feat(actions): adds optional Actions tab toggle

Add enableActions boolean to ConfigSchema (default true). When disabled:
- Skip all workflow run API calls (full poll, targeted refresh, hot poll)
- Hide Actions tab and actions-based custom tabs from TabBar
- Suppress workflowRuns notifications and disable related settings
- Surface 'Actions monitoring disabled' in MCP relay and server tools
- Clear stale cached workflow data and hot run sets on disable
- Reset notification and events state on re-enable

Author: wgordon17

mcp/src/data-source.ts

@@ -26,6 +26,7 @@ export interface CachedConfig {
   trackedUsers: TrackedUser[];
   upstreamRepos: RepoRef[];
   monitoredRepos: RepoRef[];
+  enableActions: boolean;
 }
 
 let _cachedConfig: CachedConfig | null = null;
@@ -341,6 +342,7 @@ export class OctokitDataSource implements DataSource {
   }
 
   async getFailingActions(repo?: string): Promise<WorkflowRun[]> {
+    if (_cachedConfig?.enableActions === false) return [];
     const repos = resolveRepos(repo);
 
     const pairs = repos.flatMap((r) =>
@@ -451,8 +453,9 @@ export class OctokitDataSource implements DataSource {
     const login = await this.getLogin();
     const repos = _cachedConfig?.selectedRepos ?? [];
 
+    const actionsEnabled = _cachedConfig?.enableActions !== false;
     if (repos.length === 0) {
-      return { openPRCount: 0, openIssueCount: 0, failingRunCount: 0, needsReviewCount: 0, approvedUnmergedCount: 0 };
+      return { openPRCount: 0, openIssueCount: 0, failingRunCount: actionsEnabled ? 0 : null, needsReviewCount: 0, approvedUnmergedCount: 0, actionsMonitoringDisabled: !actionsEnabled };
     }
 
     const repoFilter = repos.map((r) => `repo:${r.owner}/${r.name}`).join("+");
@@ -463,7 +466,6 @@ export class OctokitDataSource implements DataSource {
     let needsReviewCount = 0;
     // REST search lacks reviewDecision data — approved count requires GraphQL (relay path only)
     const approvedUnmergedCount = 0;
-    let failingRunCount = 0;
 
     const [prResult, issueResult, reviewResult] = await Promise.allSettled([
       this.octokit.request("GET /search/issues", { q: `is:pr+is:open${involvesPart}+${repoFilter}`, per_page: 1 }),
@@ -487,21 +489,25 @@ export class OctokitDataSource implements DataSource {
       console.error("[mcp] getDashboardSummary review count error:", reviewResult.reason instanceof Error ? reviewResult.reason.message : String(reviewResult.reason));
     }
 
-    const failingRunResults = await Promise.allSettled(
-      repos.map((r) =>
-        this.octokit.request(
-          "GET /repos/{owner}/{repo}/actions/runs",
-          { owner: r.owner, repo: r.name, status: "failure", per_page: 5 }
+    let finalFailingRunCount: number | null = null;
+    if (actionsEnabled) {
+      const failingRunResults = await Promise.allSettled(
+        repos.map((r) =>
+          this.octokit.request(
+            "GET /repos/{owner}/{repo}/actions/runs",
+            { owner: r.owner, repo: r.name, status: "failure", per_page: 5 }
+          )
         )
-      )
-    );
-    for (const settled of failingRunResults) {
-      if (settled.status === "fulfilled") {
-        failingRunCount += (settled.value.data as { total_count: number }).total_count;
+      );
+      finalFailingRunCount = 0;
+      for (const settled of failingRunResults) {
+        if (settled.status === "fulfilled") {
+          finalFailingRunCount += (settled.value.data as { total_count: number }).total_count;
+        }
       }
     }
 
-    return { openPRCount, openIssueCount, failingRunCount, needsReviewCount, approvedUnmergedCount };
+    return { openPRCount, openIssueCount, failingRunCount: finalFailingRunCount, needsReviewCount, approvedUnmergedCount, actionsMonitoringDisabled: !actionsEnabled };
   }
 
   async getConfig(): Promise<CachedConfig | null> {

mcp/src/index.ts

@@ -34,6 +34,7 @@ const ConfigUpdatePayloadSchema = z.object({
   trackedUsers: TrackedUserSchema.array().max(MAX_TRACKED_USERS).default([]),
   upstreamRepos: RepoRefSchema.array().max(MAX_REPOS).default([]),
   monitoredRepos: RepoRefSchema.array().max(MAX_MONITORED_REPOS).default([]),
+  enableActions: z.boolean().default(true),
 });
 
 // ── Main entry point ──────────────────────────────────────────────────────────

mcp/src/tools.ts

@@ -4,7 +4,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import { METHODS } from "../../src/shared/protocol.js";
-import type { DataSource } from "./data-source.js";
+import type { DataSource, CachedConfig } from "./data-source.js";
 import type {
   Issue,
   PullRequest,
@@ -68,12 +68,15 @@ function formatRun(run: WorkflowRun, index: number): string {
 }
 
 function formatSummary(summary: DashboardSummary, scope: string): string {
+  const failingLine = summary.failingRunCount === null
+    ? "Failing CI Runs:  — (Actions monitoring disabled)"
+    : `Failing CI Runs:  ${summary.failingRunCount}`;
   const lines: string[] = [
     `GitHub Tracker Dashboard Summary (scope: ${scope})`,
     "─".repeat(50),
     `Open PRs:         ${summary.openPRCount}`,
     `Open Issues:      ${summary.openIssueCount}`,
-    `Failing CI Runs:  ${summary.failingRunCount}`,
+    failingLine,
     `Needs Review:     ${summary.needsReviewCount}`,
     `Approved/Unmerged: ${summary.approvedUnmergedCount}`,
   ];
@@ -186,6 +189,12 @@ export function registerTools(server: McpServer, dataSource: DataSource): void {
     async (args) => {
       const { repo } = args as { repo?: string };
       try {
+        // SEC-010: check config before calling getFailingActions to surface disabled state
+        const cachedConfig: CachedConfig | null = await dataSource.getConfig();
+        if (cachedConfig?.enableActions === false) {
+          const text = "GitHub Actions monitoring is disabled in the dashboard. Enable it in Settings to track workflow runs." + stalenessLine();
+          return { content: [{ type: "text" as const, text }] };
+        }
         const runs = await dataSource.getFailingActions(repo);
         if (runs.length === 0) {
           const text = `No failing or in-progress workflow runs found${repo ? ` in ${repo}` : ""}.` + stalenessLine();

src/app/components/dashboard/DashboardPage.tsx

@@ -532,6 +532,8 @@ export default function DashboardPage() {
     const tab = config.rememberLastTab ? viewState.lastActiveTab : config.defaultTab;
     if (tab === "tracked" && !config.enableTracking) return "issues";
     if (tab === "jiraAssigned" && !config.jira?.enabled) return "issues";
+    if (tab === "actions" && !config.enableActions) return "issues";
+    if (!config.enableActions && !isBuiltinTab(tab) && config.customTabs.find((t) => t.id === tab)?.baseType === "actions") return "issues";
     // Validate custom tab still exists; fall back to "issues" if stale
     if (!isBuiltinTab(tab) && !config.customTabs.some((t) => t.id === tab)) return "issues";
     return tab;
@@ -542,6 +544,10 @@ export default function DashboardPage() {
   function handleTabChange(tab: TabId) {
     // Reject invalid tab IDs to prevent persisting stale state
     if (!isBuiltinTab(tab) && !config.customTabs.some((t) => t.id === tab)) return;
+    if (!config.enableActions) {
+      if (tab === "actions") return;
+      if (!isBuiltinTab(tab) && config.customTabs.find((t) => t.id === tab)?.baseType === "actions") return;
+    }
     setActiveTab(tab);
     updateViewState({ lastActiveTab: tab });
   }
@@ -569,6 +575,15 @@ export default function DashboardPage() {
     }
   });
 
+  // Redirect away from Actions tab (or actions-based custom tab) when Actions is disabled
+  createEffect(() => {
+    if (!config.enableActions) {
+      const tab = activeTab();
+      const isActionsTab = tab === "actions" || (!isBuiltinTab(tab) && config.customTabs.find((t) => t.id === tab)?.baseType === "actions");
+      if (isActionsTab) handleTabChange("issues");
+    }
+  });
+
   // Clear stale Jira data when auth is cleared (e.g., 401 during token refresh)
   createEffect(() => {
     if (!isJiraAuthenticated()) {
@@ -792,6 +807,7 @@ export default function DashboardPage() {
     const currentTabId = activeTab();
     const result: Record<string, { issues: typeof dashboardData.issues; pullRequests: typeof dashboardData.pullRequests; workflowRuns: typeof dashboardData.workflowRuns }> = {};
     for (const tab of config.customTabs) {
+      if (!config.enableActions && tab.baseType === "actions") continue;
       if (!tab.exclusive && tab.id !== currentTabId) continue;
       const matchesScope = buildTabScopeMatcher(tab);
       result[tab.id] = {
@@ -866,6 +882,7 @@ export default function DashboardPage() {
     const users = allUsers();
     const customCounts: Record<string, number> = {};
     for (const tab of config.customTabs) {
+      if (!config.enableActions && tab.baseType === "actions") continue;
       // customTabData skips non-exclusive inactive tabs (perf optimization),
       // so compute scope on demand for tabs absent from the memo.
       let data = customTabData()[tab.id];
@@ -968,9 +985,9 @@ export default function DashboardPage() {
       pullRequests: visiblePullRequests().filter((p) =>
         isPrVisible(p, { ignoredIds: ignoredPRs, globalFilter: builtinFilter })
       ).length,
-      actions: visibleWorkflowRuns().filter((w) =>
+      ...(config.enableActions ? { actions: visibleWorkflowRuns().filter((w) =>
         isRunVisible(w, { ignoredIds: ignoredRuns, showPrRuns: viewState.showPrRuns, globalFilter: builtinFilter })
-      ).length,
+      ).length } : {}),
       ...(config.enableTracking ? { tracked: viewState.trackedItems.length } : {}),
       ...(config.jira?.enabled ? (() => {
         const f = viewState.tabFilters.jiraAssigned;
@@ -1053,6 +1070,14 @@ export default function DashboardPage() {
     { defer: true }
   ));
 
+  // When Actions is disabled, clear stale workflowRuns from the store so memos
+  // computing against empty workflowRuns don't process cached data (SEC-004).
+  createEffect(() => {
+    if (!config.enableActions) {
+      setDashboardData(produce((d) => { d.workflowRuns = []; }));
+    }
+  });
+
   // Push dashboard data into the MCP relay snapshot on each full refresh.
   // Tracks lastRefreshedAt (always updated alongside data arrays in pollFetch).
   // Hot poll updates are intentionally excluded — relay reflects full-refresh data only.
@@ -1064,6 +1089,7 @@ export default function DashboardPage() {
       issues: d.issues,
       pullRequests: d.pullRequests,
       workflowRuns: d.workflowRuns,
+      enableActions: config.enableActions,
       lastUpdatedAt: Date.now(),
     });
   });
@@ -1092,8 +1118,9 @@ export default function DashboardPage() {
               onTabChange={handleTabChange}
               counts={tabCounts()}
               enableTracking={config.enableTracking}
+              enableActions={config.enableActions}
               enableJira={!!config.jira?.enabled}
-              customTabs={config.customTabs.map((t) => ({ id: t.id, name: t.name }))}
+              customTabs={config.customTabs.filter((t) => config.enableActions || t.baseType !== "actions").map((t) => ({ id: t.id, name: t.name }))}
               onAddTab={() => setShowCustomTabModal(true)}
               onEditTab={(id) => { setEditingTabId(id); setShowCustomTabModal(true); }}
             />
@@ -1156,7 +1183,7 @@ export default function DashboardPage() {
                   siteUrl={config.jira?.siteUrl ?? ""}
                 />
               </Match>
-              <Match when={activeTab() === "actions"}>
+              <Match when={activeTab() === "actions" && config.enableActions}>
                 <ActionsTab
                   workflowRuns={visibleWorkflowRuns()}
                   loading={dashboardData.loading}
@@ -1237,6 +1264,7 @@ export default function DashboardPage() {
             editingTab={editingTab()}
             availableOrgs={[...new Set(config.selectedRepos.map((r) => r.owner))]}
             availableRepos={config.selectedRepos}
+            enableActions={config.enableActions}
           />
         </div>
 

src/app/components/layout/TabBar.tsx

@@ -11,6 +11,7 @@ interface TabBarProps {
   onTabChange: (tab: TabId) => void;
   counts?: TabCounts;
   enableTracking?: boolean;
+  enableActions?: boolean;
   enableJira?: boolean;
   customTabs?: Array<{ id: string; name: string }>;
   onAddTab?: () => void;
@@ -36,12 +37,14 @@ export default function TabBar(props: TabBarProps) {
                   <span class="badge badge-sm badge-neutral ml-1">{props.counts?.pullRequests}</span>
                 </Show>
               </Tabs.Trigger>
-              <Tabs.Trigger value="actions" class="tab compact:tab-sm data-[selected]:tab-active">
-                Actions
-                <Show when={props.counts?.actions !== undefined}>
-                  <span class="badge badge-sm badge-neutral ml-1">{props.counts?.actions}</span>
-                </Show>
-              </Tabs.Trigger>
+              <Show when={props.enableActions !== false}>
+                <Tabs.Trigger value="actions" class="tab compact:tab-sm data-[selected]:tab-active">
+                  Actions
+                  <Show when={props.counts?.actions !== undefined}>
+                    <span class="badge badge-sm badge-neutral ml-1">{props.counts?.actions}</span>
+                  </Show>
+                </Tabs.Trigger>
+              </Show>
               <Show when={props.enableTracking}>
                 <Tabs.Trigger value="tracked" class="tab compact:tab-sm data-[selected]:tab-active">
                   Tracked

src/app/components/settings/SettingsPage.tsx

@@ -177,6 +177,7 @@ export default function SettingsPage() {
         defaultTab: config.defaultTab,
         rememberLastTab: config.rememberLastTab,
         enableTracking: config.enableTracking,
+        enableActions: config.enableActions,
         customTabs: config.customTabs,
         // Non-secret jira config fields only — no tokens, sealed blobs, or email
         jira: {
@@ -345,10 +346,10 @@ export default function SettingsPage() {
   const tabOptions = createMemo(() => [
     { value: "issues", label: "Issues" },
     { value: "pullRequests", label: "Pull Requests" },
-    { value: "actions", label: "GitHub Actions" },
+    ...(config.enableActions ? [{ value: "actions", label: "GitHub Actions" }] : []),
     ...(config.enableTracking ? [{ value: "tracked", label: "Tracked Items" }] : []),
     ...(config.jira?.enabled ? [{ value: "jiraAssigned", label: "Jira" }] : []),
-    ...config.customTabs.map((t) => ({ value: t.id, label: t.name })),
+    ...config.customTabs.filter((t) => config.enableActions || t.baseType !== "actions").map((t) => ({ value: t.id, label: t.name })),
   ]);
 
 
@@ -607,6 +608,34 @@ export default function SettingsPage() {
 
         {/* Section 5: GitHub Actions */}
         <Section title="GitHub Actions">
+          <SettingRow
+            label="Enable GitHub Actions"
+            description="Track workflow runs and show the Actions tab. Disable to save API calls."
+          >
+            <input
+              type="checkbox"
+              role="switch"
+              aria-checked={config.enableActions}
+              aria-label="Enable GitHub Actions"
+              checked={config.enableActions}
+              onChange={(e) => {
+                const val = e.currentTarget.checked;
+                const isActionsCustomTab = (id: string) =>
+                  config.customTabs.some((t) => t.id === id && t.baseType === "actions");
+                const needsDefaultReset = !val && (config.defaultTab === "actions" || isActionsCustomTab(config.defaultTab));
+                const needsLastTabReset = !val && (viewState.lastActiveTab === "actions" || isActionsCustomTab(viewState.lastActiveTab));
+                saveWithFeedback({
+                  enableActions: val,
+                  ...(needsDefaultReset ? { defaultTab: "issues" as const } : {}),
+                  ...(!val ? { notifications: { ...config.notifications, workflowRuns: false } } : {}),
+                });
+                if (needsLastTabReset) {
+                  updateViewState({ lastActiveTab: "issues" });
+                }
+              }}
+              class="toggle toggle-primary"
+            />
+          </SettingRow>
           <SettingRow
             label="Max workflows per repo"
             description="Number of active workflows to track per repository (1–20)"
@@ -616,13 +645,14 @@ export default function SettingsPage() {
               min={1}
               max={20}
               value={config.maxWorkflowsPerRepo}
+              disabled={!config.enableActions}
               onInput={(e) => {
                 const val = parseInt(e.currentTarget.value, 10);
                 if (!isNaN(val) && val >= 1 && val <= 20) {
                   saveWithFeedback({ maxWorkflowsPerRepo: val });
                 }
               }}
-              class="input input-sm w-20"
+              class={`input input-sm w-20${!config.enableActions ? " opacity-50" : ""}`}
             />
           </SettingRow>
           <SettingRow
@@ -634,13 +664,14 @@ export default function SettingsPage() {
               min={1}
               max={10}
               value={config.maxRunsPerWorkflow}
+              disabled={!config.enableActions}
               onInput={(e) => {
                 const val = parseInt(e.currentTarget.value, 10);
                 if (!isNaN(val) && val >= 1 && val <= 10) {
                   saveWithFeedback({ maxRunsPerWorkflow: val });
                 }
               }}
-              class="input input-sm w-20"
+              class={`input input-sm w-20${!config.enableActions ? " opacity-50" : ""}`}
             />
           </SettingRow>
         </Section>
@@ -719,14 +750,17 @@ export default function SettingsPage() {
               class="toggle toggle-primary"
             />
           </SettingRow>
-          <SettingRow label="Workflow Runs" description="Notify when workflow runs complete">
+          <SettingRow
+            label="Workflow Runs"
+            description={!config.enableActions ? "Disabled — GitHub Actions is off" : "Notify when workflow runs complete"}
+          >
             <input
               type="checkbox"
               role="switch"
               aria-checked={config.notifications.workflowRuns}
               aria-label="Workflow runs notifications"
               checked={config.notifications.workflowRuns}
-              disabled={!config.notifications.enabled}
+              disabled={!config.notifications.enabled || !config.enableActions}
               onChange={(e) =>
                 saveWithFeedback({
                   notifications: { ...config.notifications, workflowRuns: e.currentTarget.checked },

src/app/components/shared/CustomTabModal.tsx

@@ -19,6 +19,7 @@ interface CustomTabModalProps {
   editingTab?: CustomTab;
   availableOrgs: string[];
   availableRepos: RepoRef[];
+  enableActions?: boolean;
 }
 
 // Filter groups per base type — scope is included for issues/PRs since custom tabs always show it
@@ -241,7 +242,9 @@ export default function CustomTabModal(props: CustomTabModalProps) {
               >
                 <option value="issues">Issues</option>
                 <option value="pullRequests">Pull Requests</option>
-                <option value="actions">Actions</option>
+                <Show when={props.enableActions !== false}>
+                  <option value="actions">Actions</option>
+                </Show>
               </select>
             </div>