personal-sysadmin/scripts/github-admin: /tmp/repos-to-configure.txt is a predictable-path shared cache across 9 scripts (CWE-377 class) #377

Context

While fixing the hardcoded /tmp/repo-config.log PID/LOG-class path in
configure-all-repos.sh (PR fix/launcher-xdg-state, CWE-377 remediation: a
predictable /tmp path lets another local user pre-create, symlink, or race the
file), I found that /tmp/repos-to-configure.txt — written by
configure-all-repos.sh and read by at least these sibling scripts in the same
directory — is a durable, shared, cross-script cache, not one-shot scratch:

add-community-health.sh
add-descriptions.sh
add-justfile-mustfile.sh
add-language-blockers.sh
add-license-badges.sh
add-missing-files.sh
add-readme-roadmap.sh
add-scm-files.sh
advanced-security-config.sh

None of the spot-checked siblings regenerate the file themselves — they all
assume a prior configure-all-repos.sh run already populated
/tmp/repos-to-configure.txt. That means it can't be safely converted to
mktemp -d + trap rm scratch (as the single-file PID/LOG brief prescribes)
without a coordinated edit across all 9 consumers plus the producer, which is
out of scope for a single-file fix.

Left untouched in fix/launcher-xdg-state (confirmed by
grep -nE "[\"'/]tmp/" configure-all-repos.sh showing exactly these 3 hits,
none on lines the PR touches):

gh repo list $OWNER --limit 400 --json name --jq '.[].name' > /tmp/repos-to-configure.txt
total=$(wc -l < /tmp/repos-to-configure.txt)
...
done < /tmp/repos-to-configure.txt

Impact

A predictable shared-cache path under world-writable /tmp lets another local
user pre-create, symlink, or race /tmp/repos-to-configure.txt before
configure-all-repos.sh runs, causing every one of the 9 consumer scripts to
silently act on attacker-controlled repo names/content.

Acceptance criteria

• Producer (configure-all-repos.sh) and all 9 consumers move to a single
  shared, re-findable, non-world-writable path — e.g.
  ${XDG_STATE_HOME:-$HOME/.local/state}/launch-scaffolder/personal-sysadmin/repos-to-configure.txt
  (parent dir created mkdir -p + chmod 0700) — OR each consumer is
  changed to regenerate its own list rather than depending on a stale
  shared file
• bash -n + shellcheck clean on all 10 touched files
• grep -nE "[\"'/]tmp/" reads 0 hits across all 10 files

Related

CWE-377 (Insecure Temporary File). Companion fix (LOG_FILE only, this cache
explicitly out of scope): PR fix/launcher-xdg-state in this repo.