You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The value was never edited — .config/buddy-bot.ts has exactly one commit in its history (ee6a5e03, 2026-04-28, "chore: initial commit").
The result is a split-brain bot. Every GitHub REST/GraphQL call ts-css's buddy-bot makes goes to stacksjs/ts-starter (this repo), while every git operation runs against the local ts-css checkout. buddy-bot is pinned at 0.9.20 (via better-dx@0.2.15), which early-returns when the config supplies both owner and name, so GITHUB_REPOSITORY did not override it. (0.10.5 fixed that; ts-css does not run it.)
This is not a reads-only incident. Writes to this repo are confirmed, from three independent evidence lines that agree: content fingerprints (ts-css's dependencies appearing in this repo's data), ts-css Actions run logs naming this repo's PR numbers, and run-window timing.
Both repos' bots act as chrisbbreuer and use overlapping crons, so actor and timing alone cannot attribute anything. Everything below rests on content fingerprints or on ts-css run logs.
Exposure window: ts-css's buddy-bot workflow has run 5,416 times since 2026-05-03 — 122 days, three crons (5,25,45 * * * *, 0 */2 * * *, 15 */2 * * *). Earliest observed write to this repo is 2026-05-27.
Confirmed writes to this repo
1. Dependency Dashboard #58 is being overwritten with ts-css's dependency list
ts-css's dashboard job rewrites your issue #58, replacing your dependency inventory with its own.
Of the 100 content edits GitHub still retains for #58, 19 carry ts-css's exact package.json — bunfig, @types/css-tree ^2.3.11, @types/csso ^5.0.4, css-select ^7.0.0, css-tree ^3.2.1, css-what ^8.0.0, csso ^5.0.5, mitata ^1.0.34. This repo's devDependencies are { better-dx: ^0.2.15 } and nothing else, so those bodies cannot have been generated from this tree.
Retained ts-css edits span 2026-08-29T11:01:17Z → 2026-09-02T11:12:28Z. All 19 also fall inside a ts-css Actions run window (e.g. the 11:12:28Z edit sits inside ts-css run 33623352278, 11:11:58–11:12:32).
The split brain is visible inside a single document: the same contaminated body lists your open PRs (#1250, #1246, #1245, #1237) under ## Open while listing ts-css's packages under "Detected dependencies". API side = ts-starter, filesystem side = ts-css.
#58 is clean right now (updated_at 2026-09-02T12:47:28Z, package.json section shows only better-dx ^0.2.15) because your own correctly-configured bot wrote last. Contamination recurs several times per day and your bot corrects it minutes later.
Note: 20 of the 100 retained edits carry a different foreign fingerprint (@types/xml2js, fast-xml-parser, sax) — stacksjs/ts-xml, which has the same stale config. See "Not just ts-css" below.
2. Thirteen of your buddy-bot PRs were commented on and closed by ts-css
Every week from 2026-05-27 to 2026-08-27, ts-css closed yourbuddy-bot/update-github-actions PR with a false explanation ("the dependency files it references are no longer present in the project" — they are present in your workflows).
Eleven are confirmed directly from ts-css's own run logs, which name your PR numbers:
🔄 Found existing PR #1257: chore(deps): update github actions
🔒 Auto-closing PR #1257 due to config change
💬 Added comment to PR #1257
✅ Closed PR #1257
Comment 5443718851 on your PR #1257 is timestamped 2026-08-27T18:45:39Z — a sub-second match to the log line. (I re-verified this comment is present.)
Two more pairs — #1241 (2026-05-27T00:41:35Z) and #1242 (2026-06-03T03:10:32Z) — match the same weekly pattern and ts-css run windows, but their logs have aged past 90-day retention. Treat those two as probable, not proven.
No human discussion was disturbed. All 47 issue/PR comments repo-wide since 2026-04-28 are the same bot "Auto-closing obsolete PR" message on buddy-bot PRs.
3. Stray branch refs created here — recurring, most recently today
ts-css creates the ref buddy-bot/update-major-update-typescss-tree on this repo. The slug decodes to @types/css-tree, which is a ts-css devDependency and is declared by no other repo in the org (code search TOTAL=1).
14 CreateEvents survive in the events feed (2026-08-28T16:29:19Z → 2026-09-01T19:10:06Z), each pairing with a ts-css PR creation 2–4 seconds later (ts-css PRs #279–#297, same head ref, all titled "chore(deps): update dependency @types/css-tree to 3.2.0"). Every create sits inside a ts-css run window and outside every ts-starter run window.
It is still happening. From your own run 33645956187 today:
15:02:53Z * [new branch] buddy-bot/update-major-update-typescss-tree -> origin/...
15:02:57Z 🔍 Found 2 orphaned buddy-bot branches (no associated open PRs)
15:02:57Z - buddy-bot/update-major-update-typescss-tree (38 days old)
15:03:00Z ✅ Deleted branch buddy-bot/update-major-update-typescss-tree via git
A point-in-time gh api repos/stacksjs/ts-starter/branches shows nothing because your own bot reaps the orphan every couple of hours.
4. Four issues were mislabeled; three are still wrong
buddy-bot labels a PR via POST /repos/{owner}/{repo}/issues/{number}/labels. With owner/name pointing here but the number computed from ts-css — and GitHub sharing one number space between issues and PRs — ts-css PR #N's labels landed on ts-starter issue #N. ts-css's own PRs #31/#58/#102 have empty label timelines, consistent with misdelivery.
#102 is the one that matters reputationally: an outside contributor's issue in this repo currently wears a label for a package this repo does not use.
Corrections to earlier claims
Several things that were suspected turned out to be wrong, in both directions. Stating them plainly:
"No stray branch was ever created here" — FALSE. Verified above from your own checkout log at 15:02:53Z today.
"ts-css pushed a stray branch with its content" — OVERSTATED. The ref was created pointing at this repo's own main tip, and there are zero PushEvents to it. ts-css PR chore(deps): update all non-major dependencies #297's head sha returns HTTP 422 "No commit found for SHA" against this repo, and search/commits repo:stacksjs/ts-starter css-tree returns 0. The "(38 days old)" cleanup line back-dates the ref to ~2026-07-26, matching your own main tip 5fd2831d (2026-07-25). No ts-css file content ever entered this repo's git history. No PR was ever opened here for that branch.
pushed_at = 2026-09-02T15:03:00Z is not a ts-css write. That is your own bot deleting the stray ref, logged at 15:03:00.404Z.
Commit 7202f85 (2026-09-02T12:19:08Z) is yours, not ts-css's. Your run 33629193320 rebased your own PR chore(deps): update all non-major dependencies #1250; the diff bumps your own better-dx ^0.2.15 → ^0.2.25.
The bunfig label's creation is not ts-css's. GraphQL shows createdAt 2025-08-17T06:01:40Z, predating ts-css. Its application to Dependency Dashboard #3 still is.
Contaminated-dashboard count: one pass reported 39 edits; a direct re-count of all 100 retained edits gives 19 bearing ts-css's fingerprint. 19 is the defensible number.
Not just ts-css
gh api -X GET search/code -f q="\"name: 'ts-starter'\" org:stacksjs path:.config"
→ 8 repos
ts-starter (correct, its own name) plus ts-css, ts-xml, ts-printers, ts-fonts, ts-svg, ts-ssh, ts-git-lfs — all seven hardcode owner: 'stacksjs', name: 'ts-starter'.
This explains behaviour ts-css alone doesn't: the 20 xml-flavoured dashboard edits, the weekly three-closes-and-two-reopens pattern on your buddy-bot PRs (ts-css reliably performed the second close), and label churn in minutes when no ts-css run was active. ts-git-lfs and ts-ssh show no runs since 2026-08-25 and look dormant; the other five are actively writing here.
Fixing ts-css addresses roughly one sixth of the live contamination. The root-cause fix for ts-css is open at stacksjs/ts-css#302. Anything else scaffolded from this template deserves the same check.
Suggested actions
Fix the other six. Merging stacksjs/ts-css#302 stops one writer; ts-xml, ts-printers, ts-fonts, ts-svg, ts-ssh, ts-git-lfs need the same edit. Making buddy-bot's repository block default to GITHUB_REPOSITORY — or removing it from the template scaffold entirely — prevents recurrence for every future repo seeded from here.
Bump buddy-bot past 0.9.20 in the template. 0.10.5 lets GITHUB_REPOSITORY override the config, which would have made this self-healing.
Consider a ruleset blocking ref creation under buddy-bot/* by anything other than your own workflow, as a stopgap while the sibling repos are fixed.
What could not be established
Counts are floors, not totals. GitHub retains ~100 content edits per issue (≈4.4 days here), ~300 repo events, and expires Actions logs after 90 days. The 19 dashboard rewrites, 14 ref creations and 13 PR closes are what survived retention across a 122-day window. The label events prove ts-css was writing here as far back as 2026-04-29 and the config never changed, so earlier activity is near-certain — but it cannot be enumerated and is not asserted here.
Who performs the first close and the reopens in each weekly cycle is unidentified — almost certainly one or more of the six sibling repos, not verified.
Label churn on PR chore(deps): update all non-major dependencies #1250 (npm/better-dx labeled/unlabeled at 2026-08-29T14:54:14Z, 2026-08-30T14:38:23Z, 2026-08-30T18:59:53Z, 2026-09-01T14:27:56Z, 2026-09-02T14:01:30Z) falls inside ts-css and ts-fonts/ts-svg windows simultaneously. Genuinely ambiguous; not attributed.
Summary
stacksjs/ts-csshas a stale.config/buddy-bot.tscopied from this template:The value was never edited —
.config/buddy-bot.tshas exactly one commit in its history (ee6a5e03, 2026-04-28, "chore: initial commit").The result is a split-brain bot. Every GitHub REST/GraphQL call ts-css's buddy-bot makes goes to
stacksjs/ts-starter(this repo), while every git operation runs against the local ts-css checkout. buddy-bot is pinned at0.9.20(viabetter-dx@0.2.15), which early-returns when the config supplies bothownerandname, soGITHUB_REPOSITORYdid not override it. (0.10.5fixed that; ts-css does not run it.)This is not a reads-only incident. Writes to this repo are confirmed, from three independent evidence lines that agree: content fingerprints (ts-css's dependencies appearing in this repo's data), ts-css Actions run logs naming this repo's PR numbers, and run-window timing.
Both repos' bots act as
chrisbbreuerand use overlapping crons, so actor and timing alone cannot attribute anything. Everything below rests on content fingerprints or on ts-css run logs.Exposure window: ts-css's buddy-bot workflow has run 5,416 times since 2026-05-03 — 122 days, three crons (
5,25,45 * * * *,0 */2 * * *,15 */2 * * *). Earliest observed write to this repo is 2026-05-27.Confirmed writes to this repo
1. Dependency Dashboard #58 is being overwritten with ts-css's dependency list
ts-css's
dashboardjob rewrites your issue #58, replacing your dependency inventory with its own.Of the 100 content edits GitHub still retains for #58, 19 carry ts-css's exact
package.json—bunfig,@types/css-tree ^2.3.11,@types/csso ^5.0.4,css-select ^7.0.0,css-tree ^3.2.1,css-what ^8.0.0,csso ^5.0.5,mitata ^1.0.34. This repo'sdevDependenciesare{ better-dx: ^0.2.15 }and nothing else, so those bodies cannot have been generated from this tree.Retained ts-css edits span
2026-08-29T11:01:17Z→2026-09-02T11:12:28Z. All 19 also fall inside a ts-css Actions run window (e.g. the 11:12:28Z edit sits inside ts-css run33623352278, 11:11:58–11:12:32).The split brain is visible inside a single document: the same contaminated body lists your open PRs (#1250, #1246, #1245, #1237) under
## Openwhile listing ts-css's packages under "Detected dependencies". API side = ts-starter, filesystem side = ts-css.#58 is clean right now (
updated_at 2026-09-02T12:47:28Z, package.json section shows onlybetter-dx ^0.2.15) because your own correctly-configured bot wrote last. Contamination recurs several times per day and your bot corrects it minutes later.2. Thirteen of your buddy-bot PRs were commented on and closed by ts-css
Every week from 2026-05-27 to 2026-08-27, ts-css closed your
buddy-bot/update-github-actionsPR with a false explanation ("the dependency files it references are no longer present in the project" — they are present in your workflows).Eleven are confirmed directly from ts-css's own run logs, which name your PR numbers:
2726048706027679860167← final close, stayed closed2851920352328956782089← final close, stayed closed29443062245299574423913050704706831077215605316850710133236975275033105029940Sample log excerpt from run
33105029940:Comment
5443718851on your PR #1257 is timestamped2026-08-27T18:45:39Z— a sub-second match to the log line. (I re-verified this comment is present.)Two more pairs — #1241 (2026-05-27T00:41:35Z) and #1242 (2026-06-03T03:10:32Z) — match the same weekly pattern and ts-css run windows, but their logs have aged past 90-day retention. Treat those two as probable, not proven.
No human discussion was disturbed. All 47 issue/PR comments repo-wide since 2026-04-28 are the same bot "Auto-closing obsolete PR" message on buddy-bot PRs.
3. Stray branch refs created here — recurring, most recently today
ts-css creates the ref
buddy-bot/update-major-update-typescss-treeon this repo. The slug decodes to@types/css-tree, which is a ts-css devDependency and is declared by no other repo in the org (code search TOTAL=1).14 CreateEvents survive in the events feed (2026-08-28T16:29:19Z → 2026-09-01T19:10:06Z), each pairing with a ts-css PR creation 2–4 seconds later (ts-css PRs #279–#297, same head ref, all titled "chore(deps): update dependency @types/css-tree to 3.2.0"). Every create sits inside a ts-css run window and outside every ts-starter run window.
It is still happening. From your own run
33645956187today:A point-in-time
gh api repos/stacksjs/ts-starter/branchesshows nothing because your own bot reaps the orphan every couple of hours.4. Four issues were mislabeled; three are still wrong
buddy-bot labels a PR via
POST /repos/{owner}/{repo}/issues/{number}/labels. Withowner/namepointing here but the number computed from ts-css — and GitHub sharing one number space between issues and PRs — ts-css PR #N's labels landed on ts-starter issue #N. ts-css's own PRs #31/#58/#102 have empty label timelines, consistent with misdelivery.bunfig,dependencies,npm,patchbunfigyes — this repo has no bunfig dependency@types/css-tree,major@types/css-treeyes@types/css-tree,major,npm@types/css-tree,major@types/css-treeyes#102 is the one that matters reputationally: an outside contributor's issue in this repo currently wears a label for a package this repo does not use.
Corrections to earlier claims
Several things that were suspected turned out to be wrong, in both directions. Stating them plainly:
maintip, and there are zero PushEvents to it. ts-css PR chore(deps): update all non-major dependencies #297's head sha returns HTTP 422 "No commit found for SHA" against this repo, andsearch/commits repo:stacksjs/ts-starter css-treereturns 0. The "(38 days old)" cleanup line back-dates the ref to ~2026-07-26, matching your ownmaintip5fd2831d(2026-07-25). No ts-css file content ever entered this repo's git history. No PR was ever opened here for that branch.pushed_at = 2026-09-02T15:03:00Zis not a ts-css write. That is your own bot deleting the stray ref, logged at 15:03:00.404Z.7202f85(2026-09-02T12:19:08Z) is yours, not ts-css's. Your run33629193320rebased your own PR chore(deps): update all non-major dependencies #1250; the diff bumps your ownbetter-dx ^0.2.15 → ^0.2.25.bunfiglabel's creation is not ts-css's. GraphQL showscreatedAt 2025-08-17T06:01:40Z, predating ts-css. Its application to Dependency Dashboard #3 still is.Not just ts-css
ts-starter(correct, its own name) plusts-css,ts-xml,ts-printers,ts-fonts,ts-svg,ts-ssh,ts-git-lfs— all seven hardcodeowner: 'stacksjs', name: 'ts-starter'.This explains behaviour ts-css alone doesn't: the 20 xml-flavoured dashboard edits, the weekly three-closes-and-two-reopens pattern on your buddy-bot PRs (ts-css reliably performed the second close), and label churn in minutes when no ts-css run was active.
ts-git-lfsandts-sshshow no runs since 2026-08-25 and look dormant; the other five are actively writing here.Fixing ts-css addresses roughly one sixth of the live contamination. The root-cause fix for ts-css is open at stacksjs/ts-css#302. Anything else scaffolded from this template deserves the same check.
Suggested actions
ts-xml,ts-printers,ts-fonts,ts-svg,ts-ssh,ts-git-lfsneed the same edit. Making buddy-bot'srepositoryblock default toGITHUB_REPOSITORY— or removing it from the template scaffold entirely — prevents recurrence for every future repo seeded from here.0.10.5letsGITHUB_REPOSITORYoverride the config, which would have made this self-healing.bunfigfrom Dependency Dashboard #3,@types/css-treefrom Action Required: Fix Renovate Configuration #31,@types/css-treefrom Extension lack in dts #102. Extension lack in dts #102 belongs to an outside contributor.buddy-bot/*by anything other than your own workflow, as a stopgap while the sibling repos are fixed.What could not be established
npm/better-dxlabeled/unlabeled at 2026-08-29T14:54:14Z, 2026-08-30T14:38:23Z, 2026-08-30T18:59:53Z, 2026-09-01T14:27:56Z, 2026-09-02T14:01:30Z) falls inside ts-css and ts-fonts/ts-svg windows simultaneously. Genuinely ambiguous; not attributed.bun.sh/patch/systemevents on Action Required: Fix Renovate Configuration #31 and Dependency Dashboard #58 (May–June 2026) match no ts-css PR. Not attributed to ts-css.@types/css-treelabel events on PRs chore(deps): update dependency actions/checkout to v6.0.2 #281–chore(deps): update dependency actions/cache to v5.0.3 #301 dated 2026-04-14 to 2026-04-16 predate ts-css's existence while the label'screatedAtis 2026-08-03. Unreconciled; not attributed.