Another repo's buddy-bot (stacksjs/ts-css) is misconfigured to target this repo and has been writing to it since May

Summary

stacksjs/ts-css has a stale .config/buddy-bot.ts copied from this template:

repository: { owner: 'stacksjs', name: 'ts-starter' }

The value was never edited — .config/buddy-bot.ts has exactly one commit in its history (ee6a5e03, 2026-04-28, "chore: initial commit").

The result is a split-brain bot. Every GitHub REST/GraphQL call ts-css's buddy-bot makes goes to stacksjs/ts-starter (this repo), while every git operation runs against the local ts-css checkout. buddy-bot is pinned at 0.9.20 (via better-dx@0.2.15), which early-returns when the config supplies both owner and name, so GITHUB_REPOSITORY did not override it. (0.10.5 fixed that; ts-css does not run it.)

This is not a reads-only incident. Writes to this repo are confirmed, from three independent evidence lines that agree: content fingerprints (ts-css's dependencies appearing in this repo's data), ts-css Actions run logs naming this repo's PR numbers, and run-window timing.

Both repos' bots act as chrisbbreuer and use overlapping crons, so actor and timing alone cannot attribute anything. Everything below rests on content fingerprints or on ts-css run logs.

Exposure window: ts-css's buddy-bot workflow has run 5,416 times since 2026-05-03 — 122 days, three crons (5,25,45 * * * *, 0 */2 * * *, 15 */2 * * *). Earliest observed write to this repo is 2026-05-27.

Confirmed writes to this repo

1. Dependency Dashboard #58 is being overwritten with ts-css's dependency list

ts-css's dashboard job rewrites your issue #58, replacing your dependency inventory with its own.

Of the 100 content edits GitHub still retains for #58, 19 carry ts-css's exact package.json — bunfig, @types/css-tree ^2.3.11, @types/csso ^5.0.4, css-select ^7.0.0, css-tree ^3.2.1, css-what ^8.0.0, csso ^5.0.5, mitata ^1.0.34. This repo's devDependencies are { better-dx: ^0.2.15 } and nothing else, so those bodies cannot have been generated from this tree.

Retained ts-css edits span 2026-08-29T11:01:17Z → 2026-09-02T11:12:28Z. All 19 also fall inside a ts-css Actions run window (e.g. the 11:12:28Z edit sits inside ts-css run 33623352278, 11:11:58–11:12:32).

The split brain is visible inside a single document: the same contaminated body lists your open PRs (#1250, #1246, #1245, #1237) under ## Open while listing ts-css's packages under "Detected dependencies". API side = ts-starter, filesystem side = ts-css.

#58 is clean right now (updated_at 2026-09-02T12:47:28Z, package.json section shows only better-dx ^0.2.15) because your own correctly-configured bot wrote last. Contamination recurs several times per day and your bot corrects it minutes later.

Note: 20 of the 100 retained edits carry a different foreign fingerprint (@types/xml2js, fast-xml-parser, sax) — stacksjs/ts-xml, which has the same stale config. See "Not just ts-css" below.

2. Thirteen of your buddy-bot PRs were commented on and closed by ts-css

Every week from 2026-05-27 to 2026-08-27, ts-css closed your buddy-bot/update-github-actions PR with a false explanation ("the dependency files it references are no longer present in the project" — they are present in your workflows).

Eleven are confirmed directly from ts-css's own run logs, which name your PR numbers:

Sample log excerpt from run 33105029940:

🔄 Found existing PR #1257: chore(deps): update github actions
🔒 Auto-closing PR #1257 due to config change
💬 Added comment to PR #1257
✅ Closed PR #1257

Comment 5443718851 on your PR #1257 is timestamped 2026-08-27T18:45:39Z — a sub-second match to the log line. (I re-verified this comment is present.)

Two more pairs — #1241 (2026-05-27T00:41:35Z) and #1242 (2026-06-03T03:10:32Z) — match the same weekly pattern and ts-css run windows, but their logs have aged past 90-day retention. Treat those two as probable, not proven.

No human discussion was disturbed. All 47 issue/PR comments repo-wide since 2026-04-28 are the same bot "Auto-closing obsolete PR" message on buddy-bot PRs.

3. Stray branch refs created here — recurring, most recently today

ts-css creates the ref buddy-bot/update-major-update-typescss-tree on this repo. The slug decodes to @types/css-tree, which is a ts-css devDependency and is declared by no other repo in the org (code search TOTAL=1).

14 CreateEvents survive in the events feed (2026-08-28T16:29:19Z → 2026-09-01T19:10:06Z), each pairing with a ts-css PR creation 2–4 seconds later (ts-css PRs #279–#297, same head ref, all titled "chore(deps): update dependency @types/css-tree to 3.2.0"). Every create sits inside a ts-css run window and outside every ts-starter run window.

It is still happening. From your own run 33645956187 today:

15:02:53Z  * [new branch] buddy-bot/update-major-update-typescss-tree -> origin/...
15:02:57Z  🔍 Found 2 orphaned buddy-bot branches (no associated open PRs)
15:02:57Z    - buddy-bot/update-major-update-typescss-tree (38 days old)
15:03:00Z  ✅ Deleted branch buddy-bot/update-major-update-typescss-tree via git

A point-in-time gh api repos/stacksjs/ts-starter/branches shows nothing because your own bot reaps the orphan every couple of hours.

4. Four issues were mislabeled; three are still wrong

buddy-bot labels a PR via POST /repos/{owner}/{repo}/issues/{number}/labels. With owner/name pointing here but the number computed from ts-css — and GitHub sharing one number space between issues and PRs — ts-css PR #N's labels landed on ts-starter issue #N. ts-css's own PRs #31/#58/#102 have empty label timelines, consistent with misdelivery.

#102 is the one that matters reputationally: an outside contributor's issue in this repo currently wears a label for a package this repo does not use.

Corrections to earlier claims

Several things that were suspected turned out to be wrong, in both directions. Stating them plainly:

• "No stray branch was ever created here" — FALSE. Verified above from your own checkout log at 15:02:53Z today.
• "ts-css pushed a stray branch with its content" — OVERSTATED. The ref was created pointing at this repo's own main tip, and there are zero PushEvents to it. ts-css PR #297's head sha returns HTTP 422 "No commit found for SHA" against this repo, and search/commits repo:stacksjs/ts-starter css-tree returns 0. The "(38 days old)" cleanup line back-dates the ref to ~2026-07-26, matching your own main tip 5fd2831d (2026-07-25). No ts-css file content ever entered this repo's git history. No PR was ever opened here for that branch.
• pushed_at = 2026-09-02T15:03:00Z is not a ts-css write. That is your own bot deleting the stray ref, logged at 15:03:00.404Z.
• Commit 7202f85 (2026-09-02T12:19:08Z) is yours, not ts-css's. Your run 33629193320 rebased your own PR #1250; the diff bumps your own better-dx ^0.2.15 → ^0.2.25.
• ts-css created zero issues here. Your newest non-PR issue is #1234 (2026-04-27T18:44:02Z), 27 hours before the ts-css repo existed. The duplicate dashboards #1231–#1234 are not ts-css's doing.
• PR #1250 is clean. Zero comments, never closed; all 27 of its force-push/commit events fall inside your own runs. PRs #1246, #1245, #1237 are pure renovate[bot] activity.
• The bunfig label's creation is not ts-css's. GraphQL shows createdAt 2025-08-17T06:01:40Z, predating ts-css. Its application to #3 still is.
• Contaminated-dashboard count: one pass reported 39 edits; a direct re-count of all 100 retained edits gives 19 bearing ts-css's fingerprint. 19 is the defensible number.

Not just ts-css

gh api -X GET search/code -f q="\"name: 'ts-starter'\" org:stacksjs path:.config"
→ 8 repos

ts-starter (correct, its own name) plus ts-css, ts-xml, ts-printers, ts-fonts, ts-svg, ts-ssh, ts-git-lfs — all seven hardcode owner: 'stacksjs', name: 'ts-starter'.

This explains behaviour ts-css alone doesn't: the 20 xml-flavoured dashboard edits, the weekly three-closes-and-two-reopens pattern on your buddy-bot PRs (ts-css reliably performed the second close), and label churn in minutes when no ts-css run was active. ts-git-lfs and ts-ssh show no runs since 2026-08-25 and look dormant; the other five are actively writing here.

Fixing ts-css addresses roughly one sixth of the live contamination. The root-cause fix for ts-css is open at stacksjs/ts-css#302. Anything else scaffolded from this template deserves the same check.

Suggested actions

1. Fix the other six. Merging stacksjs/ts-css#302 stops one writer; ts-xml, ts-printers, ts-fonts, ts-svg, ts-ssh, ts-git-lfs need the same edit. Making buddy-bot's repository block default to GITHUB_REPOSITORY — or removing it from the template scaffold entirely — prevents recurrence for every future repo seeded from here.
2. Bump buddy-bot past 0.9.20 in the template. 0.10.5 lets GITHUB_REPOSITORY override the config, which would have made this self-healing.
3. Remove the three stale labels: bunfig from #3, @types/css-tree from #31, @types/css-tree from #102. #102 belongs to an outside contributor.
4. Reconsider #1244 and #1249. Both were closed by ts-css and stayed closed. If those GitHub Actions updates are still wanted, they need reopening.
5. Verify #58's body the next time your own dashboard cron has just run.
6. Consider a ruleset blocking ref creation under buddy-bot/* by anything other than your own workflow, as a stopgap while the sibling repos are fixed.

What could not be established

• Counts are floors, not totals. GitHub retains ~100 content edits per issue (≈4.4 days here), ~300 repo events, and expires Actions logs after 90 days. The 19 dashboard rewrites, 14 ref creations and 13 PR closes are what survived retention across a 122-day window. The label events prove ts-css was writing here as far back as 2026-04-29 and the config never changed, so earlier activity is near-certain — but it cannot be enumerated and is not asserted here.
• #1241 and #1242 rest on run-window timing plus pattern, not on logs.
• Who performs the first close and the reopens in each weekly cycle is unidentified — almost certainly one or more of the six sibling repos, not verified.
• Label churn on PR #1250 (npm/better-dx labeled/unlabeled at 2026-08-29T14:54:14Z, 2026-08-30T14:38:23Z, 2026-08-30T18:59:53Z, 2026-09-01T14:27:56Z, 2026-09-02T14:01:30Z) falls inside ts-css and ts-fonts/ts-svg windows simultaneously. Genuinely ambiguous; not attributed.
• Label events on #9, and bun.sh/patch/system events on #31 and #58 (May–June 2026) match no ts-css PR. Not attributed to ts-css.
• 28 @types/css-tree label events on PRs #281–#301 dated 2026-04-14 to 2026-04-16 predate ts-css's existence while the label's createdAt is 2026-08-03. Unreconciled; not attributed.
• This audit was read-only. Nothing was changed, and no labels were removed.