Repository navigation
fix: validate action metadata shape before inspecting runs (#670) - #720
Conversation
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 59 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Coverage Report
File Coverage
|
||||||||||||||||||||||||||||||||||||||
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Jamie-BitFlight
left a comment
Jamie-BitFlight
left a comment
There was a problem hiding this comment.
Holistic review of PRs #717–#728
Reviewed 4dec063ea5a6853e096d34f12b652a28df42a8ff against main at edb05b4eeea35e03df75b066b8ddd1d708de9f1c.
Assessment: the narrow runtime guard and cause preservation are correct; ready for final verification. No introduced runtime defect found.
On main, truthy scalar runs values such as runs: node24, runs: 42 and runs: true reach the in operator and throw TypeError. This head returns false and the constructor reports contextual invalid metadata while retaining the cause. Ordinary metadata and boolean/numeric/null input defaults remain accepted. Current-head Node 24/26, lint and both real-repository integration checks are green.
The predicate's ActionYaml type still overstates what has been checked: that model includes the internally supplied path, specific run variants and nested types. This is existing type-model debt, not evidence that raw YAML should be required to provide internal fields. If that model is corrected, describe the parsed guarantees separately; do not use it to justify the incompatible #727 restrictions.
#727 was reviewed only for its own additional nested-validation block. Keep this parent narrow; the child currently rejects supported metadata and must be corrected before restacking.
## [2.0.5](v2.0.4...v2.0.5) (2026-10-11) ### Bug Fixes * add CLI-only generation error boundary ([#654](#654)) ([#725](#725)) ([6a27eaa](6a27eaa)) * **ci:** honor explicit Node versions before automatic detection ([95a9e68](95a9e68)) * **ci:** honor explicit Node versions in the test matrix ([#735](#735)) ([3f03f0d](3f03f0d)) * complete SVG writes before reporting success ([#717](#717)) ([170e499](170e499)) * consistently interpret GitHub Actions environment flag ([#670](#670)) ([#723](#723)) ([68756ad](68756ad)) * fail generation on formatting and requested save errors ([#654](#654)) ([#718](#718)) ([bb48434](bb48434)) * guard malformed runs metadata and preserve load error causes ([#720](#720)) ([c6caf7a](c6caf7a)) * load native ESM configuration and verify fresh package entry points ([5f92784](5f92784)) * load native ESM configuration and verify fresh package entry points ([#733](#733)) ([55746ed](55746ed)) * pair section log groups and honor Actions mode at output boundaries ([2d45100](2d45100)) * pair section log groups and honor Actions output mode ([#734](#734)) ([ceaa03a](ceaa03a)) * preserve empty metadata descriptions and cover reviewed errors ([3c0a181](3c0a181)) * preserve empty metadata descriptions and verify reviewed error paths ([#732](#732)) ([f8c0f4e](f8c0f4e)) * preserve original file read error as cause ([#722](#722)) ([05553e0](05553e0)) * validate consumed nested metadata descriptions ([#670](#670)) ([#729](#729)) ([330ab9a](330ab9a)) * validate README section configuration at input boundary ([#670](#670)) ([#726](#726)) ([40c9efd](40c9efd)) * verify declared defaults using their rendered projection ([beb2180](beb2180)) * verify empty metadata descriptions through the contract checker ([a5e2d31](a5e2d31))
|
🎉 This PR is included in version 2.0.5 🎉 The release is available on: Your semantic-release bot 📦🚀 |
1 participant
Fixes the verified TypeError for a non-object
runsvalue. Parse YAML asunknown, check the runtime shape before usingin, correct the validator's type predicate to the outer action metadata, and preserve the original load failure ascause.Draft pending malformed-metadata regression tests and full repository CI. A separate follow-up should validate optional nested fields without rejecting valid GitHub Action metadata. Related #670.