fix(ci): repair workflows that are not valid YAML and have never run - #303
Merged
Conversation
GitHub Actions rejects an unparseable workflow before creating any job: the
run is `failure` with no jobs, no log and no check run. These files have never
executed once.
All of it traces to sweeps that edited by LINE POSITION rather than by parsing.
The shapes repaired here:
* A permissions block substituted INTO A QUOTED SHELL STRING, splitting it:
echo "Add 'permissions:
contents: read' at workflow level"
The second line sits at 2-space indent, less than the surrounding block
scalar, so it terminates the block and YAML tries to parse it. Rejoined.
* A top-level `permissions:` block dropped INSIDE a job, at column 0 between
`timeout-minutes` and `steps`. Removed; the job is covered by the
top-level declaration.
* TWO top-level `permissions:` blocks. Merged, keeping the widest value for
each key (write > read > none) — the only choice that cannot remove a
capability a job already relies on.
* An embedded interpreter script written at column 0 inside `run: |`,
ending the block scalar. Re-indented into it. Safe for the program too:
YAML strips the block-scalar indent when building the string, so the shell
and Python still receive it at column 0 with relative indentation intact.
* A `run:` scalar containing ": " inside a quoted string, which YAML reads
as a mapping. Converted to a block scalar.
VERIFIED: every workflow in this repository parses after the change, and each
repairer refuses to write a file that does not parse and still contain jobs.
Part of an estate-wide repair — 67 repositories, 100 workflow files. The
most frequently broken file was workflow-linter.yml, in 22 repositories: the
workflow whose job is to lint workflows was itself unparseable, so it never
ran and never caught this.
Detection is being added upstream so it cannot recur invisibly:
hyperpolymath/standards#582. Ordinary validation cannot see this class of
fault — yaml.safe_load silently keeps the last duplicate and reports success.
EXPECT THIS REPOSITORY TO GET LOUDER.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ ApprovedRepairs broken GitHub Actions workflow YAML files that were previously invalid and failing silently without running. No issues found.
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Important Your trial ends in 4 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
These workflow files are not valid YAML, so they have never run. Not "ran and failed" — never ran. GitHub Actions rejects the file before creating any job: the run is recorded as
failurewith no jobs, no log and no check run, andgh pr checksshows no row at all. A red mark with nothing behind it to read.Cause
A sweep added permission declarations by line position rather than by parsing the document. Three invalid shapes resulted:
A — a mapping indented under a scalar value
read-allalready grants everythingactions: readwould, so the orphaned line is dropped and nothing is lost.B — injected inside another block
C — a literal
\nthat was never interpreted, gluing the escape'snto the key:Only a text-level writer emitting an uninterpreted escape can produce that.
Verified, not assumed
Every workflow in this repository parses after the change. The repairer refuses to write any file that does not parse and still contain jobs afterwards.
Where a job-level
permissions:line was removed, a read-only top-levelpermissions:remains, so nothing is widened — and if none would remain, the tool reports that rather than inventing one. Guessing a permission set is how you silently over-grant.Estate context
67 repositories and 100 workflow files are in this state. The most frequently broken file is
workflow-linter.yml, in 22 repositories — followed byscorecard.yml(20) anddogfood-gate.yml(13).The workflow whose job is to lint workflows was itself unparseable, so it never ran, and never caught this or anything else. The check that would have found the damage was destroyed by the same sweep that caused it.
So it cannot recur invisibly
Detection is being added upstream: a strict-YAML check in the governance reusable — hyperpolymath/standards#582. Ordinary validation cannot see this class of fault, because
yaml.safe_loadsilently accepts duplicate keys and only a full parse catches the malformed indentation.Expect this repository to get louder
Workflows that have been failing silently will now actually run, and some will find real problems that have been invisible for as long as the files have been broken.
🤖 Generated with Claude Code