mandrel-platform 0.17.2 → 0.18.0

package/scripts/check-required-contexts.mjs

@@ -17,8 +17,20 @@
  *   node scripts/check-required-contexts.mjs --contract path/to/main-protection.json
  *   node scripts/check-required-contexts.mjs --workflows-dir .github/workflows
  *
+ * Also warns (never blocks) when the caller-naming triplet — the CI workflow
+ * file name, its display `name:`, and the caller job id that wraps the
+ * `pr-quality.yml` call — diverges from the canonical shape documented in
+ * `docs/reusable-workflows.md` (`ci.yml` / `CI` / caller job id `ci`, giving
+ * the required context `ci / ci-required`). Three fleet consumers converged
+ * on three different spellings for the same shared workflow (validated
+ * 2026-07-01: domio `ci-pr.yml` / `CI (PR)`; athportal `quality.yml` /
+ * `quality`; swarm-os `ci.yml` / `CI` with job id `quality`) — this is a
+ * lint nudge toward convergence, not a gate, so existing non-canonical
+ * consumers are never blocked by adopting this script.
+ *
  * Exit codes:
  *   0 — all required contexts are emitted by at least one workflow job
+ *       (regardless of caller-naming warnings — those never affect the exit code)
  *   1 — one or more phantom contexts detected (named in stderr)
  *
  * Consumer adoption:
@@ -36,63 +48,11 @@ import { readFileSync, readdirSync } from "node:fs";
 import { resolve, join, relative } from "node:path";
 
 // ---------------------------------------------------------------------------
-// Arg parsing
+// Repo-root resolution (used by both the CLI entrypoint below and the
+// exported naming-lint helper, which reports paths relative to it)
 // ---------------------------------------------------------------------------
 
-const args = process.argv.slice(2);
-let contractPath = null;
-let workflowsDir = null;
-
-for (let i = 0; i < args.length; i++) {
-  if ((args[i] === "--contract" || args[i] === "-c") && args[i + 1]) {
-    contractPath = args[++i];
-  } else if ((args[i] === "--workflows-dir" || args[i] === "-w") && args[i + 1]) {
-    workflowsDir = args[++i];
-  } else if (args[i] === "--help" || args[i] === "-h") {
-    process.stdout.write(
-      "Usage: node scripts/check-required-contexts.mjs [--contract <path>] [--workflows-dir <dir>]\n"
-    );
-    process.exit(0);
-  }
-}
-
-// Resolve paths relative to the repo root (cwd when invoked from CI or locally).
 const repoRoot = process.cwd();
-const resolvedContract = contractPath
-  ? resolve(contractPath)
-  : resolve(repoRoot, "docs/runbooks/main-protection.json");
-const resolvedWorkflowsDir = workflowsDir
-  ? resolve(workflowsDir)
-  : resolve(repoRoot, ".github/workflows");
-
-// ---------------------------------------------------------------------------
-// Load contract
-// ---------------------------------------------------------------------------
-
-let contract;
-try {
-  const raw = readFileSync(resolvedContract, "utf8");
-  contract = JSON.parse(raw);
-} catch (err) {
-  process.stderr.write(
-    `[check-required-contexts] ERROR: Cannot read contract at ${relative(repoRoot, resolvedContract)}: ${err.message}\n`
-  );
-  process.exit(1);
-}
-
-const requiredContexts = Array.isArray(contract.requiredStatusChecks)
-  ? contract.requiredStatusChecks
-  : [];
-const upstreamJobs = Array.isArray(contract.upstreamJobs)
-  ? contract.upstreamJobs
-  : [];
-
-if (requiredContexts.length === 0) {
-  process.stderr.write(
-    "[check-required-contexts] ERROR: contract.requiredStatusChecks is empty — at least one context is required.\n"
-  );
-  process.exit(1);
-}
 
 // ---------------------------------------------------------------------------
 // Collect job names from all workflow files
@@ -114,7 +74,7 @@ if (requiredContexts.length === 0) {
  *
  * The job ID line is indented by exactly 2 spaces and ends with a colon.
  */
-function extractJobIds(yamlContent) {
+export function extractJobIds(yamlContent) {
   const ids = new Set();
   let inJobsBlock = false;
 
@@ -143,105 +103,263 @@ function extractJobIds(yamlContent) {
   return ids;
 }
 
-let workflowFiles;
-try {
-  workflowFiles = readdirSync(resolvedWorkflowsDir).filter(
-    (f) => f.endsWith(".yml") || f.endsWith(".yaml")
-  );
-} catch (err) {
-  process.stderr.write(
-    `[check-required-contexts] ERROR: Cannot read workflows directory at ${relative(repoRoot, resolvedWorkflowsDir)}: ${err.message}\n`
-  );
-  process.exit(1);
+/**
+ * Extract the workflow's top-level display `name:` (the value GitHub Actions
+ * shows in the UI and uses as the first segment of a workflow_call caller's
+ * status context, e.g. "CI / ci-required"). Returns null when no top-level
+ * `name:` key is present (GitHub then falls back to the file path).
+ *
+ * Only the zero-indentation `name:` key qualifies — job-level `name:` keys
+ * are indented and must not be mistaken for the workflow's own display name.
+ */
+export function extractWorkflowName(yamlContent) {
+  for (const line of yamlContent.split("\n")) {
+    const match = line.match(/^name:\s*(.+?)\s*$/);
+    if (match) {
+      return match[1].replace(/^["']|["']$/g, "");
+    }
+    // Stop scanning once we reach `on:` or `jobs:` — `name:` is always a
+    // top-of-file key in a well-formed workflow, so nothing past those
+    // markers should be mistaken for it.
+    if (/^(on|jobs):\s*$/.test(line)) break;
+  }
+  return null;
 }
 
-if (workflowFiles.length === 0) {
-  process.stderr.write(
-    `[check-required-contexts] ERROR: No workflow files found in ${relative(repoRoot, resolvedWorkflowsDir)}\n`
-  );
-  process.exit(1);
-}
+// ---------------------------------------------------------------------------
+// Canonical caller-naming lint (warn-only — see docs/reusable-workflows.md
+// "Canonical caller naming" for the full rationale and target shape).
+// ---------------------------------------------------------------------------
 
-/** Map from workflow filename → Set<jobId> */
-const workflowJobMap = new Map();
-/** Flat set of all job IDs across all workflows */
-const allJobIds = new Set();
+export const CANONICAL_CALLER = {
+  file: "ci.yml",
+  displayName: "CI",
+  jobId: "ci",
+};
 
-for (const file of workflowFiles) {
-  const filePath = join(resolvedWorkflowsDir, file);
+/**
+ * Non-blocking nudge toward the canonical `ci.yml` / `CI` / `ci` caller
+ * naming triplet (operator decision 2026-07-01, D2). Never affects the exit
+ * code — this is drift *signal*, not a gate, so existing consumers already on
+ * a non-canonical spelling (domio's `ci-pr.yml`, athportal's `quality.yml`,
+ * swarm-os's `quality` job id) are never blocked by adopting this script.
+ */
+export function warnOnNonCanonicalCallerNaming(workflowFiles, workflowJobMap, resolvedWorkflowsDir) {
+  const warnings = [];
+
+  if (!workflowFiles.includes(CANONICAL_CALLER.file)) {
+    warnings.push(
+      `no "${CANONICAL_CALLER.file}" file found in ${relative(repoRoot, resolvedWorkflowsDir)}/ — ` +
+      `the canonical caller file name is "${CANONICAL_CALLER.file}" (found: ${workflowFiles.join(", ")})`
+    );
+    return warnings;
+  }
+
+  const filePath = join(resolvedWorkflowsDir, CANONICAL_CALLER.file);
   let content;
   try {
     content = readFileSync(filePath, "utf8");
-  } catch (err) {
-    process.stderr.write(
-      `[check-required-contexts] WARN: Cannot read ${file}: ${err.message} — skipping.\n`
+  } catch {
+    return warnings;
+  }
+
+  const displayName = extractWorkflowName(content);
+  if (displayName !== CANONICAL_CALLER.displayName) {
+    warnings.push(
+      `${CANONICAL_CALLER.file} display name is "${displayName ?? "(none)"}" — ` +
+      `canonical is "${CANONICAL_CALLER.displayName}"`
     );
-    continue;
   }
-  const ids = extractJobIds(content);
-  workflowJobMap.set(file, ids);
-  for (const id of ids) {
-    allJobIds.add(id);
+
+  const jobIds = workflowJobMap.get(CANONICAL_CALLER.file) ?? new Set();
+  if (!jobIds.has(CANONICAL_CALLER.jobId)) {
+    warnings.push(
+      `${CANONICAL_CALLER.file} has no "${CANONICAL_CALLER.jobId}" job id — ` +
+      `canonical required context is "${CANONICAL_CALLER.jobId} / ci-required" ` +
+      `(found job ids: ${[...jobIds].sort().join(", ") || "(none)"})`
+    );
   }
+
+  return warnings;
 }
 
 // ---------------------------------------------------------------------------
-// Validate required contexts
+// CLI entrypoint (skipped under `node --test` import — see the guard below)
 // ---------------------------------------------------------------------------
 
-const phantomContexts = requiredContexts.filter((ctx) => !allJobIds.has(ctx));
-const phantomUpstream = upstreamJobs.filter((job) => !allJobIds.has(job));
+export function runCli(argv) {
+  // ── Arg parsing ────────────────────────────────────────────────────────
+  let contractPath = null;
+  let workflowsDir = null;
 
-// ---------------------------------------------------------------------------
-// Report
-// ---------------------------------------------------------------------------
+  for (let i = 0; i < argv.length; i++) {
+    if ((argv[i] === "--contract" || argv[i] === "-c") && argv[i + 1]) {
+      contractPath = argv[++i];
+    } else if ((argv[i] === "--workflows-dir" || argv[i] === "-w") && argv[i + 1]) {
+      workflowsDir = argv[++i];
+    } else if (argv[i] === "--help" || argv[i] === "-h") {
+      process.stdout.write(
+        "Usage: node scripts/check-required-contexts.mjs [--contract <path>] [--workflows-dir <dir>]\n"
+      );
+      return 0;
+    }
+  }
 
-const contractRel = relative(repoRoot, resolvedContract);
-const workflowsRel = relative(repoRoot, resolvedWorkflowsDir);
+  // Resolve paths relative to the repo root (cwd when invoked from CI or locally).
+  const resolvedContract = contractPath
+    ? resolve(contractPath)
+    : resolve(repoRoot, "docs/runbooks/main-protection.json");
+  const resolvedWorkflowsDir = workflowsDir
+    ? resolve(workflowsDir)
+    : resolve(repoRoot, ".github/workflows");
 
-process.stdout.write(
-  `[check-required-contexts] Contract : ${contractRel}\n` +
-  `[check-required-contexts] Workflows: ${workflowsRel}/ (${workflowFiles.length} file${workflowFiles.length === 1 ? "" : "s"})\n` +
-  `[check-required-contexts] Emitted job IDs: ${[...allJobIds].sort().join(", ")}\n`
-);
+  // ── Load contract ──────────────────────────────────────────────────────
+  let contract;
+  try {
+    const raw = readFileSync(resolvedContract, "utf8");
+    contract = JSON.parse(raw);
+  } catch (err) {
+    process.stderr.write(
+      `[check-required-contexts] ERROR: Cannot read contract at ${relative(repoRoot, resolvedContract)}: ${err.message}\n`
+    );
+    return 1;
+  }
 
-if (phantomContexts.length > 0) {
-  process.stderr.write(
-    `\n[check-required-contexts] ❌ PHANTOM required contexts detected!\n` +
-    `   These contexts are listed in requiredStatusChecks but no workflow job emits them:\n`
-  );
-  for (const ctx of phantomContexts) {
-    process.stderr.write(`     • "${ctx}"\n`);
+  const requiredContexts = Array.isArray(contract.requiredStatusChecks)
+    ? contract.requiredStatusChecks
+    : [];
+  const upstreamJobs = Array.isArray(contract.upstreamJobs) ? contract.upstreamJobs : [];
+
+  if (requiredContexts.length === 0) {
+    process.stderr.write(
+      "[check-required-contexts] ERROR: contract.requiredStatusChecks is empty — at least one context is required.\n"
+    );
+    return 1;
   }
-  process.stderr.write(
-    `\n   A phantom context will block every PR indefinitely on a "pending" status\n` +
-    `   that never resolves. Fix: either add a workflow job with this exact ID,\n` +
-    `   or remove the context from requiredStatusChecks in ${contractRel}.\n\n`
-  );
-}
 
-if (phantomUpstream.length > 0) {
-  process.stderr.write(
-    `\n[check-required-contexts] ❌ PHANTOM upstream jobs detected!\n` +
-    `   These jobs are listed in upstreamJobs but no workflow defines them:\n`
-  );
-  for (const job of phantomUpstream) {
-    process.stderr.write(`     • "${job}"\n`);
+  // ── Collect job names from all workflow files ─────────────────────────
+  let workflowFiles;
+  try {
+    workflowFiles = readdirSync(resolvedWorkflowsDir).filter(
+      (f) => f.endsWith(".yml") || f.endsWith(".yaml")
+    );
+  } catch (err) {
+    process.stderr.write(
+      `[check-required-contexts] ERROR: Cannot read workflows directory at ${relative(repoRoot, resolvedWorkflowsDir)}: ${err.message}\n`
+    );
+    return 1;
   }
-  process.stderr.write(
-    `\n   Fix: either add the missing job to a workflow, or remove it from\n` +
-    `   upstreamJobs in ${contractRel}.\n\n`
-  );
-}
 
-const hasError = phantomContexts.length > 0 || phantomUpstream.length > 0;
+  if (workflowFiles.length === 0) {
+    process.stderr.write(
+      `[check-required-contexts] ERROR: No workflow files found in ${relative(repoRoot, resolvedWorkflowsDir)}\n`
+    );
+    return 1;
+  }
+
+  /** Map from workflow filename → Set<jobId> */
+  const workflowJobMap = new Map();
+  /** Flat set of all job IDs across all workflows */
+  const allJobIds = new Set();
+
+  for (const file of workflowFiles) {
+    const filePath = join(resolvedWorkflowsDir, file);
+    let content;
+    try {
+      content = readFileSync(filePath, "utf8");
+    } catch (err) {
+      process.stderr.write(
+        `[check-required-contexts] WARN: Cannot read ${file}: ${err.message} — skipping.\n`
+      );
+      continue;
+    }
+    const ids = extractJobIds(content);
+    workflowJobMap.set(file, ids);
+    for (const id of ids) {
+      allJobIds.add(id);
+    }
+  }
+
+  // ── Validate required contexts ─────────────────────────────────────────
+  const phantomContexts = requiredContexts.filter((ctx) => !allJobIds.has(ctx));
+  const phantomUpstream = upstreamJobs.filter((job) => !allJobIds.has(job));
+
+  // ── Report ──────────────────────────────────────────────────────────────
+  const contractRel = relative(repoRoot, resolvedContract);
+  const workflowsRel = relative(repoRoot, resolvedWorkflowsDir);
 
-if (!hasError) {
   process.stdout.write(
-    `[check-required-contexts] ✅ All required contexts and upstream jobs are emitted by CI.\n` +
-    `   requiredStatusChecks : ${requiredContexts.join(", ")}\n` +
-    `   upstreamJobs         : ${upstreamJobs.length > 0 ? upstreamJobs.join(", ") : "(none listed)"}\n`
+    `[check-required-contexts] Contract : ${contractRel}\n` +
+    `[check-required-contexts] Workflows: ${workflowsRel}/ (${workflowFiles.length} file${workflowFiles.length === 1 ? "" : "s"})\n` +
+    `[check-required-contexts] Emitted job IDs: ${[...allJobIds].sort().join(", ")}\n`
   );
+
+  if (phantomContexts.length > 0) {
+    process.stderr.write(
+      `\n[check-required-contexts] ❌ PHANTOM required contexts detected!\n` +
+      `   These contexts are listed in requiredStatusChecks but no workflow job emits them:\n`
+    );
+    for (const ctx of phantomContexts) {
+      process.stderr.write(`     • "${ctx}"\n`);
+    }
+    process.stderr.write(
+      `\n   A phantom context will block every PR indefinitely on a "pending" status\n` +
+      `   that never resolves. Fix: either add a workflow job with this exact ID,\n` +
+      `   or remove the context from requiredStatusChecks in ${contractRel}.\n\n`
+    );
+  }
+
+  if (phantomUpstream.length > 0) {
+    process.stderr.write(
+      `\n[check-required-contexts] ❌ PHANTOM upstream jobs detected!\n` +
+      `   These jobs are listed in upstreamJobs but no workflow defines them:\n`
+    );
+    for (const job of phantomUpstream) {
+      process.stderr.write(`     • "${job}"\n`);
+    }
+    process.stderr.write(
+      `\n   Fix: either add the missing job to a workflow, or remove it from\n` +
+      `   upstreamJobs in ${contractRel}.\n\n`
+    );
+  }
+
+  const namingWarnings = warnOnNonCanonicalCallerNaming(
+    workflowFiles,
+    workflowJobMap,
+    resolvedWorkflowsDir
+  );
+
+  if (namingWarnings.length > 0) {
+    process.stdout.write(
+      `\n[check-required-contexts] ⚠️  Non-canonical CI caller naming (warn-only, does not fail this check):\n`
+    );
+    for (const warning of namingWarnings) {
+      process.stdout.write(`     • ${warning}\n`);
+    }
+    process.stdout.write(
+      `\n   See docs/reusable-workflows.md § "Canonical caller naming" for the\n` +
+      `   target shape (file "${CANONICAL_CALLER.file}", display name "${CANONICAL_CALLER.displayName}",\n` +
+      `   caller job id "${CANONICAL_CALLER.jobId}" → required context "${CANONICAL_CALLER.jobId} / ci-required").\n` +
+      `   Renaming an existing caller is a per-consumer migration, not required by this lint.\n\n`
+    );
+  }
+
+  const hasError = phantomContexts.length > 0 || phantomUpstream.length > 0;
+
+  if (!hasError) {
+    process.stdout.write(
+      `[check-required-contexts] ✅ All required contexts and upstream jobs are emitted by CI.\n` +
+      `   requiredStatusChecks : ${requiredContexts.join(", ")}\n` +
+      `   upstreamJobs         : ${upstreamJobs.length > 0 ? upstreamJobs.join(", ") : "(none listed)"}\n`
+    );
+  }
+
+  return hasError ? 1 : 0;
 }
 
-process.exit(hasError ? 1 : 0);
+// Only run when executed directly, not when imported by the test suite.
+const invokedDirectly =
+  process.argv[1] && resolve(process.argv[1]).endsWith("check-required-contexts.mjs");
+if (invokedDirectly) {
+  process.exit(runCli(process.argv.slice(2)));
+}

package/scripts/check-required-contexts.test.mjs

@@ -0,0 +1,137 @@
+#!/usr/bin/env node
+/**
+ * check-required-contexts.test.mjs — node:test suite for the canonical
+ * CI-caller-naming lint added to check-required-contexts.mjs (Story #173).
+ *
+ * The pre-existing phantom-context checker is exercised end-to-end via the
+ * CLI (see docs/reusable-workflows.md § "Canonical caller naming" for the
+ * target shape this lint nudges consumers toward). This suite covers the
+ * three pure functions the naming lint adds: `extractWorkflowName`,
+ * `extractJobIds` (pre-existing, re-exercised for the new call sites), and
+ * `warnOnNonCanonicalCallerNaming` — all offline, no filesystem beyond a
+ * scratch temp dir for the workflows-dir fixture.
+ *
+ * Run: node scripts/check-required-contexts.test.mjs  (or `node --test scripts/`)
+ */
+
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import {
+  CANONICAL_CALLER,
+  extractJobIds,
+  extractWorkflowName,
+  warnOnNonCanonicalCallerNaming,
+} from "./check-required-contexts.mjs";
+
+// ── extractWorkflowName ─────────────────────────────────────────────────────
+
+test("extractWorkflowName: reads the top-level `name:` key", () => {
+  const yaml = `name: CI\n\non:\n  pull_request:\n    branches: [main]\n\njobs:\n  ci:\n    runs-on: ubuntu-latest\n`;
+  assert.equal(extractWorkflowName(yaml), "CI");
+});
+
+test("extractWorkflowName: strips surrounding quotes", () => {
+  assert.equal(extractWorkflowName('name: "CI (PR)"\non:\n'), "CI (PR)");
+  assert.equal(extractWorkflowName("name: 'quality'\non:\n"), "quality");
+});
+
+test("extractWorkflowName: returns null when no top-level name: is present", () => {
+  const yaml = `on:\n  push:\n    branches: [main]\njobs:\n  build:\n    name: Build\n`;
+  assert.equal(extractWorkflowName(yaml), null);
+});
+
+test("extractWorkflowName: does not mistake a job-level name: for the workflow name", () => {
+  const yaml = `on:\n  push:\njobs:\n  build:\n    name: Build job display name\n`;
+  assert.equal(extractWorkflowName(yaml), null);
+});
+
+// ── extractJobIds (pre-existing behaviour, re-exercised for the new caller) ─
+
+test("extractJobIds: finds the canonical `ci` job id", () => {
+  const yaml = `name: CI\non:\n  pull_request:\njobs:\n  ci:\n    uses: dsj1984/mandrel-platform/.github/workflows/pr-quality.yml@sha\n  ci-required:\n    needs: [ci]\n`;
+  const ids = extractJobIds(yaml);
+  assert.ok(ids.has("ci"));
+  assert.ok(ids.has("ci-required"));
+});
+
+// ── warnOnNonCanonicalCallerNaming ──────────────────────────────────────────
+
+function withTempWorkflowsDir(files, run) {
+  const dir = mkdtempSync(join(tmpdir(), "check-required-contexts-test-"));
+  try {
+    for (const [name, content] of Object.entries(files)) {
+      writeFileSync(join(dir, name), content, "utf8");
+    }
+    return run(dir);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+test("warnOnNonCanonicalCallerNaming: no warnings for the fully canonical shape", () => {
+  withTempWorkflowsDir(
+    {
+      "ci.yml": `name: CI\non:\n  pull_request:\njobs:\n  ci:\n    uses: dsj1984/mandrel-platform/.github/workflows/pr-quality.yml@sha\n  ci-required:\n    needs: [ci]\n`,
+    },
+    (dir) => {
+      const workflowFiles = ["ci.yml"];
+      const workflowJobMap = new Map([["ci.yml", extractJobIds(
+        `name: CI\non:\n  pull_request:\njobs:\n  ci:\n    uses: x\n  ci-required:\n    needs: [ci]\n`
+      )]]);
+      const warnings = warnOnNonCanonicalCallerNaming(workflowFiles, workflowJobMap, dir);
+      assert.deepEqual(warnings, []);
+    }
+  );
+});
+
+test("warnOnNonCanonicalCallerNaming: warns (does not throw) when the caller file is missing", () => {
+  withTempWorkflowsDir({ "quality.yml": "name: quality\non:\njobs:\n  quality:\n" }, (dir) => {
+    const workflowFiles = ["quality.yml"];
+    const workflowJobMap = new Map([["quality.yml", new Set(["quality"])]]);
+    const warnings = warnOnNonCanonicalCallerNaming(workflowFiles, workflowJobMap, dir);
+    assert.equal(warnings.length, 1);
+    assert.match(warnings[0], new RegExp(`no "${CANONICAL_CALLER.file}" file found`));
+  });
+});
+
+test("warnOnNonCanonicalCallerNaming: warns on a non-canonical display name (athportal shape)", () => {
+  withTempWorkflowsDir(
+    { "ci.yml": `name: quality\non:\njobs:\n  ci:\n    uses: x\n` },
+    (dir) => {
+      const workflowFiles = ["ci.yml"];
+      const workflowJobMap = new Map([["ci.yml", new Set(["ci"])]]);
+      const warnings = warnOnNonCanonicalCallerNaming(workflowFiles, workflowJobMap, dir);
+      assert.equal(warnings.length, 1);
+      assert.match(warnings[0], /display name is "quality"/);
+    }
+  );
+});
+
+test("warnOnNonCanonicalCallerNaming: warns on a non-canonical job id (swarm-os shape)", () => {
+  withTempWorkflowsDir(
+    { "ci.yml": `name: CI\non:\njobs:\n  quality:\n    uses: x\n  ci-required:\n    needs: [quality]\n` },
+    (dir) => {
+      const workflowFiles = ["ci.yml"];
+      const workflowJobMap = new Map([["ci.yml", new Set(["quality", "ci-required"])]]);
+      const warnings = warnOnNonCanonicalCallerNaming(workflowFiles, workflowJobMap, dir);
+      assert.equal(warnings.length, 1);
+      assert.match(warnings[0], /has no "ci" job id/);
+    }
+  );
+});
+
+test("warnOnNonCanonicalCallerNaming: warns on both display name and job id together", () => {
+  withTempWorkflowsDir(
+    { "ci.yml": `name: CI (PR)\non:\njobs:\n  build:\n    uses: x\n` },
+    (dir) => {
+      const workflowFiles = ["ci.yml"];
+      const workflowJobMap = new Map([["ci.yml", new Set(["build"])]]);
+      const warnings = warnOnNonCanonicalCallerNaming(workflowFiles, workflowJobMap, dir);
+      assert.equal(warnings.length, 2);
+    }
+  );
+});