Repository navigation
GH Audit Anomaly Alert: 1 suspicious operations detected #34764
Description
GH Audit Anomaly Report
Scan time: 2026-10-15T09:14:59Z
Anomalies found: 1
Log scanned: Lines 2449–3094 of gh-audit.log
Anomalous Entries
| Timestamp | Op | Repo | Number | Signals | Caller |
|---|---|---|---|---|---|
| 2026-10-14T14:21:02Z | issue_edit | [private repository] | #13090 | protected_label_removed:status:in-progress | main |
Next Steps
Review owner: the runner that filed this alert (the issue author). The evidence in gh-audit.log exists only on that runner, so this alert is labelled no-auto-dispatch and is never dispatched to workers.
- Review each entry in
~/.aidevops/logs/gh-audit.log, including each snapshot'scapture_status. - Verify the current GitHub state and cross-reference the events API:
gh api /repos/OWNER/REPO/issues/N/events --jq '[.[] | select(.event == "renamed")]' - A
state_capture_unavailable:*signal means the audit read failed; it is not evidence that content was wiped. - If a destructive edit is confirmed, recover content from GitHub history or a committed backup. The audit log stores lengths, not content.
- See
reference/gh-audit-log.mdfor the forensics workflow.
aidevops.sh v3.39.32 automated scan.
Activity
marcusquinn commentedon Oct 15, 2026
#13090 checked: benign worker blocked exit, no restoration needed
The single entry,
[private repository] #13090at2026-10-14T14:21:02Z, is the same issue that #34534 reported on 2026-10-13. This time it records a second worker exit with the same blocker. I checked it with maintainer access to that repository. Its name stays redacted here.Issue timeline (UTC, 2026-10-14)
status:blocked→status:availablestatus:available→status:queued→status:in-progressBLOCKEDcheckpoint: no replacement PR, because a required deployment configuration value is still not configuredstatus:in-progressremoved,status:blockedaddedCLAIM_RELEASED reason=blocked; unassigned; lease terminalChecks against
reference/gh-audit-log.mdstatus:in-progress→status:blocked, 2 s before the audit timestamp. This matches the alert's single signal. It is an evidenced worker exit, like the GH#34361 worked example.renamedevents. GraphQLlastEditedAtisnullanduserContentEditsis 0, so the issue body has never been edited. The issue is still open, with a nonempty title and body.capture_status: I could not check it. The entry is only in the producing runner'sgh-audit.log, and this runner's log has no entry for GH#13087: tighten story.md Quick Reference — merge redundant sections #13090. The GitHub history above settles the content question either way.Scanner behaviour: this is correct as designed. The caller is generic
mainwith no verified-transition provenance, so the doc says not to suppress progress-to-blocked removals by destination label alone. The audit record and scanner filters stay unchanged.Source task (not part of this alert): the source issue has now been blocked twice in about 34 hours by the same missing configuration value. Each time it was reset to available and redispatched. The source repository's owner should give that issue a durable hold until the value exists, so it stops costing worker launches. Closing this alert does not unblock or complete the source task.
Closing as investigated.
aidevops.sh v3.39.32 plugin for OpenCode v1.19.0 with claude-opus-5-5 spent 2m and 4,246 tokens on this with the user in an interactive session.