fix(gh): bypass the stale run cache with a created filter

GitHub answered the confirming run query with a weeks-old cached result
even with page=1, so alerts for fixed workflows stayed. A created filter
changes the query each day and reads current runs.

internal/gh/fetch.go

@@ -14,14 +14,16 @@ import (
 )
 
 const (
-	maxFailingNames  = 5
-	runsPerWorkflow  = 5
-	maxWorkflows     = 100
-	eventPullRequest = "pull_request"
-	eventPullReqTgt  = "pull_request_target"
-	statusStateFail  = "failure"
-	statusStateError = "error"
-	statusStatePend  = "pending"
+	maxFailingNames = 5
+	runsPerWorkflow = 5
+	// freshRunsWindowDays bounds the created filter of the confirming run query.
+	freshRunsWindowDays = 30
+	maxWorkflows        = 100
+	eventPullRequest    = "pull_request"
+	eventPullReqTgt     = "pull_request_target"
+	statusStateFail     = "failure"
+	statusStateError    = "error"
+	statusStatePend     = "pending"
 )
 
 // backgroundEvents are triggers that run without a person pushing code.
@@ -374,9 +376,11 @@ func (c *Client) workflowRuns(ctx context.Context, full string, id int64, branch
 	path := fmt.Sprintf("/repos/%s/actions/workflows/%d/runs", full, id)
 	get := c.getJSON
 	if fresh {
-		// GitHub can keep answering one exact query from an old cached result, for weeks, whatever
-		// the connection. A different query string skips that entry and reads current runs.
+		// GitHub can keep answering a branch query from an old cached result, for weeks, whatever
+		// the connection, and page=1 alone does not skip it. A created filter changes the query
+		// every day and reads current runs.
 		q.Set("page", "1")
+		q.Set("created", ">="+c.now().UTC().AddDate(0, 0, -freshRunsWindowDays).Format(time.DateOnly))
 		get = c.getJSONFresh
 	}
 	if err := get(ctx, full, path, q, &out); err != nil {

internal/gh/gh_test.go

@@ -461,12 +461,12 @@ func TestAPIErrorMessageParsing(t *testing.T) {
 }
 
 // staleThenFresh models GitHub answering one exact query from an old cached result: the plain
-// query returns an old failing run every time, and the same query with page=1 returns current runs.
+// query returns an old failing run every time, and the same query with a created filter returns current runs.
 func staleThenFresh(f *fakeGitHub, path string) *atomic.Int64 {
 	var calls atomic.Int64
 	f.routes[path] = func(w http.ResponseWriter, r *http.Request) {
 		calls.Add(1)
-		if r.URL.Query().Get("page") == "" {
+		if r.URL.Query().Get("created") == "" {
 			_, _ = w.Write([]byte(`{"workflow_runs":[
 			  {"id":1,"html_url":"old","event":"schedule","head_branch":"main","status":"completed","conclusion":"failure","created_at":"2026-09-11T03:02:00Z"}]}`))
 			return

pnpm-lock.yaml

@@ -25,7 +25,7 @@ importers:
         version: 3.3.3(@fortawesome/[email protected])([email protected]([email protected]))
       '@lucide/vue':
         specifier: ^1.49.0
-        version: 1.50.0([email protected]([email protected]))
+        version: 1.51.0([email protected]([email protected]))
       '@vueuse/core':
         specifier: ^15.0.0
         version: 15.0.0([email protected]([email protected]))
@@ -248,8 +248,8 @@ packages:
   '@keyv/[email protected]':
     resolution: {integrity: sha512-dXn3FZhPv0US+7dtJsIi2R+c7qWYiReoEh5zUntWCf4oSpMNib8FDhSoed6m3QyZdx5hK7iLFkYk3rNxwt8vTA==}
 
-  '@lucide/[email protected]0.0':
-    resolution: {integrity: sha512-/cYAYqHIMUcVbhGYPk+GqgPqlqTKCFfyGrpXvH/6z5v7sWRoWBHViYwO3cNgmupZCBY+4WB016wN6CkXNcy0Yw==}
+  '@lucide/[email protected]1.0':
+    resolution: {integrity: sha512-zMkTAMP8OsPESz/GDedsZfr3VUF2IiHlj25mBZG6Pc8A8J8BdygkE8k1HhRFXEUNzytp5DqxiBQNm3RG/U2bVg==}
     peerDependencies:
       vue: '>=3.0.1'
 
@@ -1638,7 +1638,7 @@ snapshots:
 
   '@keyv/[email protected]': {}
 
-  '@lucide/[email protected]0.0([email protected]([email protected]))':
+  '@lucide/[email protected]1.0([email protected]([email protected]))':
     dependencies:
       vue: 3.5.43([email protected])
 

renovate.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "packageRules": [
+    {
+      "description": "pnpm 11 cannot switch to the pnpm 12 native binary: npx runs it with node",
+      "matchDepTypes": ["packageManager"],
+      "matchPackageNames": ["pnpm"],
+      "allowedVersions": "<12"
+    }
+  ]
+}