[afeezorobsco-cyber]

Today the conflict notifier failed three times on transient GitHub errors (web: 503 on GET /pulls/161, then 500 on POST /issues/189/labels; escrow: 500 on POST /issues/160/comments). Each failure aborted the whole run, so PRs after the failing one weren't labelled or notified until a manual re-run.

• pr-conflict-notifier.yml and pr-malware-scan.yml: retries: 3 on actions/github-script. The built-in Octokit retry plugin then retries 5xx responses; 4xx are never retried.
• pr-conflict-notifier.cjs: each PR is processed in its own try/catch. A PR whose calls still fail is logged with core.warning and listed under "API error, retried next run" in the run summary, and the rest carry on. The mergeability prefetch uses Promise.allSettled.
• ROADMAP changelog line.

The malware scan runs as pull_request_target, so its retry setting takes effect once this is on main.

Tested with a fake client that returns a 500 on one PR's addLabels: the other PRs were still notified and unlabelled, and the failing PR was reported under the new summary line.

🤖 Generated with Claude Code

[github-actions]

Malware scan: passed, with notes for the reviewer

Nothing malicious was detected in cf2dc19. These changes touch sensitive areas and should get a careful look before CI is approved:

Where	Rule	Why
.github/workflows/pr-conflict-notifier.yml:44	workflow-change	Changes a CI workflow; a maintainer must review before approving runs.
.github/workflows/pr-malware-scan.yml:59	workflow-change	Changes a CI workflow; a maintainer must review before approving runs.

[github-actions]

@afeezorobsco-cyber This PR now has merge conflicts with main, most likely because #197 (fix(backups): make the backup restore drill actually run; unique sessions test port) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-core.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared files like ROADMAP.md and ARCHITECTURE*.md. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}