Repository navigation
feat: add workflow and settings check families - #7
Merged
Merged
Conversation
…nd environment The model carries the transitive needs graph, effective permissions (a job's declaration replaces the workflow's) and effective environment, so checks over workflow files share one reading of them.
…tHub client The workflow checks read job ordering, skippable jobs, runner resolution, runtime version sources, credentials, repository_dispatch handlers, update bot cooldowns, merge_group triggers and action pinning from the workflow model. The settings checks read merge methods, required checks and review thread resolution through a GitHubClient and run only when a client is given.
…and pinning decisions
A successful OIDC exchange overrides the _authToken line setup-node writes, so registry-url would not break trusted publishing.
… jobs that skip pull requests A junction job may decide in a script over join(needs.*.result), and jobs whose if keeps them to other events never run for a pull request. publishConfig.provenance in the package.json counts as requested provenance.
… the repository's own workflows
… options A push written as git push origin HEAD or origin +main was not recognised as a push to the default branch, and the value of an option such as -o was read as the remote or refspec. A push to a URL that carries its own credentials no longer counts as authenticating with the default token left by the checkout.
…ommand pnpm -r publish and pnpm --filter <package> publish are the usual workspace publish forms and were not read as publish commands, so a tokenless one with no blanked tokens and no provenance passed.
… labels A fallback to another self-hosted label was accepted, though it offers no runner when the self-hosted fleet is down. The last literal fallback is read as JSON and matched against hostedLabels.
…e-queue and disjunctive jobs A job is exempt from the junction's needs only when its if compares the ref or event name and names neither pull_request nor merge_group and has no disjunction, so a merge_group-only job or an || that can hold for a pull request is no longer taken as never running there.
…job's needs result
…ge to wait for a positive time
… the merge-method settings
…un through a package manager
…lish traceable only
…G_PROVENANCE, and its negations
… quotes and git global options
…ith a ConformanceError
…d instead of a made-up fallback The limits of merge_group and path filters are stated in the docs of both checks.
Also drops the unused job command reader, whose doc claimed commands but returned logical lines.
Mearman
marked this pull request as ready for review
October 2, 2026 02:52
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
🎉 This PR is included in version 1.2.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the workflows check family from the issue: nine offline checks over a parsed model of the workflow files (jobs, transitive needs, if conditions, effective permissions and environment), and three settings checks (merge methods, required checks including the junction job with strict mode, review thread resolution) that read the repository through an injectable GitHubClient. The settings checks run only when runChecks is given a client or the CLI gets --settings, so the file checks stay offline and token-free.
registry-url does not disable tokenless publishing, so it is not banned. In the npm CLI source the OIDC exchange overrides the registry _authToken on success, setup-node v7 no longer exports a placeholder token, and its own trusted-publishing example keeps registry-url. The real hazard is the failure path falling back to an inherited token, which is what workflow-credentials asks you to blank or cover with provenance. The comment in ci.yml claiming the opposite is corrected. Pinning is a policy option: third parties by full SHA by default, listed organisations may use a ref.
One deviation: dispatching with GITHUB_TOKEN is not flagged in itself, since GitHub documents repository_dispatch and workflow_dispatch as the events that do create runs with it. The handler check flags what that token cannot do instead (pushes and pull requests that start no workflows, dispatch to another repository). Sources and limits for each check are in the README.
Refs #5