Skip to content

Another repo's buddy-bot (stacksjs/ts-css) is misconfigured to target this repo and has been writing to it since May #1258

Description

@chrisbbreuer

Summary

stacksjs/ts-css has a stale .config/buddy-bot.ts copied from this template:

repository: { owner: 'stacksjs', name: 'ts-starter' }

The value was never edited — .config/buddy-bot.ts has exactly one commit in its history (ee6a5e03, 2026-04-28, "chore: initial commit").

The result is a split-brain bot. Every GitHub REST/GraphQL call ts-css's buddy-bot makes goes to stacksjs/ts-starter (this repo), while every git operation runs against the local ts-css checkout. buddy-bot is pinned at 0.9.20 (via better-dx@0.2.15), which early-returns when the config supplies both owner and name, so GITHUB_REPOSITORY did not override it. (0.10.5 fixed that; ts-css does not run it.)

This is not a reads-only incident. Writes to this repo are confirmed, from three independent evidence lines that agree: content fingerprints (ts-css's dependencies appearing in this repo's data), ts-css Actions run logs naming this repo's PR numbers, and run-window timing.

Both repos' bots act as chrisbbreuer and use overlapping crons, so actor and timing alone cannot attribute anything. Everything below rests on content fingerprints or on ts-css run logs.

Exposure window: ts-css's buddy-bot workflow has run 5,416 times since 2026-05-03 — 122 days, three crons (5,25,45 * * * *, 0 */2 * * *, 15 */2 * * *). Earliest observed write to this repo is 2026-05-27.


Confirmed writes to this repo

1. Dependency Dashboard #58 is being overwritten with ts-css's dependency list

ts-css's dashboard job rewrites your issue #58, replacing your dependency inventory with its own.

Of the 100 content edits GitHub still retains for #58, 19 carry ts-css's exact package.jsonbunfig, @types/css-tree ^2.3.11, @types/csso ^5.0.4, css-select ^7.0.0, css-tree ^3.2.1, css-what ^8.0.0, csso ^5.0.5, mitata ^1.0.34. This repo's devDependencies are { better-dx: ^0.2.15 } and nothing else, so those bodies cannot have been generated from this tree.

Retained ts-css edits span 2026-08-29T11:01:17Z2026-09-02T11:12:28Z. All 19 also fall inside a ts-css Actions run window (e.g. the 11:12:28Z edit sits inside ts-css run 33623352278, 11:11:58–11:12:32).

The split brain is visible inside a single document: the same contaminated body lists your open PRs (#1250, #1246, #1245, #1237) under ## Open while listing ts-css's packages under "Detected dependencies". API side = ts-starter, filesystem side = ts-css.

#58 is clean right now (updated_at 2026-09-02T12:47:28Z, package.json section shows only better-dx ^0.2.15) because your own correctly-configured bot wrote last. Contamination recurs several times per day and your bot corrects it minutes later.

Note: 20 of the 100 retained edits carry a different foreign fingerprint (@types/xml2js, fast-xml-parser, sax) — stacksjs/ts-xml, which has the same stale config. See "Not just ts-css" below.

2. Thirteen of your buddy-bot PRs were commented on and closed by ts-css

Every week from 2026-05-27 to 2026-08-27, ts-css closed your buddy-bot/update-github-actions PR with a false explanation ("the dependency files it references are no longer present in the project" — they are present in your workflows).

Eleven are confirmed directly from ts-css's own run logs, which name your PR numbers:

Your PR Comment + close ts-css run
#1243 2026-06-10T07:29:54Z 27260487060
#1244 2026-06-17T09:39:13Z 27679860167 ← final close, stayed closed
#1248 2026-07-01T12:58:24Z 28519203523
#1249 2026-07-08T15:59:35Z 28956782089 ← final close, stayed closed
#1251 2026-07-15T19:04:06Z 29443062245
#1252 2026-07-22T21:00:28Z 29957442391
#1253 2026-07-30T01:56:51Z 30507047068
#1254 2026-08-06T06:25:54Z 31077215605
#1255 2026-08-13T09:06:47Z 31685071013
#1256 2026-08-20T12:37:20Z 32369752750
#1257 2026-08-27T18:45:39Z 33105029940

Sample log excerpt from run 33105029940:

🔄 Found existing PR #1257: chore(deps): update github actions
🔒 Auto-closing PR #1257 due to config change
💬 Added comment to PR #1257
✅ Closed PR #1257

Comment 5443718851 on your PR #1257 is timestamped 2026-08-27T18:45:39Z — a sub-second match to the log line. (I re-verified this comment is present.)

Two more pairs — #1241 (2026-05-27T00:41:35Z) and #1242 (2026-06-03T03:10:32Z) — match the same weekly pattern and ts-css run windows, but their logs have aged past 90-day retention. Treat those two as probable, not proven.

No human discussion was disturbed. All 47 issue/PR comments repo-wide since 2026-04-28 are the same bot "Auto-closing obsolete PR" message on buddy-bot PRs.

3. Stray branch refs created here — recurring, most recently today

ts-css creates the ref buddy-bot/update-major-update-typescss-tree on this repo. The slug decodes to @types/css-tree, which is a ts-css devDependency and is declared by no other repo in the org (code search TOTAL=1).

14 CreateEvents survive in the events feed (2026-08-28T16:29:19Z → 2026-09-01T19:10:06Z), each pairing with a ts-css PR creation 2–4 seconds later (ts-css PRs #279#297, same head ref, all titled "chore(deps): update dependency @types/css-tree to 3.2.0"). Every create sits inside a ts-css run window and outside every ts-starter run window.

It is still happening. From your own run 33645956187 today:

15:02:53Z  * [new branch] buddy-bot/update-major-update-typescss-tree -> origin/...
15:02:57Z  🔍 Found 2 orphaned buddy-bot branches (no associated open PRs)
15:02:57Z    - buddy-bot/update-major-update-typescss-tree (38 days old)
15:03:00Z  ✅ Deleted branch buddy-bot/update-major-update-typescss-tree via git

A point-in-time gh api repos/stacksjs/ts-starter/branches shows nothing because your own bot reaps the orphan every couple of hours.

4. Four issues were mislabeled; three are still wrong

buddy-bot labels a PR via POST /repos/{owner}/{repo}/issues/{number}/labels. With owner/name pointing here but the number computed from ts-css — and GitHub sharing one number space between issues and PRs — ts-css PR #N's labels landed on ts-starter issue #N. ts-css's own PRs #31/#58/#102 have empty label timelines, consistent with misdelivery.

Issue Labels written When Still present?
#3 "Dependency Dashboard" (open) bunfig, dependencies, npm, patch 2026-04-29T00:36:04Z, 1s after ts-css PR #3 bunfig yes — this repo has no bunfig dependency
#31 "Action Required: Fix Renovate Configuration" (closed) @types/css-tree, major 2026-08-05T13:57:14Z, 1s after ts-css PR #31 @types/css-tree yes
#58 "Dependency Dashboard" (open) @types/css-tree, major, npm added 2026-08-08T08:34:46Z, removed 08:56:03Z no — self-reverted
#102 "Extension lack in dts" (closed, filed by @tomaswrobel-fastest) @types/css-tree, major 2026-08-12T01:26:11Z, 1s after ts-css PR #102 @types/css-tree yes

#102 is the one that matters reputationally: an outside contributor's issue in this repo currently wears a label for a package this repo does not use.


Corrections to earlier claims

Several things that were suspected turned out to be wrong, in both directions. Stating them plainly:


Not just ts-css

gh api -X GET search/code -f q="\"name: 'ts-starter'\" org:stacksjs path:.config"
→ 8 repos

ts-starter (correct, its own name) plus ts-css, ts-xml, ts-printers, ts-fonts, ts-svg, ts-ssh, ts-git-lfs — all seven hardcode owner: 'stacksjs', name: 'ts-starter'.

This explains behaviour ts-css alone doesn't: the 20 xml-flavoured dashboard edits, the weekly three-closes-and-two-reopens pattern on your buddy-bot PRs (ts-css reliably performed the second close), and label churn in minutes when no ts-css run was active. ts-git-lfs and ts-ssh show no runs since 2026-08-25 and look dormant; the other five are actively writing here.

Fixing ts-css addresses roughly one sixth of the live contamination. The root-cause fix for ts-css is open at stacksjs/ts-css#302. Anything else scaffolded from this template deserves the same check.


Suggested actions

  1. Fix the other six. Merging stacksjs/ts-css#302 stops one writer; ts-xml, ts-printers, ts-fonts, ts-svg, ts-ssh, ts-git-lfs need the same edit. Making buddy-bot's repository block default to GITHUB_REPOSITORY — or removing it from the template scaffold entirely — prevents recurrence for every future repo seeded from here.
  2. Bump buddy-bot past 0.9.20 in the template. 0.10.5 lets GITHUB_REPOSITORY override the config, which would have made this self-healing.
  3. Remove the three stale labels: bunfig from Dependency Dashboard #3, @types/css-tree from Action Required: Fix Renovate Configuration #31, @types/css-tree from Extension lack in dts #102. Extension lack in dts #102 belongs to an outside contributor.
  4. Reconsider chore(deps): update github actions #1244 and chore(deps): update github actions #1249. Both were closed by ts-css and stayed closed. If those GitHub Actions updates are still wanted, they need reopening.
  5. Verify Dependency Dashboard #58's body the next time your own dashboard cron has just run.
  6. Consider a ruleset blocking ref creation under buddy-bot/* by anything other than your own workflow, as a stopgap while the sibling repos are fixed.

What could not be established

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions