@htekdev/actions-debugger 1.0.54 → 1.0.55
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -0,0 +1,99 @@
|
|
|
1
|
+
id: silent-failures-055
|
|
2
|
+
title: "'github.event_name' is 'workflow_call' inside reusable workflows — not the caller's event"
|
|
3
|
+
category: silent-failures
|
|
4
|
+
severity: silent-failure
|
|
5
|
+
tags:
|
|
6
|
+
- reusable-workflow
|
|
7
|
+
- workflow_call
|
|
8
|
+
- event_name
|
|
9
|
+
- github-context
|
|
10
|
+
- conditional
|
|
11
|
+
- silent
|
|
12
|
+
patterns:
|
|
13
|
+
- regex: 'github\.event_name\s*==\s*[''"]push[''"]'
|
|
14
|
+
flags: i
|
|
15
|
+
- regex: 'github\.event_name\s*==\s*[''"]pull_request[''"]'
|
|
16
|
+
flags: i
|
|
17
|
+
- regex: 'github\.event_name\s*==\s*[''"]workflow_dispatch[''"]'
|
|
18
|
+
flags: i
|
|
19
|
+
error_messages:
|
|
20
|
+
- "Evaluating: github.event_name == 'push' => false"
|
|
21
|
+
- "Step skipped: if condition 'github.event_name == \"push\"' was false"
|
|
22
|
+
root_cause: |
|
|
23
|
+
When a workflow is called as a reusable workflow via on: workflow_call, GitHub Actions
|
|
24
|
+
sets github.event_name to "workflow_call" inside that workflow — NOT to the triggering
|
|
25
|
+
event from the caller workflow.
|
|
26
|
+
|
|
27
|
+
A common mistake is to write conditional logic in a reusable workflow that checks
|
|
28
|
+
github.event_name expecting the caller's event (push, pull_request, workflow_dispatch,
|
|
29
|
+
etc.). These conditions always evaluate to false when the workflow is invoked via
|
|
30
|
+
workflow_call, silently skipping the affected steps or entire jobs.
|
|
31
|
+
|
|
32
|
+
The behaviour is especially confusing because developers often test the reusable workflow
|
|
33
|
+
in isolation via workflow_dispatch — in which case github.event_name IS correct. The
|
|
34
|
+
silent skip only appears when the workflow is called from another workflow, and the skipped
|
|
35
|
+
step or job disappears from the run summary with no error message.
|
|
36
|
+
fix: |
|
|
37
|
+
Pass the caller's event name as an explicit input to the reusable workflow. The caller
|
|
38
|
+
reads github.event_name from its own context (where it is correct) and passes it as a
|
|
39
|
+
string input. Inside the reusable workflow, check inputs.caller_event (or whatever name
|
|
40
|
+
you choose) instead of github.event_name.
|
|
41
|
+
|
|
42
|
+
Alternatively, restructure so that event-specific logic stays in the caller workflow and
|
|
43
|
+
the reusable workflow only receives final parameters — not the raw event name.
|
|
44
|
+
fix_code:
|
|
45
|
+
- language: yaml
|
|
46
|
+
label: "Problem: event_name check always false in reusable workflow"
|
|
47
|
+
code: |
|
|
48
|
+
# reusable.yml — WRONG: event_name is always "workflow_call" here
|
|
49
|
+
on:
|
|
50
|
+
workflow_call:
|
|
51
|
+
|
|
52
|
+
jobs:
|
|
53
|
+
build:
|
|
54
|
+
runs-on: ubuntu-latest
|
|
55
|
+
steps:
|
|
56
|
+
- name: Deploy only on push
|
|
57
|
+
if: github.event_name == 'push' # Always false — event_name is "workflow_call"
|
|
58
|
+
run: echo "Deploying..."
|
|
59
|
+
- language: yaml
|
|
60
|
+
label: "Fix: accept caller_event as an explicit input"
|
|
61
|
+
code: |
|
|
62
|
+
# reusable.yml — CORRECT: accept the caller's event as an input
|
|
63
|
+
on:
|
|
64
|
+
workflow_call:
|
|
65
|
+
inputs:
|
|
66
|
+
caller_event:
|
|
67
|
+
type: string
|
|
68
|
+
required: true
|
|
69
|
+
|
|
70
|
+
jobs:
|
|
71
|
+
build:
|
|
72
|
+
runs-on: ubuntu-latest
|
|
73
|
+
steps:
|
|
74
|
+
- name: Deploy only on push
|
|
75
|
+
if: inputs.caller_event == 'push' # Correct — uses the passed-in value
|
|
76
|
+
run: echo "Deploying..."
|
|
77
|
+
- language: yaml
|
|
78
|
+
label: "Caller workflow: pass github.event_name as input"
|
|
79
|
+
code: |
|
|
80
|
+
# caller.yml — pass the caller's event name to the reusable workflow
|
|
81
|
+
on: [push, pull_request]
|
|
82
|
+
|
|
83
|
+
jobs:
|
|
84
|
+
call-reusable:
|
|
85
|
+
uses: ./.github/workflows/reusable.yml
|
|
86
|
+
with:
|
|
87
|
+
caller_event: ${{ github.event_name }} # "push" or "pull_request"
|
|
88
|
+
prevention:
|
|
89
|
+
- "Never use 'github.event_name' in a reusable workflow to detect the caller's event — it will always be 'workflow_call'"
|
|
90
|
+
- "Pass event-specific data as explicit inputs; document expected values in the input description field"
|
|
91
|
+
- "When testing a reusable workflow via workflow_dispatch, simulate the production caller_event value via inputs to catch conditional errors early"
|
|
92
|
+
- "The same rule applies to github.event.* properties — many will be empty or refer to the workflow_call event, not the caller's event"
|
|
93
|
+
docs:
|
|
94
|
+
- url: "https://docs.github.com/en/actions/sharing-automations/reusing-workflows"
|
|
95
|
+
label: "GitHub Docs: Reusing workflows"
|
|
96
|
+
- url: "https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#github-context"
|
|
97
|
+
label: "GitHub Docs: github context reference"
|
|
98
|
+
- url: "https://docs.github.com/en/actions/sharing-automations/reusing-workflows#limitations"
|
|
99
|
+
label: "GitHub Docs: Reusable workflow limitations"
|
|
@@ -0,0 +1,115 @@
|
|
|
1
|
+
id: triggers-039
|
|
2
|
+
title: "'github.sha' in pull_request_target points to base branch HEAD, not the PR's head commit"
|
|
3
|
+
category: triggers
|
|
4
|
+
severity: silent-failure
|
|
5
|
+
tags:
|
|
6
|
+
- pull_request_target
|
|
7
|
+
- github-sha
|
|
8
|
+
- base-branch
|
|
9
|
+
- pr-head
|
|
10
|
+
- checkout
|
|
11
|
+
- security
|
|
12
|
+
- silent
|
|
13
|
+
patterns:
|
|
14
|
+
- regex: 'pull_request_target'
|
|
15
|
+
flags: i
|
|
16
|
+
- regex: 'github\.event\.pull_request\.head\.sha'
|
|
17
|
+
flags: i
|
|
18
|
+
- regex: 'github\.sha.*pull_request_target'
|
|
19
|
+
flags: i
|
|
20
|
+
error_messages:
|
|
21
|
+
- "Tests passed but PR code was never executed (checked out base branch at github.sha)"
|
|
22
|
+
root_cause: |
|
|
23
|
+
The pull_request_target event fires in the context of the BASE branch of a pull request,
|
|
24
|
+
not the PR's head branch. Consequently, github.sha inside a pull_request_target workflow
|
|
25
|
+
is the HEAD commit SHA of the BASE branch — typically main or master — not the PR
|
|
26
|
+
contributor's changes.
|
|
27
|
+
|
|
28
|
+
This design is intentional: pull_request_target runs with repository secrets and write
|
|
29
|
+
permissions available, so GitHub restricts it to trusted base-branch code to prevent
|
|
30
|
+
malicious PR code from exfiltrating secrets. However, it causes a silent logic error when
|
|
31
|
+
developers expect github.sha (or the default actions/checkout behaviour, which checks out
|
|
32
|
+
github.sha) to build and test the PR's changes.
|
|
33
|
+
|
|
34
|
+
The result is a CI run that appears to succeed — but it compiled and tested the base
|
|
35
|
+
branch code, not the pull request's changes. The PR author sees green CI even though
|
|
36
|
+
their changes were never executed.
|
|
37
|
+
fix: |
|
|
38
|
+
To work with PR head code in a pull_request_target workflow, explicitly specify the PR
|
|
39
|
+
head SHA using github.event.pull_request.head.sha in the checkout step's ref: input.
|
|
40
|
+
|
|
41
|
+
SECURITY WARNING: checking out untrusted PR code in a workflow that has access to secrets
|
|
42
|
+
creates a pwn-request vulnerability. Only check out PR head code in jobs with minimal
|
|
43
|
+
permissions and no secret exposure.
|
|
44
|
+
|
|
45
|
+
For most CI use cases — building, linting, testing — use the standard pull_request event
|
|
46
|
+
instead of pull_request_target. The pull_request event correctly checks out PR changes
|
|
47
|
+
but runs without repository secrets, which is the safe and intended design.
|
|
48
|
+
fix_code:
|
|
49
|
+
- language: yaml
|
|
50
|
+
label: "Problem: default checkout in pull_request_target checks out base branch"
|
|
51
|
+
code: |
|
|
52
|
+
on: pull_request_target
|
|
53
|
+
|
|
54
|
+
jobs:
|
|
55
|
+
test:
|
|
56
|
+
runs-on: ubuntu-latest
|
|
57
|
+
steps:
|
|
58
|
+
- uses: actions/checkout@v4
|
|
59
|
+
# No ref specified — uses github.sha which is BASE branch HEAD, not PR code
|
|
60
|
+
- run: npm test # Tests base branch, not the PR changes
|
|
61
|
+
- language: yaml
|
|
62
|
+
label: "Explicit PR head checkout (only when no secrets are exposed)"
|
|
63
|
+
code: |
|
|
64
|
+
on: pull_request_target
|
|
65
|
+
|
|
66
|
+
jobs:
|
|
67
|
+
label-and-check:
|
|
68
|
+
runs-on: ubuntu-latest
|
|
69
|
+
permissions:
|
|
70
|
+
pull-requests: write # Minimal permissions — no secrets
|
|
71
|
+
steps:
|
|
72
|
+
- uses: actions/checkout@v4
|
|
73
|
+
with:
|
|
74
|
+
ref: ${{ github.event.pull_request.head.sha }}
|
|
75
|
+
# Only safe because this job has no secret access
|
|
76
|
+
# Do NOT add secrets: or environment: to jobs that do this
|
|
77
|
+
- language: yaml
|
|
78
|
+
label: "Recommended: use pull_request for testing, pull_request_target only for privileged operations"
|
|
79
|
+
code: |
|
|
80
|
+
# Standard PR testing — pull_request has no secrets but correctly checks out PR changes
|
|
81
|
+
on: pull_request
|
|
82
|
+
|
|
83
|
+
jobs:
|
|
84
|
+
test:
|
|
85
|
+
runs-on: ubuntu-latest
|
|
86
|
+
steps:
|
|
87
|
+
- uses: actions/checkout@v4
|
|
88
|
+
# github.sha is the PR merge commit — correct for testing PR changes
|
|
89
|
+
- run: npm test
|
|
90
|
+
|
|
91
|
+
---
|
|
92
|
+
# Separate privileged workflow for labeling/commenting — uses pull_request_target
|
|
93
|
+
# This one works with base-branch context (github.sha = base HEAD) — which is correct
|
|
94
|
+
# for privileged operations that should only run trusted code
|
|
95
|
+
on: pull_request_target
|
|
96
|
+
|
|
97
|
+
jobs:
|
|
98
|
+
label:
|
|
99
|
+
runs-on: ubuntu-latest
|
|
100
|
+
permissions:
|
|
101
|
+
pull-requests: write
|
|
102
|
+
steps:
|
|
103
|
+
- uses: actions/labeler@v5
|
|
104
|
+
prevention:
|
|
105
|
+
- "Default to 'pull_request' event for building and testing PR code — it correctly checks out PR changes and has no secrets"
|
|
106
|
+
- "Use 'pull_request_target' only for privileged operations that genuinely need secrets or write permissions (labeling, commenting, deployment approval)"
|
|
107
|
+
- "Never expose repository secrets in the same job that checks out untrusted PR head code via github.event.pull_request.head.sha"
|
|
108
|
+
- "Add a comment next to any pull_request_target checkout step documenting which ref is used and why it is safe"
|
|
109
|
+
docs:
|
|
110
|
+
- url: "https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#pull_request_target"
|
|
111
|
+
label: "GitHub Docs: pull_request_target event"
|
|
112
|
+
- url: "https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/"
|
|
113
|
+
label: "GitHub Security Lab: Preventing pwn requests"
|
|
114
|
+
- url: "https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions"
|
|
115
|
+
label: "GitHub Docs: Security hardening for GitHub Actions"
|
|
@@ -0,0 +1,91 @@
|
|
|
1
|
+
id: yaml-syntax-038
|
|
2
|
+
title: "'::save-state::' and '::get-state::' workflow commands deprecated — upgrade to GITHUB_STATE"
|
|
3
|
+
category: yaml-syntax
|
|
4
|
+
severity: warning
|
|
5
|
+
tags:
|
|
6
|
+
- save-state
|
|
7
|
+
- get-state
|
|
8
|
+
- deprecated
|
|
9
|
+
- workflow-commands
|
|
10
|
+
- environment-files
|
|
11
|
+
- GITHUB_STATE
|
|
12
|
+
patterns:
|
|
13
|
+
- regex: 'The `save-state` command is deprecated'
|
|
14
|
+
flags: i
|
|
15
|
+
- regex: 'The `get-state` command is deprecated'
|
|
16
|
+
flags: i
|
|
17
|
+
- regex: '::save-state name='
|
|
18
|
+
flags: ''
|
|
19
|
+
- regex: '::get-state name='
|
|
20
|
+
flags: ''
|
|
21
|
+
error_messages:
|
|
22
|
+
- "Warning: The `save-state` command is deprecated and will be disabled soon. Please upgrade to using Environment Files."
|
|
23
|
+
- "Warning: The `get-state` command is deprecated and will be disabled soon. Please upgrade to using Environment Files."
|
|
24
|
+
root_cause: |
|
|
25
|
+
GitHub Actions originally provided workflow commands ::save-state name=FOO::value and
|
|
26
|
+
::get-state name=FOO:: as a way to persist data between the main body of a step and its
|
|
27
|
+
pre: or post: hooks in JavaScript actions.
|
|
28
|
+
|
|
29
|
+
GitHub deprecated these commands when it introduced environment files (GITHUB_STATE,
|
|
30
|
+
GITHUB_ENV, GITHUB_OUTPUT) as a more robust alternative. Workflows and actions that use
|
|
31
|
+
the old echo "::save-state name=...::value" or echo "::get-state name=...:" syntax now
|
|
32
|
+
produce deprecation warnings in workflow logs.
|
|
33
|
+
|
|
34
|
+
When these commands are eventually disabled, steps using them will silently fail to persist
|
|
35
|
+
state — the post: hook will read an empty string from the state variable, causing subtle
|
|
36
|
+
logic errors. Actions published to the Marketplace are particularly affected because older
|
|
37
|
+
versions used these commands before the deprecation was announced.
|
|
38
|
+
fix: |
|
|
39
|
+
Replace the deprecated workflow commands with the GITHUB_STATE environment file approach:
|
|
40
|
+
- To write state: append "KEY=value" to $GITHUB_STATE (shell) or write to
|
|
41
|
+
process.env['GITHUB_STATE'] (Node.js)
|
|
42
|
+
- To read state in pre:/post: hooks: read the environment variable STATE_<KEY>
|
|
43
|
+
|
|
44
|
+
In shell-based steps the pattern is identical to GITHUB_ENV and GITHUB_OUTPUT.
|
|
45
|
+
In JavaScript actions, upgrade to @actions/core v1.10.0+ and use the saveState() and
|
|
46
|
+
getState() helpers, which internally write to GITHUB_STATE.
|
|
47
|
+
fix_code:
|
|
48
|
+
- language: yaml
|
|
49
|
+
label: "Deprecated: ::save-state:: and ::get-state:: commands (produces warnings)"
|
|
50
|
+
code: |
|
|
51
|
+
# DEPRECATED — produces warning in logs, will eventually break
|
|
52
|
+
- name: Save state (deprecated)
|
|
53
|
+
run: echo "::save-state name=SERVER_PID::12345"
|
|
54
|
+
|
|
55
|
+
- name: Read state in post step (deprecated)
|
|
56
|
+
run: echo "Saved PID was $(echo "::get-state name=SERVER_PID::")"
|
|
57
|
+
- language: yaml
|
|
58
|
+
label: "Correct: GITHUB_STATE environment file"
|
|
59
|
+
code: |
|
|
60
|
+
# Write state to GITHUB_STATE file
|
|
61
|
+
- name: Save state
|
|
62
|
+
run: echo "SERVER_PID=12345" >> $GITHUB_STATE
|
|
63
|
+
|
|
64
|
+
# State is automatically available as STATE_<KEY> in later phases
|
|
65
|
+
- name: Read state (available in main, pre, and post phases)
|
|
66
|
+
run: echo "Server PID was $STATE_SERVER_PID"
|
|
67
|
+
- language: yaml
|
|
68
|
+
label: "PowerShell equivalent"
|
|
69
|
+
code: |
|
|
70
|
+
- name: Save state (PowerShell)
|
|
71
|
+
shell: pwsh
|
|
72
|
+
run: |
|
|
73
|
+
"SERVER_PID=12345" | Out-File -FilePath $env:GITHUB_STATE -Append
|
|
74
|
+
|
|
75
|
+
- name: Read state (PowerShell)
|
|
76
|
+
shell: pwsh
|
|
77
|
+
run: |
|
|
78
|
+
Write-Host "Server PID was $env:STATE_SERVER_PID"
|
|
79
|
+
prevention:
|
|
80
|
+
- "Audit actions with pre: or post: hooks — these are the primary consumers of save-state/get-state"
|
|
81
|
+
- "Upgrade to @actions/core v1.10.0+ which uses GITHUB_STATE internally via saveState()/getState()"
|
|
82
|
+
- "Search existing workflows and composite actions for '::save-state' and '::get-state' patterns before they are disabled"
|
|
83
|
+
- "Pin to action versions that have migrated to GITHUB_STATE; check CHANGELOG for migration notes"
|
|
84
|
+
- "The same deprecation cycle affected ::set-output:: (now GITHUB_OUTPUT) and ::set-env:: (now GITHUB_ENV)"
|
|
85
|
+
docs:
|
|
86
|
+
- url: "https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#environment-files"
|
|
87
|
+
label: "GitHub Docs: Workflow commands — environment files"
|
|
88
|
+
- url: "https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/"
|
|
89
|
+
label: "GitHub Changelog: Deprecating save-state and set-output commands (Oct 2022)"
|
|
90
|
+
- url: "https://github.com/actions/toolkit/releases/tag/%40actions%2Fcore%401.10.0"
|
|
91
|
+
label: "actions/toolkit: @actions/core v1.10.0 release notes"
|
|
@@ -0,0 +1,115 @@
|
|
|
1
|
+
id: yaml-syntax-039
|
|
2
|
+
title: "'type: choice' not supported for workflow_call inputs — validation error when combining with workflow_dispatch"
|
|
3
|
+
category: yaml-syntax
|
|
4
|
+
severity: error
|
|
5
|
+
tags:
|
|
6
|
+
- workflow_call
|
|
7
|
+
- workflow_dispatch
|
|
8
|
+
- inputs
|
|
9
|
+
- type-choice
|
|
10
|
+
- validation
|
|
11
|
+
- combined-triggers
|
|
12
|
+
patterns:
|
|
13
|
+
- regex: 'Input type .choice. is not supported'
|
|
14
|
+
flags: i
|
|
15
|
+
- regex: 'Unexpected value .choice.'
|
|
16
|
+
flags: i
|
|
17
|
+
- regex: 'Invalid workflow file.*type.*choice'
|
|
18
|
+
flags: i
|
|
19
|
+
error_messages:
|
|
20
|
+
- "Invalid workflow file: Input type 'choice' is not supported for workflow_call triggers. Allowed types: boolean, number, string"
|
|
21
|
+
- "Unexpected value 'choice', expected one of: boolean, number, string"
|
|
22
|
+
- "Invalid value for inputs.*.type: 'choice'"
|
|
23
|
+
root_cause: |
|
|
24
|
+
GitHub Actions supports different input types depending on the trigger:
|
|
25
|
+
- workflow_dispatch supports: boolean, choice, environment, number, string
|
|
26
|
+
- workflow_call supports only: boolean, number, string
|
|
27
|
+
|
|
28
|
+
When developers combine both triggers in the same workflow file (a common pattern for
|
|
29
|
+
workflows that can be called by other workflows AND dispatched manually), they define a
|
|
30
|
+
shared inputs: block. If those shared inputs use type: choice — valid for workflow_dispatch
|
|
31
|
+
but not workflow_call — the workflow fails schema validation with a cryptic error.
|
|
32
|
+
|
|
33
|
+
The error message does not always clearly indicate which trigger is rejecting the type,
|
|
34
|
+
causing developers to search for choice support across GitHub Actions documentation rather
|
|
35
|
+
than recognising it as a trigger-specific limitation. The same restriction applies to
|
|
36
|
+
type: environment.
|
|
37
|
+
fix: |
|
|
38
|
+
For inputs shared between workflow_dispatch and workflow_call, use type: string and
|
|
39
|
+
document the allowed values in the description field. The GitHub UI renders a free-text
|
|
40
|
+
field for manual dispatch instead of a dropdown, but callers still pass controlled values.
|
|
41
|
+
|
|
42
|
+
For strict input validation, add a shell step at the start of the job that fails if the
|
|
43
|
+
input value is not in the allowed set.
|
|
44
|
+
|
|
45
|
+
If the dropdown UI is essential for manual dispatch, create a thin dispatcher workflow
|
|
46
|
+
(workflow_dispatch only with type: choice) that calls the main reusable workflow passing
|
|
47
|
+
the validated value as a string.
|
|
48
|
+
fix_code:
|
|
49
|
+
- language: yaml
|
|
50
|
+
label: "Problem: type: choice breaks workflow_call validation"
|
|
51
|
+
code: |
|
|
52
|
+
on:
|
|
53
|
+
workflow_dispatch:
|
|
54
|
+
inputs:
|
|
55
|
+
environment:
|
|
56
|
+
type: choice # Valid for workflow_dispatch only
|
|
57
|
+
options: [dev, staging, prod]
|
|
58
|
+
workflow_call:
|
|
59
|
+
inputs:
|
|
60
|
+
environment:
|
|
61
|
+
type: choice # INVALID for workflow_call — causes validation error
|
|
62
|
+
- language: yaml
|
|
63
|
+
label: "Fix: use type: string with documented allowed values"
|
|
64
|
+
code: |
|
|
65
|
+
on:
|
|
66
|
+
workflow_dispatch:
|
|
67
|
+
inputs:
|
|
68
|
+
environment:
|
|
69
|
+
type: string
|
|
70
|
+
description: "Target environment. Allowed values: dev, staging, prod"
|
|
71
|
+
default: dev
|
|
72
|
+
workflow_call:
|
|
73
|
+
inputs:
|
|
74
|
+
environment:
|
|
75
|
+
type: string
|
|
76
|
+
description: "Target environment. Allowed values: dev, staging, prod"
|
|
77
|
+
|
|
78
|
+
jobs:
|
|
79
|
+
deploy:
|
|
80
|
+
runs-on: ubuntu-latest
|
|
81
|
+
steps:
|
|
82
|
+
- name: Validate environment input
|
|
83
|
+
run: |
|
|
84
|
+
case "${{ inputs.environment }}" in
|
|
85
|
+
dev|staging|prod) echo "Environment: ${{ inputs.environment }}" ;;
|
|
86
|
+
*) echo "Invalid environment: ${{ inputs.environment }}"; exit 1 ;;
|
|
87
|
+
esac
|
|
88
|
+
- language: yaml
|
|
89
|
+
label: "Alternative: dispatcher wrapper preserves dropdown UI for manual runs"
|
|
90
|
+
code: |
|
|
91
|
+
# dispatcher.yml — manual dispatch wrapper with choice dropdown
|
|
92
|
+
on:
|
|
93
|
+
workflow_dispatch:
|
|
94
|
+
inputs:
|
|
95
|
+
environment:
|
|
96
|
+
type: choice
|
|
97
|
+
options: [dev, staging, prod]
|
|
98
|
+
|
|
99
|
+
jobs:
|
|
100
|
+
dispatch:
|
|
101
|
+
uses: ./.github/workflows/deploy.yml # calls the reusable workflow
|
|
102
|
+
with:
|
|
103
|
+
environment: ${{ inputs.environment }} # passes as string
|
|
104
|
+
prevention:
|
|
105
|
+
- "workflow_call inputs support only: boolean, number, string — not choice or environment"
|
|
106
|
+
- "Use type: string with a description listing allowed values when an input is shared across both triggers"
|
|
107
|
+
- "Add input validation as the first job step to fail fast when an unexpected value is passed via workflow_call"
|
|
108
|
+
- "Run actionlint locally before pushing — it catches unsupported input types at development time"
|
|
109
|
+
docs:
|
|
110
|
+
- url: "https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#onworkflow_callinputs"
|
|
111
|
+
label: "GitHub Docs: on.workflow_call.inputs syntax"
|
|
112
|
+
- url: "https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#onworkflow_dispatchinputs"
|
|
113
|
+
label: "GitHub Docs: on.workflow_dispatch.inputs syntax"
|
|
114
|
+
- url: "https://rhysd.github.io/actionlint/"
|
|
115
|
+
label: "actionlint: static checker for GitHub Actions workflow files"
|
package/package.json
CHANGED