes: 135 raw findings, 63 rejected, 72 confirmed, 11 added by four completeness sweeps, 83 actioned. Nothing found is architectural.

The work, ordered by dependency

• ci: repair the container publish and validation pipeline #103 — repair the container publish and validation pipeline (infrastructure high-priority) — done in v0.9.0 (ci: repair the container publish and validation pipeline #111): uppercase ghcr.io/QuantEcon/… from github.repository_owner made buildx registry cache refs fail non-fatally, leaving builds cold and green (CHANGELOG.md:233-237); an unserialised workflow let an older commit win :latest (:238-240); a concurrency group shared across runs cancelled most of the lecture-validation matrix (:241-247); both unattended workflows now open a deduplicated failure issue via scripts/create-ci-failure-issue.sh (:194-200), the alerting nine red weeks in Feb–Apr 2026 lacked.
• fix(restore-jupyter-cache): save-mode outputs and fail-on-miss are broken #104 — restore-jupyter-cache save-mode outputs (bug high-priority) — done in v0.9.0 (fix(restore-jupyter-cache): repair save-mode outputs and fail-on-miss #112); unblocks the Optimize preview builds: phased plan for the fastest PR previews (tracking) #92 save-cache rollout. Top-level actions/cache@v6 declares only cache-hit, so save mode's outputs came back empty — cache-hit false on a perfect restore, fail-on-miss failing unconditionally; restore now always uses actions/cache/restore@v6, with a lookup-only: true step registering the job-end save hook (CHANGELOG.md:213-221). In CI since v0.10.0: both cache types × both modes, fail-on-miss both ways (CHANGELOG.md:141-151).
• fix(preview): surface deploy errors, pin CLIs, remove unsafe fork guidance #105 — preview deploy errors, CLI pinning, fork guidance (bug security high-priority). Partly overtaken by v0.11.1 (fix(preview-cloudflare): link the stable pr-N alias, not the deployment hash (#14) #131): deploy-url now comes from the pr-N alias, not a grep of wrangler output, and the surviving deployment-url extraction ends || true (preview-cloudflare/action.yml:124, :131-134). Untouched: DEPLOY_OUTPUT=$(wrangler … 2>&1) at :93 still aborts under -e, leaving the output dump at :102-104 and friendly error at :106-109 unreachable, and wrangler@latest is unpinned at :71. Line numbers have drifted; re-derive before editing. Closes PLAN item 8.
• docs: sweep to the Anaconda 2026.06 baseline and measured container sizes #106 — Anaconda 2026.06 baseline and measured sizes (documentation high-priority). CHANGELOG half closed: Migrate both containers to the Anaconda 2026.06 baseline #95/ci: bump the github-actions-major group across 4 directories with 2 updates #90/ci: bump the github-actions group across 2 directories with 5 updates #94 gaps filled in the v0.9.0 section (CHANGELOG.md:203-210), ci: bump softprops/action-gh-release from 3.0.1 to 3.0.2 in /publish-gh-pages in the github-actions group across 1 directory #101 recorded retrospectively in v0.10.0 (CHANGELOG.md:166-169). Seven sites still say Anaconda 2025.12 while both images ship anaconda=2026.06 (containers/quantecon/environment.yml:11): docs/ARCHITECTURE.md:12, docs/CONTAINER-GUIDE.md:9, containers/README.md:18, containers/quantecon/README.md:15 and :107, containers/quantecon-build/README.md:26 and :82. The dependency policy in PLAN.md, which actively misled by pinning containers back to a superseded baseline, was corrected in docs(plan): clear the last stale facts and disposition the whole tracker #139. Six docs also carry the round ~8GB / ~3GB pair and a "~60% smaller" claim README.md:147-148 contradicts (containers/README.md:9 and :35); v0.11.0 moved CI size reporting to compressed manifest bytes (CHANGELOG.md:83-84), not comparable, so stragglers need re-measuring, not copying.
• fix(actions): batch of small correctness fixes across the seven actions #107 — batch of small correctness fixes (bug). 7 of 10 boxes remain. The if: always() fix landed — both guards read always() && … != 'true' at build-jupyter-cache/action.yml:384 and :649 — and fix(build-jupyter-cache): make container-mode failure alerting actually work (#83) #122 deleted build-jupyter-cache/scripts/, mooting its two create-failure-issue.sh items. The substring builder parse is still live: validation at build-jupyter-cache/action.yml:106, the same three *"jupyter"* / *"pdflatex"* / *"html"* tests repeated at :120-136. Advances PLAN items 7 and 15.
• test: unify container smoke tests and make the fixture exercise the Dockerfiles #108 — unify container smoke tests, fix the fixture (infrastructure). Mostly shipped in v0.11.0 (test(containers): make the container fixture able to fail (#108) #125): containers/quantecon/tests/smoke-test.sh covers the container marker, xelatex, an executing HTML build and pdflatex, plus a --self-test that fails if a raising cell stays green; .github/workflows/test-container.yml:14-37 is one two-image matrix (:24-25) running a real container: job (:32-37) instead of docker run, size split to a sibling job (:77-101); smoke-test.sh:83-84 runs unconditionally, giving the lean image its first pdflatex build; the fixture executes and asserts; run-local-tests.sh:5 has set -euo pipefail. Two residuals, one PR's worth: containers/quantecon/tests/test-container.sh survives untouched with containers/quantecon/README.md:227 still pointing at it, and the fixture keeps html_theme: sphinx_book_theme and fontpkg: "" (containers/quantecon/tests/minimal-jupyter-book/_config.yml:26 and :28), leaving quantecon_book_theme and FreeSerif untested. Distinct from testing: publish/preview/cache action logic has no automated tests #100 — these tests exist but could not fail.
• docs: reconcile action READMEs and templates with the shipped code #109 — reconcile READMEs and templates with shipped code (documentation). Fold in docs: QUICK-REFERENCE "Pages 404?" snippet recommends the wrong permissions #99 while in the same file.

Tracker structure

QEP-2 routes umbrella issues to native sub-issues with no Type label on the parent.

• Add fix(preview): surface deploy errors, pin CLIs, remove unsafe fork guidance #105–docs: reconcile action READMEs and templates with the shipped code #109 as native sub-issues, plus closed ci: repair the container publish and validation pipeline #103 and fix(restore-jupyter-cache): save-mode outputs and fail-on-miss are broken #104 for the audit trail. — done; all seven are linked.
• Then remove the maintenance Type label — done, in that order: QEP-2's exemption from "unlabelled means needs triage" keys on the sub-issue relationship, so dropping it first would have left the tracker looking untriaged rather than structural.

Labelling and related issues

Labels follow QEP-2, now Accepted: infrastructure not maintenance for CI/build/deploy work, grouping by milestone rather than an audit label. security on #105 is a cross-cutting modifier, not a second Type. testing is retired to infrastructure/maintenance; #108 and #100 both moved, so nothing here uses it.

Nothing supersedes an existing issue. #100 (action-logic test coverage) stays open: its stage-1 harness shipped in v0.10.0, #108 covers only existing container tests being unable to fail, and its release-gating stage is tracked in #135. #99 folds into #109. #92 is open and unblocked. #83 and #14 were advanced here but closed elsewhere — #83 in v0.11.0 (#122, #123 variant in #127), which moots PLAN item 14 since create-failure-issue.sh was deleted rather than hardened, and #14 in v0.11.1 (#131). PLAN items 7, 8 and 15 remain open.

The full ranked report — 83 findings, a 26-row quick-wins table, per-finding evidence — sits outside the repo.