Repository navigation
chore(ci): bump jactionlint to 2.3.0 and address its new rules - #7287
Merged
kanadgupta merged 22 commits intoOct 23, 2026
Merged
kanadgupta merged 22 commits into
kanadgupta merged 22 commits into
Conversation
kanadgupta
added
the
run-ci
kanadgupta
marked this pull request as ready for review
October 23, 2026 01:10
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🤖 AI Review
Both independent reviews were available. Code inspection confirmed Claude's single cleanup nit; Codex reported no findings. No additional issues were identified. jactionlint validation was not run because the executable was unavailable.
Findings
| Severity | Location | Category | Sources | Claim |
|---|---|---|---|---|
| ⚪ NIT | .github/scripts/ai-review/resolve.ts:377 |
dead-code |
claude | Removing the resolve job's head_ref output leaves an unused resolver output and a stale workflow comment referencing the removed job output. |
Findings outside the diff
- ⚪ NIT
.github/scripts/ai-review/resolve.ts:377— Removing the resolve job's head_ref output leaves an unused resolver output and a stale workflow comment referencing the removed job output.
Stats
Claude findings: 1 · Codex findings: 0 · Confirmed: 1 · Refuted: 0 · Uncertain: 0
Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: auto · Workflow run
This review runs once per PR. A maintainer can request another with a /ai-review comment.
![depthfirst-app[bot]](https://avatars.githubusercontent.com/in/1021002?s=60&v=4){kind=small}
avallete
approved these changes
Oct 23, 2026
kanadgupta
added this pull request to stack #7305
October 23, 2026 14:34
Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
Single-job workflows move their write scopes under the job, so a job added later starts with no token access. contribution-gate grants both jobs the scopes the script needs to comment on and close pull requests. release-smoke-test's caller job keeps the four scopes release-shared's job tree declares: contents and id-token for publish, pull-requests for the notes proposal, actions for the live-e2e gate. Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
The authorize job reads a team membership and comments on the pull request. The apply job edits the release, comments, and closes the pull request with its branch; workflows write covers a release whose tagged commit changed a workflow file, as release-shared already requests. The propose job pushes a branch, creates a label, and opens the pull request. Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
Both steps skip when the release already exists, which action-gh-release handled by updating it, and verify the tag the earlier step pushed. The config release stays off "latest" and the CLI release stays a draft for the asset upload steps that follow. Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
The gate script talks to the API with its own token and never runs git. Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
The default run shell is bash -e without pipefail, so a failing go, jq, pnpm or docker command at the head of a pipeline was hidden by the exit status of the command after it. Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
The sync workflows run on workflow_run with secrets, where a value written to GITHUB_ENV reaches every later step. A step output reaches only the three steps that start Claude. Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
Each workflow exists to react to the event it is flagged for, and each one already runs only trusted-checkout code under that event. Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
Creating the label works with pull-requests write; the only other issue access is Claude reading linked issues. Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
The apply job runs the notes script from the pull request's checkout, so its token must not be able to change workflow files. Releases for tags on main are already created and edited with the workflow token, which can never hold that scope, so editing the notes does not need it either. Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
kanadgupta
force-pushed
the
kanad-claude/jactionlint-v2
branch
from
October 23, 2026 14:34
305f1f2 to
f4d989f
Compare
kanadgupta
enabled stacked auto-merge
October 23, 2026 14:34
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #7285.
Bump
jactionlintmoves from 1.8.2 to 2.3.0 ("2"in mise.toml, pinned inmise.lock).require-commit-hashkey becomesrules: unpinned-uses: error, the vendored.repos/**submodules are excluded, and themissing-timeoutandconcurrency-limitspolicy rules are turned off.Fixes, one commit per rule
softprops/action-gh-releasesteps becomegh release create, skipping when the release already exists and verifying the tag the earlier step pushed.Accepted findings, one commit per rule
Each carries an inline
# jactionlint ignore=comment with a plain-English reason:dangerous-triggers,adhoc-packages,unverified-download,cache-poisoning(run-scoped key),unpinned-images(smoke-test container),bot-conditions(the author check is already present), andissues: writeon reopen-stale-issue.🤖 Generated with Claude Code