From the 2026-07-06 codebase audit (docs/audits/codebase-audit-2026-07-06.md, in-repo). Finding IDs are stable — cite them in fixes.
Severity: Critical · Status: CONFIRMED
Problem
automerge-dependabot.yml and lighthouse-to-slack.yml sit in website/.github/workflows/. GitHub Actions only reads workflows from the repository root .github/workflows/ — there is no root .github/ at all (the PR template is also in the unread location). Evidence it has never fired: an unmerged dependabot/npm_and_yarn/website/... branch sits on origin.
Failure scenario
A PR that breaks bun run build:engine or website typecheck merges green because nothing runs. Combined with the committed-dist pipeline (C6/C60), dist can silently drift from src with no tripwire — the audit verified dist is in sync today, but every mechanism that would keep it true tomorrow is absent.
Direction
Move workflows to root .github/workflows/ with paths: filters; add one minimal CI job: install → build engine+react → diff freshly-built dist against committed dist (fail on drift) → website typecheck/build → bun test. The dist-drift check is what makes the committed artifact safe to keep at all (audit design tension 4). Pairs with the tests issue (C59).
Severity: Critical · Status: CONFIRMED
Problem
automerge-dependabot.ymlandlighthouse-to-slack.ymlsit inwebsite/.github/workflows/. GitHub Actions only reads workflows from the repository root.github/workflows/— there is no root.github/at all (the PR template is also in the unread location). Evidence it has never fired: an unmergeddependabot/npm_and_yarn/website/...branch sits on origin.Failure scenario
A PR that breaks
bun run build:engineor website typecheck merges green because nothing runs. Combined with the committed-dist pipeline (C6/C60), dist can silently drift from src with no tripwire — the audit verified dist is in sync today, but every mechanism that would keep it true tomorrow is absent.Direction
Move workflows to root
.github/workflows/withpaths:filters; add one minimal CI job: install → build engine+react → diff freshly-built dist against committed dist (fail on drift) → website typecheck/build →bun test. The dist-drift check is what makes the committed artifact safe to keep at all (audit design tension 4). Pairs with the tests issue (C59).