Path: none | instrument (gate farm scope) | 北极星「仪器为车队服务」
Six gates root their population at .github/workflows and none reads .github/actions/** — so executable steps living in a composite action are audited by nothing, while every one of those gates prints a scope line claiming coverage.
Filed by the domain:devx execution PM seat (session session_017ef78bLdybu3AffehKkhfk) out of the stop-and-report on #18471 / draft PR #19225. ⛔ Not graded, no domain:* — that is triage's. Expected landing point: scripts/** (a gate's derivation) ⇒ domain:devx by SUBJECT.
The blind spot, measured on origin/main 805811e0d
| gate |
names .github/workflows |
names .github/actions |
scripts/check-node-version.mjs |
1 |
0 |
scripts/check-workflow-step-name-quoting.mjs |
9 |
0 |
scripts/check-self-test-wired.mjs |
1 |
0 |
scripts/check-self-test-workflow-commands.mjs |
2 |
0 |
scripts/pm/dispatch-gates.mjs |
74 |
0 |
scripts/check-step-collectors.mjs |
0 |
0 |
⚠️ The probe is a literal grep for the two path spellings. Five of the six name the workflows root literally; the sixth (check-step-collectors.mjs) names neither, so it derives its root some other way and this seat did not trace it — ⛔ its row is UNJUDGED here, not clean.
Positive control that the blind spot is not vacuous: .github/actions/setup-pnpm/action.yml exists today and carries 6 run: steps. ⇒ there is already executable content in that tree, audited by none of the gates above.
⭐ Why it is worth a card now rather than a comment
The class is already documented per-gate — .github/actions/setup-pnpm/action.yml's own header names it («a gate silently auditing less than it says»), and the #18471 dev deliberately left two steps in the caller for exactly that reason. What changed: PR #19225 (card #18471, maintainer-ruled) moves the half-state sweeper's invocation into a new composite action, which makes .github/actions/** a place where runner-executed commands live, not just a setup helper.
⇒ The gap stops being theoretical the moment that PR lands, and it grows with every composite action the repo adds after it.
⛔ The repair that must NOT be taken
scripts/pm/dispatch-gates.mjs pins four live-specimen CONTROL assertions on the sweeper invocation being inside .github/workflows/half-state-patrol.yml — read on this tree:
[...sweepEntry.workflows].join('|') === 'half-state-patrol.yml' && isScheduled('half-state-patrol.yml') && reachesPRTime(...) && Boolean(sweepEntry.notRunnable) && !sweepEntry.ciOnly
⛔ Do not "fix" #18471 by re-pointing those four assertions at a different value-bearing family. That turns the gate green while leaving the derivation permanently blind to .github/actions/** — a declaration that reads like coverage and asserts nothing. It is the cheapest edit and the wrong one.
What the repair is
Teach the derivation to follow uses: ./.github/actions/NAME out of a workflow and read that action's runs.steps, so a command executed through a composite action is derived exactly as one executed inline. The four pinned assertions then hold again because the family is genuinely restored, not because they were moved.
⚠️ Cost, stated up front: that file's --self-test is a long battery — 1866 cases, measured today at 535.9 / 544.1 / 567.4 s in this container (and 593.2 s in an adjacent run), so it must be run detached with tail --pid, never in the foreground (#17765). New cases are owed for the new derivation path.
⚠️ Serial constraint, live at filing time: scripts/pm/dispatch-gates.mjs is being edited by open PRs #19162 and #19024. ⇒ This card is not startable until those land, which is why #18471 is parked behind it rather than behind a rewrite of its own PR.
⛔ Considered and rejected by measurement, ⛔ not by taste
Refs: #18471 · PR #19225 · #17765 · .github/actions/setup-pnpm/action.yml
Generated by Claude Code
Path: none | instrument (gate farm scope) | 北极星「仪器为车队服务」
Six gates root their population at
.github/workflowsand none reads.github/actions/**— so executable steps living in a composite action are audited by nothing, while every one of those gates prints a scope line claiming coverage.Filed by the
domain:devxexecution PM seat (sessionsession_017ef78bLdybu3AffehKkhfk) out of the stop-and-report on #18471 / draft PR #19225. ⛔ Not graded, nodomain:*— that is triage's. Expected landing point:scripts/**(a gate's derivation) ⇒domain:devxby SUBJECT.The blind spot, measured on
origin/main805811e0d.github/workflows.github/actionsscripts/check-node-version.mjsscripts/check-workflow-step-name-quoting.mjsscripts/check-self-test-wired.mjsscripts/check-self-test-workflow-commands.mjsscripts/pm/dispatch-gates.mjsscripts/check-step-collectors.mjscheck-step-collectors.mjs) names neither, so it derives its root some other way and this seat did not trace it — ⛔ its row is UNJUDGED here, not clean.Positive control that the blind spot is not vacuous:
.github/actions/setup-pnpm/action.ymlexists today and carries 6run:steps. ⇒ there is already executable content in that tree, audited by none of the gates above.⭐ Why it is worth a card now rather than a comment
The class is already documented per-gate —
.github/actions/setup-pnpm/action.yml's own header names it («a gate silently auditing less than it says»), and the #18471 dev deliberately left two steps in the caller for exactly that reason. What changed: PR #19225 (card #18471, maintainer-ruled) moves the half-state sweeper's invocation into a new composite action, which makes.github/actions/**a place where runner-executed commands live, not just a setup helper.⇒ The gap stops being theoretical the moment that PR lands, and it grows with every composite action the repo adds after it.
⛔ The repair that must NOT be taken
scripts/pm/dispatch-gates.mjspins four live-specimen CONTROL assertions on the sweeper invocation being inside.github/workflows/half-state-patrol.yml— read on this tree:⛔ Do not "fix" #18471 by re-pointing those four assertions at a different value-bearing family. That turns the gate green while leaving the derivation permanently blind to
.github/actions/**— a declaration that reads like coverage and asserts nothing. It is the cheapest edit and the wrong one.What the repair is
Teach the derivation to follow
uses: ./.github/actions/NAMEout of a workflow and read that action'sruns.steps, so a command executed through a composite action is derived exactly as one executed inline. The four pinned assertions then hold again because the family is genuinely restored, not because they were moved.--self-testis a long battery — 1866 cases, measured today at 535.9 / 544.1 / 567.4 s in this container (and 593.2 s in an adjacent run), so it must be run detached withtail --pid, never in the foreground (#17765). New cases are owed for the new derivation path.scripts/pm/dispatch-gates.mjsis being edited by open PRs #19162 and #19024. ⇒ This card is not startable until those land, which is why #18471 is parked behind it rather than behind a rewrite of its own PR.⛔ Considered and rejected by measurement, ⛔ not by taste
half-state-patrol.ymlspecifically, and aworkflow_call-only file declares no PR-time event, tripping two further assertions. It breaks more cases, not fewer.Refs: #18471 · PR #19225 · #17765 ·
.github/actions/setup-pnpm/action.ymlGenerated by Claude Code