[Schema Consistency] 🔍 Schema Consistency Check - 2026-10-22

[github-actions[bot]]

Overview

Found 3 confirmed inconsistencies across schema, compiler, and documentation. Reviewed workflow usage using the precomputed root-field comparison and a targeted release-workflow check. No source files changed.

• Strategy: cached Schema-def spot checks + targeted parser/doc/workflow verification (strategy-2).
• Selection: day 295 modulo 10 = 5; proven strategy selected. New strategy: no.
• Validation: local Draft7 validation of reference YAML examples, followed by minimal JSON reproductions and static compiler checks. Previously cached findings were excluded.
• Severity: medium; no critical runtime defect established. These discrepancies reject documented configuration during validation.

Key Issues

1. Cross-repository docs recommend the removed allowed-repos: current alias. The reference explicitly promises normalization, but the schema rejects this string. A migration codemod already rewrites it to ${{ github.repository }}. Update the prose and example to the accepted expression and explain migration with gh aw fix.
2. safe-outputs.close-issue.allow-body is implemented and documented but missing from the schema. The documentation promises comment suppression, the compiler configuration carries the boolean, and handler serialization emits it; schema validation rejects it as an additional property. Add the boolean property and a regression check through normal compilation.
3. safe-outputs.update-release.github-token is parsed and documented but missing from the schema. The release example supplies a per-output token; the shared update parser reads it, but the release schema rejects it as an additional property. Add the appropriate existing token-schema reference and validate the published example through compilation.

Evidence and minimal reproductions

1. Removed repository alias

• Documentation: docs/src/content/docs/reference/cross-repository.md:71 describes current; the example begins at line 82.
• Schema: pkg/parser/schemas/main_workflow_schema.json:5082 limits scalar allowed-repos to all, public, or ${{ github.repository }}.
• Migration evidence: pkg/cli/codemod_allowed_repos_current.go:5 defines the migration and rewrites the alias.
• Rejected minimal input: {"tools":{"github":{"allowed-repos":"current"}}}.

2. Missing close-issue property

• Documentation: docs/src/content/docs/reference/safe-outputs.md:399 includes allow-body: false and explains suppression immediately below.
• Schema: the close-issue definition at pkg/parser/schemas/main_workflow_schema.json:7865 omits allow-body and sets additionalProperties to false.
• Compiler: pkg/workflow/close_entity_helpers.go:87 declares AllowBody; pkg/workflow/safe_outputs_handler_registry_issues.go:50 serializes it as allow_body.
• Rejected minimal input: {"safe-outputs":{"close-issue":{"allow-body":false}}}.
• Validation result: additional properties are not allowed (allow-body was unexpected).

3. Missing release token property

• Documentation: docs/src/content/docs/reference/safe-outputs.md:1156 supplies a custom token in the release configuration.
• Schema: pkg/parser/schemas/main_workflow_schema.json:12557 omits github-token and rejects additional properties.
• Compiler: pkg/workflow/update_release.go:15 calls the shared update parser; pkg/workflow/update_entity_helpers.go:167 parses common base fields; pkg/workflow/safe_outputs_config_base.go:38 reads github-token.
• Rejected minimal input: {"safe-outputs":{"update-release":{"github-token":"${{ secrets.CUSTOM_TOKEN }}"}}}. This is a literal documentation expression; no secret was accessed.
• Validation result: additional properties are not allowed (github-token was unexpected).

Ruled-out leads and workflow scope

The precomputed gaps for docker-image-pull-policy and work-queue-policy are false positives from tagged-field enumeration: pkg/workflow/docker.go:294 and pkg/workflow/work_queue_policy.go:184 consume RawFrontmatter. Neither is counted as a missing implementation.

The supplied diff reports no workflow root keys absent from the schema. The checkout contains 346 root workflow Markdown files and 147 shared Markdown files. These counts are scope context, not a claim that every file was compiled or every nested configuration validated. .github/workflows/release.md:36 enables update-release without the rejected token option. No confirmed workflow violation was established. Shared components were not treated as complete workflows.

AWF comparison limitation

The precomputed AWF comparison has degraded=true because canonical-source retrieval failed. Non-authoritative warning only: canonical AWF config-source consistency could not be assessed. No AWF drift finding, failed required check, corrective PR, or drift issue is proposed from this incomplete comparison.

Recommendations and Next Steps

• Replace the obsolete repository alias in cross-repository documentation and document its migration.
• Add close-issue.allow-body and update-release.github-token to their schema definitions, aligned with compiler semantics.
• Add focused compilation regressions for the three documented configurations; validate reference snippets in CI.
• Review the adjacent close-discussion schema for the same shared allow-body option; this was not counted as a separate finding.

Parser updates required: none established; preserve the existing consumers and align schema acceptance with them.

Strategy performance: 3 confirmed findings; high effectiveness; reuse recommended. Updated strategy-2 in the persistent strategy database with this run and findings.

References: §39728537998

Generated by ✅ Schema Consistency Checker · codex · gpt61 · 17 AIC · ⌖ 6.96 AIC · ⊞ 19.6K · ◷

• expires on Oct 22, 2026, 9:37 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Schema Consistency Checker.

A newer discussion is available at Discussion #71359.