Repository navigation
🏗️🔧：check actions in jobs named with or env - #1926
Merged
openinf-commit-queue[bot] merged 1 commit intoOct 19, 2026
Merged
Conversation
verify-workflows skipped every uses: with a with: or env: key anywhere above it, so that inputs named "uses" were not read as actions. A job whose id is "with" or "env" matched too, and its unpinned steps were never checked. The skip now ignores a with: or env: key that sits directly under jobs:, since that is a job id rather than an input or variable map. Tests cover both job names and the input cases that must still pass. Signed-off-by: Derek Lewis <DerekNonGeneric@inf.is> Assisted-by: Claude-Code:claude-opus-5
✅ Deploy Preview for gh-pages-openinf ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly identifies the main change: checking actions in jobs named with or env. The emojis and punctuation add minor noise but do not make the title unclear. |
| Docstring Coverage | |
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
✨ Finishing Touches
-
📝 Generate docstrings
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
Member
Author
|
@coderabbitai review Generated by Claude Code |
✅ Action performedReview finished.
|
DerekNonGeneric
added
the
🚀 Status: Commit Queue
Claude
openinf-commit-queue
Bot
removed
the
🚀 Status: Commit Queue
openinf-commit-queue
Bot
deleted the
claude/full-audit-0e491i-pin-check-scope
branch
October 19, 2026 13:53
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by DerekNonGeneric · project thread
Before: the pin check skipped every
uses:that had awith:orenv:key anywhere above it. So a job whose id waswithorenvcould run unpinned actions without the check noticing.After: a
with:orenv:key that sits directly underjobs:is treated as a job id, so that job's steps are checked. Step inputs, env vars, and reusable-workflow inputs namedusesare still ignored.How: this ports OpenINF/.github#942: a small
isKeyedhelper, plus a parent check in the skip.build/tasks/verify-workflows.test.mtscovers both job names and the input cases that must still pass. The two job-name cases fail without the fix. verify.unit (194/194), verify.ts, verify.workflows, verify.md, verify.filenames, spelling and the build all pass locally.Summary by CodeRabbit
withorenv, while continuing to allowusesvalues in step inputs and reusable-workflow jobs.