fix(actions): batch of small correctness fixes across the seven actions

Small, independent correctness defects across the actions, from the 2026-07 maintenance audit. Seven of the original ten are still live at main; the three in the build-jupyter-cache failure-handling path shipped in v0.11.0 and are struck below.

setup-environment

Container-mode conda env update omits -n, so a delta env file can update the wrong environment — action.yml:77. Standard mode passes -n ${{ inputs.environment-name }} … --prune at :145; container mode lets conda resolve the target from the file's own name: key, so a delta file saying name: lecture-python updates /opt/conda/envs/lecture-python, which is not on the container PATH — the step prints "✅ Environment updated successfully" and the build fails later with ModuleNotFoundError. The path is unquoted too. Fix: conda env update -n "$ENV_NAME" -f "$ENV_UPDATE", pass both values via env: rather than shell interpolation, and warn if the file's name: differs.

LaTeX install dies with no output on an empty requirements file, and passes trailing comments to apt — action.yml:153. Composite shell: bash runs under -eo pipefail: on a fully-commented file the grep pipeline exits non-zero, the PACKAGES=$(…) assignment fails, and the step dies with no diagnostics. grep -v '^#' strips only whole-line comments, so texlive-xetex # for unicode math reaches apt verbatim; $PACKAGES is unquoted at :156. Fix: sed -e 's/#.*//' into a mapfile array, warn-and-skip if empty, install -y "${pkgs[@]}".

The environment summary reports the wrong Python environment in standard mode — action.yml:169 and :207. The step uses plain bash, correct for containers and commented as such, but setup-miniconda activates via the login profile — which is why :141 uses bash -l {0}. On a standard runner pip list reports the runner's default Python, right below "Conda: Restored from cache ✅". Fix: branch on container-mode, or invoke "$CONDA/envs/$ENV_NAME/bin/python" -m pip list explicitly, and drop the 2>/dev/null.

build-lectures

The build-failure banner names an artifact that doesn't exist and the wrong reports directory — action.yml:163, :166, :167. The banner hardcodes execution-reports-{builder} but the upload step honours failure-artifact-name at :179, which test-containers-lectures.yml:102, :112 and :122 always set — so every failing container-validation run prints a wrong download line. :167 also sends pdflatex users to _build/pdflatex/reports/; the real path is _build/latex/reports per :182 and the case at :123-128. Fix: compute both strings once in env:. PLAN item 15 flags the path half only.

build-jupyter-cache

builders is validated and parsed by substring, so unknown builders are silently dropped — action.yml:106 (validate), :120/:126/:132 (parse), :139-141 (log). Documented as comma-separated but never split: builders: 'html,pdf' passes validation and builds HTML only with no warning; 'nojupyter' enables the jupyter build. install-latex at :153 derives from the same substring result, so a false negative on pdflatex skips the LaTeX install too. The same three tests repeat three times across two steps. Fix: split on commas once, case each trimmed token against html|pdflatex|jupyter, error on anything else, and emit the three run-* outputs from the loop.

The harness covers only the all-invalid case — test-actions.yml:727 uses builders: 'nonsense'. Neither the partially-invalid (html,pdf) nor the false-positive (nojupyter) shape has coverage, so the fix should land with harness cases.

"Fail if builds failed" is implicitly gated on success(). Done in v0.11.0 — always() arrived with #122; #127 re-pointed it at a new always() "Resolve overall status" step at action.yml:290-311, so the guard now reads if: always() && steps.status.outputs.all-passed != 'true' at :648-649.

The failure-notification path aborts on ordinary input and on a missing label. Moot as of v0.11.0 (#122) — build-jupyter-cache/scripts/create-failure-issue.sh was deleted, not hardened; filing now goes through actions/github-script@v9 at action.yml:382-528, with labels and assignees parsed into JS arrays at :406-409 and passed to the REST API — no shell interpolation, and missing labels are created implicitly.

The auto-created failure issue gives an unrunnable repro command. Done in v0.11.0 (#122) — per-builder repro strings at action.yml:439-443, emitted only for the builders that failed. Cosmetic residual: --path-output is still omitted, so a local repro writes to lectures/_build, not ./_build.

publish-gh-pages

asset-url is bound to an output action-gh-release does not expose — action.yml:30-32. The producing step at :144-147 is softprops/action-gh-release v3.0.2, which exposes url, id, upload_url, assets — never asset-url — so it is always empty while README.md:42 advertises it. Fix: delete the output and the README row (PLAN item 7), or repoint at fromJSON(steps.upload-release.outputs.assets)[0].browser_download_url.

scripts/

Renamed lecture files never get a preview deep link — detect-changed-lectures.sh:29, :37-40. git diff --name-status reports renames as R<score> with two tab-separated paths; the case at :37-40 accepts only A*/M* and its *) continue arm drops everything else, so a renamed lecture is dropped; both preview actions consume this script (preview-netlify/action.yml:54, preview-cloudflare/action.yml:66), so neither PR comment gets the link. Fix: pass --no-renames on :29 so renames decompose into A/D pairs.

Checklist

• conda env update -n
• Robust LaTeX package parsing
• Container/standard split for the environment summary
• Failure-banner artifact name and reports path computed once
• Exact-match builder parsing in build-jupyter-cache, landed with harness cases for html,pdf and nojupyter
• if: always() && on the final fail step — done in v0.11.0 (#122/#127)
• Array-based assignees + label fallback in create-failure-issue.sh — moot in v0.11.0 (#122); script deleted
• Real per-builder repro command in the issue body — done in v0.11.0 (#122)
• Resolve asset-url
• --no-renames in detect-changed-lectures.sh

Overlaps PLAN items 7 (asset-url) and 15 (the pdflatex reports path); the --no-renames fix touches the same script family as the #105/#92 preview work and is worth batching there.

Start with the referenced action.yml sections in setup-environment, build-lectures, build-jupyter-cache, publish-gh-pages, and scripts/detect-changed-lectures.sh, then inspect the related workflow and README references. Add harness coverage in .github/workflows/test-actions.yml for html,pdf and nojupyter, and verify each unchecked checklist item while preserving the fixes already shipped in v0.11.0.