scripts/load-config.py supports a top-level blender: wrapper in a target's .blender/blender.yml (see the blender override branch), but every yq read in .github/actions/setup-target/action.yml uses flat paths only — node_version, python_version, install_command, repo_name, dismiss_unaffected, dismiss_min_confidence. So a wrapped repo config is silently ignored in the remediation job and every value falls back to its default.
Systemic (not specific to any one field) and it fails safe for dismissal (a wrapped repo gets the stricter high default), but it's a real footgun. Fix: make all setup-target reads check the wrapped path before the flat path and default, e.g. yq '.investigate.X // .blender.investigate.X // "default"'.
Surfaced by Copilot review of #145.
scripts/load-config.pysupports a top-levelblender:wrapper in a target's.blender/blender.yml(see theblenderoverride branch), but everyyqread in.github/actions/setup-target/action.ymluses flat paths only —node_version,python_version,install_command,repo_name,dismiss_unaffected,dismiss_min_confidence. So a wrapped repo config is silently ignored in the remediation job and every value falls back to its default.Systemic (not specific to any one field) and it fails safe for dismissal (a wrapped repo gets the stricter
highdefault), but it's a real footgun. Fix: make all setup-target reads check the wrapped path before the flat path and default, e.g.yq '.investigate.X // .blender.investigate.X // "default"'.Surfaced by Copilot review of #145.