fix(ci): stop TODO scanner from matching its own workflow comments

[devantler]

🤖 Generated by the Daily AI Assistant

Problem

The TODO-scanning workflow (.github/workflows/todos.yaml) opens a tracking issue for every TODO comment it finds via alstr/todo-to-issue-action. That action matches the literal token TODO in any comment.

When this repo moved its workflow permissions to the job level, it added two inline documentation comments that themselves contain the word TODO:

      contents: read # checkout to scan for TODO comments
      issues: write # open/maintain TODO tracking issues

So on every push to main the scanner matched its own workflow and opened two junk tracking issues — #1 "tracking issues" (from ...maintain **TODO** tracking issues) and #2 "comments" (from ...scan for **TODO** comments). The upstream platform repo avoids this by declaring permissions at the workflow level with no inline comments and therefore has no such issues.

Because this is a template, every repository generated from it inherits the same two junk issues.

Fix

Reword the two job-level permission comments so they no longer contain the scanner's TODO identifier, while keeping the (good, least-privilege) job-level permission scoping:

      contents: read # checkout so the scanner can read the source files
      issues: write # open/maintain the tracking issues the scanner manages

Effect

• No behaviour change to the workflow itself (same triggers, permissions, called reusable workflow, secret).
• After this merges, the next scan run no longer matches these comments; the action then closes the now-resolved tracking issues #1 and comments #2 automatically.
• Genuine # TODO: comments in real source files are unaffected and still tracked.

Notes

• Drafted per the autonomous-engineer draft-PR discipline; promote to mark ready.
• Not addressed here: issues Remove the auth-proxy component when Cilium supports native forward auth (cilium/cilium#23797) #8–Remove auth-proxy when Cilium supports native forward auth (https://github.com/cilium/cilium/issues/23797) #12 are five copies of the same real # TODO: Remove auth-proxy… comment that appears in five separate config files — that is the action creating one issue per occurrence, a separate concern from this self-match bug.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

Pull request overview

Adjusts inline comments in the TODO-scanning GitHub Actions workflow so the alstr/todo-to-issue-action scanner no longer matches its own workflow permission comments and opens junk tracking issues in template-derived repos.

Changes:

• Reworded the contents: read permission comment to avoid the literal TODO token.
• Reworded the issues: write permission comment to avoid the literal TODO token while keeping intent/clarity.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.