Should failing allowedUnsafeExecutions checks return an ArtifactError?

[mikeroll]

I came from #43562 (reply in thread), where mise lock was silently skipped due to not being whitelisted, rather than erroring out.

This code is for mise but it's essentially the same for all unsafe commands:

  const allowlist = GlobalConfig.get('allowedUnsafeExecutions');
  if (!allowlist.includes('mise')) {
    logger.once.warn(
      '`mise lock` was requested to run, but `mise` is not permitted in the allowedUnsafeExecutions',
    );
    return null;
  }

Do you think something like this would make sense instead? It would definitely make such issues visible with the Mend-hosted Renovate, and I suspect would also improve the ergonomics for the self-hosted variant.

  const allowlist = GlobalConfig.get('allowedUnsafeExecutions');
  if (!allowlist.includes('mise')) {
	const reason = '`mise lock` was requested to run, but `mise` is not permitted in the allowedUnsafeExecutions';
    return [
      {
        artifactError: {
          fileName: lockFileName,
          stderr: reason,
        },
      },
    ];
  }

[jamietanna]

Good shout! I've converted to #44232