fix: validate nested action inputs, outputs and branding (#670)

[Jamie-BitFlight]

Stacked on #720. Check that optional inputs, outputs and branding are mappings and that fields consumed as strings have compatible types before generation. Preserve unknown metadata fields and optional values. Does not attempt full GitHub Actions schema enforcement.

Draft: add valid/invalid metadata fixtures, assess scalar defaults and boolean required values against actual action metadata, and run CI. Merge #720 first, then retarget to main. Related #670.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	92.11%	1016 / 1103
🔵	Statements	92.26%	1038 / 1125
🔵	Functions	95.15%	157 / 165
🔵	Branches	86.16%	573 / 665

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
src/Action.ts	92%	90.74%	100%	92%	149, 161, 232, 259

Generated in workflow #1075 for commit 2dd9b34 by the Vitest Coverage Report Action

[Jamie-BitFlight]

Holistic review of PRs #717–#728

Reviewed 2dd9b340e4f8f2b57482ffdc609f55162ab5317f against #720 at 4dec063ea5a6853e096d34f12b652a28df42a8ff.

Assessment: correction required — critical rejection of valid, already supported metadata (P1).

This review compares the 20-line nested-validation addition against its actual #720 base; the outer runs guard and load-error cause belong to the parent. The string-only check for input defaults rejects boolean, numeric and null YAML scalars that main/#720 render into inputs and usage sections. It even rejects this repository's own action metadata; exact-head CI passes its 688 tests and build, then fails generate-docs while loading action.yml.

A smaller nested boundary check has a real purpose: numeric input descriptions reach string methods, and null input entries crash consumers on main. That does not justify applying the same rule to defaults, unused deprecationMessage, or every optional field. Rewrite the check around actual renderer requirements while preserving supported scalar defaults and optional-value behavior. Loading real YAML through generation is necessary regression coverage; the existing renderer fixtures bypassed this parser defect.

After correction, restack on #720 and run the workflows against the intended eventual base. This stack branch currently receives no real-repository integration/lint runs because those workflows filter PR base branches. Their absence is not verification.

[Jamie-BitFlight]

Critical (P1) — preserve scalar input defaults when validating metadata.

Including default in this string-only check rejects metadata the generator already handles. With default: false, default: 0, or default: null, main and #720 generate the inputs/usage sections; this head fails during action loading. The repository's own action.yml has unquoted boolean defaults, and the current Node 24 CI job passes 688 tests and the build, then fails npm run generate-docs with Invalid action metadata syntax for that file.

These are ordinary GitHub metadata forms: pinned actions/checkout metadata includes boolean, numeric and null defaults, and the runner's template reader converts those scalar tokens to strings when its string schema accepts them.

Keep supported scalar defaults accepted instead of applying the description string check to them. Add a regression that parses actual YAML and generates sections, so renderer-only fixtures cannot miss this failure.