test: add regression guard for #571 action.yml expression bug - #574
test: add regression guard for #571 action.yml expression bug#574wryenmeek wants to merge 1 commit into
Conversation
Investigated issue #571 ("fleet-merge.yml intermittently fails to load fleet-orchestrator-token/action.yml") to implement a fix, but discovered the underlying bug was already fixed incidentally by commit aedce40 (merged 2026-08-16T14:56, as part of an unrelated PR that reverted an out-of-scope edit to this file back to main's already-fixed version). Verified via: - git diff across the fix boundary shows aedce40 removed the bare `${{ secrets.* }}` / `${{ steps.* }}` tokens from `description:` field prose in .github/actions/fleet-orchestrator-token/action.yml. - Every fleet-merge.yml run since aedce40 landed (2026-08-16T18:58 onward) either succeeded or failed for an unrelated, legitimate reason (PR #572 merge conflict) — none show the "Unrecognized named-value" error that characterized every pre-fix run. Adding test_action_descriptions_do_not_contain_bare_expressions to tests/kb/test_workflow_yaml_syntax.py so this bug class cannot silently recur: it recursively scans every action.yml's `description:` fields for bare `${{ secrets.* }}` / `${{ steps.* }}` expression syntax and fails if any is found. Confirmed the test fails against the pre-fix commit (62ffe35) and passes against current main. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 60c85cf866
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # intermittently mis-parsed such tokens inside description strings as live | ||
| # expressions, throwing "Unrecognized named-value: 'secrets'"/"'steps'" and | ||
| # failing to load the action. | ||
| _EXPRESSION_PATTERN = re.compile(r"\$\{\{\s*(secrets|steps)\.") |
There was a problem hiding this comment.
When a future description uses valid index syntax such as ${{ secrets['FLEET_APP_ID'] }} or ${{ steps['mint'].outputs.token }}, the composite-action validator still encounters the forbidden secrets/steps context, but _EXPRESSION_PATTERN requires an immediate dot and the regression test passes. Match bracket access (and optional whitespace before property access) as well so this action-load failure cannot recur through an equivalent expression spelling.
Useful? React with 👍 / 👎.
Summary
Closes #571.
While setting up to fix #571, discovered the underlying bug was already fixed on
mainby commitaedce40(merged 2026-08-16T14:56, as an incidental revert-to-main of an out-of-scope edit in an unrelated PR for #560). That commit removed the bare${{ secrets.* }}/${{ steps.* }}expression tokens fromdescription:field prose in.github/actions/fleet-orchestrator-token/action.yml, which is what the GitHub Actions composite-action template validator was intermittently mis-parsing as live expressions (Unrecognized named-value: 'secrets'/'steps').Evidence the bug is already fixed:
fleet-merge.ymlrun beforeaedce40landed (2026-08-16T15:33–16:28) failed with theUnrecognized named-valueerror.aedce40landed (2026-08-16T18:58 onward, including today) either succeeded or failed for an unrelated, legitimate reason (a real PR Add near-expiry checks for document freshness #572 merge conflict) — none show the composite-action load error.Since no code fix was actually needed, this PR instead adds a regression test so this bug class cannot silently recur (e.g. if a future edit reintroduces the pattern).
Changes
tests/kb/test_workflow_yaml_syntax.py: addstest_action_descriptions_do_not_contain_bare_expressions, which recursively scans every.github/actions/**/action.yml'sdescription:fields for bare${{ secrets.* }}/${{ steps.* }}expression syntax and fails if found.Verification
action.ymlcontent (commit62ffe359a5) — reproduces the 3 known violations.main.tests/kb/test_workflow_yaml_syntax.py tests/kb/test_fleet_merge_workflow.py— 46 passed.