fix: repair main CI and automate action publication

[kantorcodes]

Purpose

• fix the failing main CI run after the marketplace guide purge
• replace the brittle GitHub license-detection badge with a stable Apache-2.0 badge
• add an actual automated publication path for the GitHub Action from the source repo

What Changed

• updated tests/test_action_bundle.py so it no longer depends on the deleted docs/github-action-marketplace.md
• replaced the README license badge with a static Apache-2.0 shield linked to LICENSE
• added .github/workflows/publish-action-repo.yml to publish the root-ready action bundle into a dedicated public action repository
• the new workflow can bootstrap hashgraph-online/hol-codex-plugin-scanner-action, sync action.yml / README.md / LICENSE / SECURITY.md, push vX.Y.Z and v1, and create or update the action-repo release
• documented the required source-repo configuration in README.md and action/README.md

Required Repo Configuration

• secret: ACTION_REPO_TOKEN
• optional variable: ACTION_REPOSITORY
  • defaults to hashgraph-online/hol-codex-plugin-scanner-action

Verification

• yq '.' .github/workflows/publish-action-repo.yml >/dev/null
• ./.venv/bin/python -c 'import sys; sys.path.insert(0,"src"); import pytest; raise SystemExit(pytest.main(["tests/test_action_bundle.py","-q"]))'
• ./.venv/bin/ruff check src tests
• ./.venv/bin/python -c 'import sys; sys.path.insert(0,"src"); import pytest; raise SystemExit(pytest.main(["-q"]))'
• ./.venv/bin/python -m build

Notes

• GitHub Marketplace still requires the one-time listing publication step in the dedicated action repository UI. After that, this repository can keep the action repository current automatically.

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
.github/workflows/publish-action-repo.yml	38	CREATE_REPOSITORY expression always evaluates to 'true' — the create_repository workflow_dispatch input is non-functional

Resolved from Previous Review

File	Issue	Status
README.md	Dangling reference to deleted docs/github-action-marketplace.md	Fixed — now links to action/README.md

Files Reviewed (4 files)

• .github/workflows/publish-action-repo.yml - 1 issue (the CREATE_REPOSITORY expression bug)
• README.md - Badge fix correct; new Automated Action Publication section is clear; previous dangling link resolved
• action/README.md - Config documentation added correctly
• tests/test_action_bundle.py - New workflow test covers key content assertions; removed stale setup-python pin assertion

Fix these issues in Kilo Cloud

---

_{Reviewed by mimo-v2-pro-20260318 · 251,390 tokens}

[gemini-code-assist]

Code Review

This pull request updates the license badge in the README to a static Apache 2.0 version and refactors the action bundle documentation tests to consolidate checks within the action's README. It also removes a specific version hash check for the setup-python action and adds a new test to verify the license badge update. I have no feedback to provide.

[kilo-code-bot]

WARNING: CREATE_REPOSITORY expression always evaluates to 'true' — the create_repository input has no effect

In GitHub Actions expressions, false && <expr> || 'true' always returns 'true' because the && returns false (falsy), then || falls through to the string 'true'. When triggered via workflow_dispatch with create_repository: false:

• github.event_name == 'workflow_dispatch' → true
• true && inputs.create_repository → false (boolean input is falsy)
• false || 'true' → 'true' (the fallback always wins)

This means the "Create the dedicated action repository if it does not exist" toggle is non-functional — the workflow will always attempt to create the repo.

To fix, coerce the boolean to a string before the || fallback:

Suggested change

	CREATE_REPOSITORY: ${{ github.event_name == 'workflow_dispatch' && inputs.create_repository || 'true' }}
	CREATE_REPOSITORY: ${{ github.event_name == 'workflow_dispatch' && inputs.create_repository || false || 'true' }}

A cleaner alternative: use fromJSON() or a ternary-style pattern like ${{ inputs.create_repository == false && 'false' || 'true' }}.