From db466ba0b28c023b01434e41879ec9727eda5693 Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 1 Jul 2026 22:40:38 +0100
Subject: [PATCH] fix(panicbot): rename colon-named findings file + fail-loud
 filename guard
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Panicbot Sweep failed 3 consecutive weekly runs (06-14/06-21/06-28):
actions/upload-artifact rejects ':' in paths, and one legacy file
(shared-context/findings/indieweb2-bastion/2026-02-14T00:00:00Z.json —
the only colon path in the tree) failed the whole sweep's artifact upload.

The writer (scripts/submit-finding.sh) already emits colon-free names
(%Y%m%d-%H%M%S), so the file is residue from an older path, not a live
writer bug — renamed to 2026-02-14T00-00-00Z.json. Added a fail-loud
pre-upload guard that names any future offender instead of letting the
upload step fail cryptically (fail loudly; the guard points at the writer).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/panicbot-sweep.yml              | 15 +++++++++++++++
 ...4T00:00:00Z.json => 2026-02-14T00-00-00Z.json} |  0
 2 files changed, 15 insertions(+)
 rename shared-context/findings/indieweb2-bastion/{2026-02-14T00:00:00Z.json => 2026-02-14T00-00-00Z.json} (100%)

diff --git a/.github/workflows/panicbot-sweep.yml b/.github/workflows/panicbot-sweep.yml
index 236897c0..29fc3b61 100644
--- a/.github/workflows/panicbot-sweep.yml
+++ b/.github/workflows/panicbot-sweep.yml
@@ -107,6 +107,21 @@ jobs:
           echo "- **Mode**: ${{ inputs.mode || 'advisor' }}" >> "$GITHUB_STEP_SUMMARY"
           echo "- **Scope**: ${{ inputs.scope || 'all' }}" >> "$GITHUB_STEP_SUMMARY"
 
+      # upload-artifact rejects ':' in paths; a single legacy colon-named file
+      # failed the whole sweep for 3 consecutive weeks. The writer
+      # (scripts/submit-finding.sh) already emits colon-free names — this guard
+      # fails LOUDLY (naming the offender) if any regressed writer reintroduces
+      # one, instead of the upload step failing cryptically.
+      - name: Guard — no artifact-illegal filenames
+        if: always()
+        run: |
+          BAD=$(find shared-context/findings -name '*:*' -print)
+          if [ -n "$BAD" ]; then
+            echo "::error::Colon-named findings file(s) break artifact upload — fix the writer, then rename:"
+            echo "$BAD"
+            exit 1
+          fi
+
       - name: Upload findings artifact
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
diff --git a/shared-context/findings/indieweb2-bastion/2026-02-14T00:00:00Z.json b/shared-context/findings/indieweb2-bastion/2026-02-14T00-00-00Z.json
similarity index 100%
rename from shared-context/findings/indieweb2-bastion/2026-02-14T00:00:00Z.json
rename to shared-context/findings/indieweb2-bastion/2026-02-14T00-00-00Z.json