feat: Add weekly-report.sh scoped to core repos

[rubambiza]

Summary

Adds scripts/weekly-report.sh, a thin wrapper that scopes the weekly org
report to the curated core-repo allowlist instead of discovering every repo
in the org.

The wrapper resolves the org identity and the core-repo list through the
shared library (load_org_profile + get_core_repos), then invokes the
Python report generator with --repos set to exactly those repos. When the
generator is called without --repos (the previous default), org-wide
discovery is unchanged, so this is additive.

Changes

• scripts/weekly-report.sh — wrapper: resolves org + core allowlist, builds
  report.py --org <org> --repos <core repos> [--since/--until/--output/--json-output],
  fails loud when the allowlist is empty or the generator is missing.
  Supports --profile and --org overrides.
• tests/test-weekly-report.sh — hermetic test (fixture allowlist via
  CORE_REPOS_FILE, stub generator via REPORT_PY): asserts arg-building,
  --since/--until pass-through, and fail-loud on a missing generator. No
  network or real config touched.
• .github/workflows/tests.yml — wires the new test into the suite runner.

The companion --repos support in the generator lives in
rossoctl/agent-skills (separate PR).

Fixes #57

Assisted-By: Claude Code

[clawgenti]

Adds scripts/weekly-report.sh, a thin wrapper that resolves the org identity and core-repo allowlist via the shared library, then invokes report.py --repos scoped to exactly those repos — plus a hermetic test covering arg-building, date-range pass-through, and fail-loud on a missing generator.

All checks pass. Ready for human review.

---

Reviewed by clawgenti using the github-pr-review skill

[esnible]

Clean, well-scoped wrapper. The hermetic test is the right shape — fixture allowlist via CORE_REPOS_FILE, stub generator via REPORT_PY, no network or real config — and it covers arg-building, window pass-through, and fail-loud on a missing generator. Wiring it into the suite runner in the same PR is good practice.

Two non-blocking notes inline. The first is a real path bug worth fixing before this gets used without an explicit REPORT_PY; approving on the understanding that automation callers set it explicitly.

Things I checked that are not problems, so they don't get re-raised:

• PROFILE_FLAG/ORG_FLAG with set -u — safe. load_org_profile dereferences both with :- defaults (org.sh:110,127), so leaving them unset is fine. Shellcheck reports SC2034 for both, but CI only shellchecks the five library modules (tests.yml:32), not scripts/*.sh, and the existing pr-review-impact.sh on main triggers three of the same warning. Established convention here.
• Unquoted $repos — intentional word-splitting, correctly commented with an SC2086 disable.
• Interaction with the companion --repos bug — agent-skills#32 strips the owner from OWNER/REPO values, but get_core_repos emits $ORG/$repo, so the owner always equals --org and that bug cannot affect this caller.

Areas reviewed: Shell, CI/GitHub Actions, Tests
Agent/IDE config (.claude/.vscode): none
Commits: 2, all signed-off: yes
CI status: passing (DCO, PR title, tests on ubuntu-latest + macos-latest, project automation)

[esnible]

suggestion: the default path names a skill directory that does not exist, so the documented default can never resolve.

The directory in agent-skills is github-weekly-report, not github-report-generator:

skills/
  automation-health-dashboard
  dep-bump-fixer
  dep-bump-scanner
  github-pr-review
  github-weekly-report   <-- here
  link-health-fixer
  link-health-scanner

skills/github-report-generator returns 404, and an org-wide code search for github-report-generator finds it nowhere outside this PR. The companion PR (agent-skills#32) edits skills/github-weekly-report/scripts/report.py.

So anyone invoking the wrapper without presetting REPORT_PY gets:

Error: report generator not found at: $HOME/workspaces/shared/skills/github-report-generator/scripts/report.py

The fail-loud handling right below is good — it turns this into a clear error rather than something silent — but the default should point at the real directory:

REPORT_PY="${REPORT_PY:-$HOME/workspaces/shared/skills/github-weekly-report/scripts/report.py}"

Worth double-checking the $HOME/workspaces/shared/skills/... prefix against how the deployment actually lays out skills, since I could only verify the trailing directory name from the repo.

[esnible]

suggestion: all three invocations set REPORT_PY explicitly (here, line 39, and line 46), so the built-in default is never exercised — which is why the wrong path in the other comment ships with CI fully green.

That is the correct call for the two happy-path assertions: they must be hermetic, and pointing at a real deployed generator would break that.

If you want a cheap regression guard for the default without giving up hermeticity, assert on its shape rather than its resolvability — e.g. run the wrapper with REPORT_PY unset and HOME pointed at a temp dir, then check that the error message names the expected skill directory:

out=$(ORG=rossoctl CORE_REPOS_FILE="$TEST_TMPDIR/repos.txt" \
      HOME="$TEST_TMPDIR/fakehome" bash "$WRAPPER" 2>&1 || true)
case "$out" in
  *github-weekly-report/scripts/report.py*) ;;
  *) echo "FAIL default REPORT_PY path: $out"; fail=1 ;;
esac

That pins the default against future renames while still touching no network and no real config. Entirely optional.

[rubambiza]

Thanks for the review and suggestions @esnible. I will address these with fresh eyes soon.