Address CodeRabbit review feedback

- Set persist-credentials: false on checkout step
- Pin pandas to 2.2.3 instead of unpinned latest
- Use GITHUB_TOKEN for push credentials in commit step
- Fix validation: flag metrics missing from all results, not just NaN

.github/workflows/update-csv.yml

@@ -14,20 +14,25 @@ jobs:
       contents: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
 
       - name: Install dependencies
-        run: pip install pandas
+        run: pip install pandas==2.2.3
 
       - name: Generate CSV
         run: python src/results_to_csv.py
 
       - name: Commit if changed
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
+          git remote set-url origin https://x-access-token:${GITHUB_TOKEN}@github.com/${{ github.repository }}
           git add results.csv
-          git diff --staged --quiet || git commit -m "Auto-update results.csv" && git push
+          git diff --staged --quiet || (git commit -m "Auto-update results.csv" && git push)

src/results_to_csv.py

@@ -57,7 +57,7 @@ def validate(df: pd.DataFrame) -> bool:
     issues = []
     for _, row in df.iterrows():
         label = f"{row.get('benchmark.name', '?')} / {row.get('model.name', '?')} / {row.get('harness.name', '?')}"
-        missing = [col for col in REQUIRED_METRICS if col in df.columns and pd.isna(row.get(col))]
+        missing = [col for col in REQUIRED_METRICS if col not in df.columns or pd.isna(row.get(col))]
         if missing:
             fields = ", ".join(c.replace("metrics.", "") for c in missing)
             issues.append(f"  {label}: missing {fields}")