AITS-422: Cache dev-docs scrape retries

[doconnell2020]

Summary

• Cache the dev-docs scrape snapshot only for reruns of the same monthly workflow run.
• Skip scraping when the restored snapshot includes _manifest.json, then compile dev-docs directly from that snapshot.
• Keep local scrape artifacts out of version control and report the snapshot page count in the generated refresh PR.

Refs AITS-422

Validation

• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/monthly-llmwiki-refresh.yml"); puts "yaml ok"'
• git diff --check
• Verified the exact cache key includes github.run_id, no restore-keys are present, and .llmwiki-cache/ is ignored.

The selected LLMWiki main ref was previously confirmed to support wiki scrape --output-dir and wiki compile --sources-root.

[semgrep-code-team-telnyx]

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

🧼 Fixed in commit 04c4223 🧼

[semgrep-code-team-telnyx]

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

🧁 Fixed in commit 04c4223 🧁

[semgrep-code-team-telnyx]

Semgrep identified an issue in your code:
This GitHub Actions workflow file uses pull_request_target and checks out code from the incoming pull request. When using pull_request_target, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., npm build and make) or dependency installation scripts (e.g., python setup.py install). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by pull-request-target-code-checkout.

_{You can view more details about this finding in the Semgrep AppSec Platform.}