Skip to content

Six gates root at .github/workflows and none reads .github/actions/** — a composite action's run: steps are audited by nothing while every scope line claims coverage #19229

Description

@os-try-charles

Path: none | instrument (gate farm scope) | 北极星「仪器为车队服务」

Six gates root their population at .github/workflows and none reads .github/actions/** — so executable steps living in a composite action are audited by nothing, while every one of those gates prints a scope line claiming coverage.

Filed by the domain:devx execution PM seat (session session_017ef78bLdybu3AffehKkhfk) out of the stop-and-report on #18471 / draft PR #19225. ⛔ Not graded, no domain:* — that is triage's. Expected landing point: scripts/** (a gate's derivation) ⇒ domain:devx by SUBJECT.

The blind spot, measured on origin/main 805811e0d

gate names .github/workflows names .github/actions
scripts/check-node-version.mjs 1 0
scripts/check-workflow-step-name-quoting.mjs 9 0
scripts/check-self-test-wired.mjs 1 0
scripts/check-self-test-workflow-commands.mjs 2 0
scripts/pm/dispatch-gates.mjs 74 0
scripts/check-step-collectors.mjs 0 0

⚠️ The probe is a literal grep for the two path spellings. Five of the six name the workflows root literally; the sixth (check-step-collectors.mjs) names neither, so it derives its root some other way and this seat did not trace it — ⛔ its row is UNJUDGED here, not clean.

Positive control that the blind spot is not vacuous: .github/actions/setup-pnpm/action.yml exists today and carries 6 run: steps. ⇒ there is already executable content in that tree, audited by none of the gates above.

⭐ Why it is worth a card now rather than a comment

The class is already documented per-gate — .github/actions/setup-pnpm/action.yml's own header names it («a gate silently auditing less than it says»), and the #18471 dev deliberately left two steps in the caller for exactly that reason. What changed: PR #19225 (card #18471, maintainer-ruled) moves the half-state sweeper's invocation into a new composite action, which makes .github/actions/** a place where runner-executed commands live, not just a setup helper.

⇒ The gap stops being theoretical the moment that PR lands, and it grows with every composite action the repo adds after it.

⛔ The repair that must NOT be taken

scripts/pm/dispatch-gates.mjs pins four live-specimen CONTROL assertions on the sweeper invocation being inside .github/workflows/half-state-patrol.yml — read on this tree:

[...sweepEntry.workflows].join('|') === 'half-state-patrol.yml' && isScheduled('half-state-patrol.yml') && reachesPRTime(...) && Boolean(sweepEntry.notRunnable) && !sweepEntry.ciOnly

Do not "fix" #18471 by re-pointing those four assertions at a different value-bearing family. That turns the gate green while leaving the derivation permanently blind to .github/actions/** — a declaration that reads like coverage and asserts nothing. It is the cheapest edit and the wrong one.

What the repair is

Teach the derivation to follow uses: ./.github/actions/NAME out of a workflow and read that action's runs.steps, so a command executed through a composite action is derived exactly as one executed inline. The four pinned assertions then hold again because the family is genuinely restored, not because they were moved.

⚠️ Cost, stated up front: that file's --self-test is a long battery — 1866 cases, measured today at 535.9 / 544.1 / 567.4 s in this container (and 593.2 s in an adjacent run), so it must be run detached with tail --pid, never in the foreground (#17765). New cases are owed for the new derivation path.

⚠️ Serial constraint, live at filing time: scripts/pm/dispatch-gates.mjs is being edited by open PRs #19162 and #19024. ⇒ This card is not startable until those land, which is why #18471 is parked behind it rather than behind a rewrite of its own PR.

⛔ Considered and rejected by measurement, ⛔ not by taste

Refs: #18471 · PR #19225 · #17765 · .github/actions/setup-pnpm/action.yml


Generated by Claude Code

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions