fix: add CJS module-load syntax gate to prevent silent await/non-async regressions

[Copilot]

PR #43170 introduced await coreObj.summary.write() inside a non-async function, producing a SyntaxError at require() time and hard-failing every workflow step that loaded parse_mcp_gateway_log.cjs. Nothing in the existing pipeline caught this before workflows ran.

Changes

• scripts/validate-cjs-syntax.sh — new script that runs node --check on every non-test .cjs file under actions/setup/js/. Parses without executing, so no @actions/core runtime needed; catches SyntaxError (including await in non-async functions) at the source.

• Makefile: validate-cjs-syntax target — exposes the check standalone (make validate-cjs-syntax) and wires it into lint-cjs, which is already part of lint → agent-report-progress.

The writeStepSummaryWithTokenUsage function is async in the current base and the ESLint require-await-core-summary-write rule already gates its await suggestion behind isInsideAsyncFunction — this PR adds the final defense-in-depth layer so the same class of mistake can't silently ship again.

[github-actions]

🛠️ Agentic Maintenance updated this pull request branch.

View workflow run

[Copilot]

Pull request overview

Adds a defense-in-depth CI gate to prevent CommonJS (.cjs) module-load SyntaxErrors (e.g., await inside a non-async function) from shipping unnoticed, by running node --check across runtime .cjs files in actions/setup/js/ and wiring that into the existing make lint flow.

Changes:

• Introduces scripts/validate-cjs-syntax.sh to parse-check non-test .cjs files with node --check (no execution).
• Adds a validate-cjs-syntax Make target and runs it as part of lint-cjs (and therefore lint).
• Regenerates multiple workflow .lock.yml files, updating embedded awf-config JSON (notably adding a lyria model alias in several files).

Show a summary per file

File	Description
scripts/validate-cjs-syntax.sh	New script to syntax-check runtime .cjs files via node --check.
Makefile	Adds validate-cjs-syntax target and hooks it into lint-cjs / lint; updates make help.
.github/workflows/workflow-health-manager.lock.yml	Workflow lockfile updated (embedded awf-config JSON changed).
.github/workflows/schema-consistency-checker.lock.yml	Workflow lockfile updated (embedded awf-config JSON changed).
.github/workflows/safe-output-health.lock.yml	Workflow lockfile updated (embedded awf-config JSON changed).
.github/workflows/pr-triage-agent.lock.yml	Workflow lockfile updated (embedded awf-config JSON changed).
.github/workflows/poem-bot.lock.yml	Workflow lockfile updated (embedded awf-config JSON changed).
.github/workflows/gpclean.lock.yml	Workflow lockfile updated (embedded awf-config JSON changed).
.github/workflows/daily-team-evolution-insights.lock.yml	Workflow lockfile updated (embedded awf-config JSON changed).
.github/workflows/daily-safe-output-optimizer.lock.yml	Workflow lockfile updated (embedded awf-config JSON changed).
.github/workflows/daily-regulatory.lock.yml	Workflow lockfile updated (embedded awf-config JSON changed).
.github/workflows/daily-observability-report.lock.yml	Workflow lockfile updated (embedded awf-config JSON changed).
.github/workflows/daily-multi-device-docs-tester.lock.yml	Workflow lockfile updated (embedded awf-config JSON changed).
.github/workflows/daily-max-ai-credits-test.lock.yml	Workflow lockfile updated (embedded awf-config JSON changed).
.github/workflows/daily-credit-limit-test.lock.yml	Workflow lockfile updated (embedded awf-config JSON changed).
.github/workflows/daily-compiler-quality.lock.yml	Workflow lockfile updated (embedded awf-config JSON changed).
.github/workflows/daily-cli-tools-tester.lock.yml	Workflow lockfile updated (embedded awf-config JSON changed).
.github/workflows/daily-cache-strategy-analyzer.lock.yml	Workflow lockfile updated (embedded awf-config JSON changed).
.github/workflows/copilot-centralization-optimizer.lock.yml	Workflow lockfile updated (embedded awf-config JSON changed).
.github/workflows/copilot-centralization-drilldown.lock.yml	Workflow lockfile updated (embedded awf-config JSON changed).
.github/workflows/code-simplifier.lock.yml	Workflow lockfile updated (embedded awf-config JSON changed).
.github/workflows/ci-coach.lock.yml	Workflow lockfile updated (embedded awf-config JSON changed).
.github/workflows/agentic-token-optimizer.lock.yml	Workflow lockfile updated for a source:-managed workflow (embedded awf-config JSON changed).
.github/workflows/agent-performance-analyzer.lock.yml	Workflow lockfile updated (embedded awf-config JSON changed).

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

Makefile:1137

• The help output still describes lint-cjs as only formatting-related, but lint-cjs now also runs the CJS syntax gate. Updating the help text avoids surprising users who rely on make help.

	@echo "  golint-incremental - Run golangci-lint incrementally (only changed files, requires BASE_REF)"
	@echo "  lint             - Run linter"

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Low

[github-actions]

Great work on the CJS syntax gate — catching await-in-non-async regressions at require() time before any workflow runs is a solid defense-in-depth layer, and wiring it into lint-cjs → lint is exactly the right place for it.

One thing worth adding before this graduates from draft:

• Add a test for scripts/validate-cjs-syntax.sh — the script has no test coverage. A minimal smoke test (e.g. a .test.cjs file under actions/setup/js/ that intentionally contains await in a sync function) would verify the script actually catches the regression class it was written for, and prevent the gate itself from being silently broken later.

If you'd like a hand, you can assign this prompt to your coding agent:

Add a test for scripts/validate-cjs-syntax.sh that verifies the script catches a SyntaxError.

Specifically:
1. Create a temporary fixture file (e.g. a helper script or test harness) that invokes validate-cjs-syntax.sh against a synthetic .cjs file containing `await` inside a non-async function.
2. Assert that the script exits with code 1 and prints a SYNTAX ERROR line for that file.
3. Also assert that the script exits 0 when run against a well-formed .cjs file.
4. The test should be runnable via `make` or a standard test target without requiring any external dependencies beyond Node.js and bash.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• patchdiff.githubusercontent.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "patchdiff.githubusercontent.com"

See Network Configuration for more information.

Generated by ✅ Contribution Check · 477.1 AIC · ⌖ 31 AIC · ⊞ 6.2K · ◷