ci: fix workflow YAML syntax errors blocking CI on main#68
Conversation
Root cause: 7 workflow files in .github/workflows/ contained invalid YAML
that GitHub Actions could not parse, causing every push and pull_request
to fail before any job could run. GitHub surfaces this as:
This run likely failed because of a workflow file issue.
Two distinct defects were present, often in the same file:
1. actions/checkout SHA pins were written without the '@' separator,
e.g. 'actions/checkout11bd71901bbe5b1630ceea73d27597364c9af683'
instead of 'actions/checkout@<sha>'. The SHA itself (which is a valid
v4 commit pin) was preserved verbatim; only the missing '@' was added.
2. Several files declared the 'on:' key twice (once at the top in inline
or block form, and again later in the body). YAML's last-write-wins
semantics hides this from most parsers, but GitHub Actions rejects
workflows with duplicate top-level keys. The two declarations were
merged into a single block that preserves the union of triggers.
scorecard.yml additionally had a duplicate 'permissions:' top-level
key (the second instance was an overbroad 'read-all'). This was
replaced with the explicit least-privilege scopes the analysis job
needs (contents: read, actions: read, security-events: write,
id-token: write), matching the job-level permissions block.
Files changed:
.github/workflows/cargo-audit.yml (duplicate 'on:' merged)
.github/workflows/cargo-machete.yml (added '@' to checkout)
.github/workflows/cargo-semver-checks.yml (added '@' to checkout)
.github/workflows/doc-links.yml (duplicate 'on:' merged + '@')
.github/workflows/fr-coverage.yml (duplicate 'on:' merged + '@')
.github/workflows/quality-gate.yml (duplicate 'on:' merged + '@')
.github/workflows/scorecard.yml (duplicate 'permissions:' fixed + '@')
Verified locally with strict YAML loader (no duplicate top-level keys),
all actions/checkout pins resolve to v4, cargo fmt/clippy/test/build
all pass with zero warnings, cargo deny and cargo audit report no issues.
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
📝 WalkthroughSummaryThis PR fixes critical YAML syntax errors in seven GitHub Actions workflow files ( Changes OverviewFiles Modified (7 total):
Net Changes: +18 insertions, -22 deletions Defects Fixed
Verification✓ All 13 workflow files pass strict YAML validation AssessmentThis is a low-risk, high-impact fix addressing blocking CI failures. The changes are purely syntactic corrections with no functional logic modifications. No Rust code is affected. Recommendation: Approve — This PR should merge without further changes. WalkthroughSix GitHub Actions workflow files receive two categories of fixes: malformed ChangesCI Workflow Trigger and Action Reference Fixes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
❌ The last analysis has failed. |
codeant-ai
Bot
added
the
size:S
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/doc-links.yml:
- Line 17: In the `.github/workflows/doc-links.yml` file, replace the commit SHA
in the `actions/checkout` action with a proper version tag. Change the action
reference from `actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683` to
either `actions/checkout@v4` (for the major version tag) or
`actions/checkout@v4.2.2` (for the specific version tag). This improves
maintainability and makes it easier to track version updates, as GitHub
recommends using version tags instead of commit SHAs.
In @.github/workflows/scorecard.yml:
- Around line 14-16: The workflow-level permissions in the scorecard.yml file
currently include write permissions (security-events: write and id-token: write)
which should be restricted per security best practices. Remove these two write
permissions from the workflow-level permissions section and move them to the
job-level permissions block instead. Keep the workflow-level permissions
restricted to read-only access (contents: read and actions: read) following the
principle of least privilege, and grant the write permissions only where
specifically needed at the job level in the scorecard job definition.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 899f0bc6-fdae-4552-999d-e035a7a28ffd
📒 Files selected for processing (7)
.github/workflows/cargo-audit.yml.github/workflows/cargo-machete.yml.github/workflows/cargo-semver-checks.yml.github/workflows/doc-links.yml.github/workflows/fr-coverage.yml.github/workflows/quality-gate.yml.github/workflows/scorecard.yml
📜 Review details
⏰ Context from checks skipped due to timeout. (4)
- GitHub Check: Analyze Rust
- GitHub Check: Cargo Audit
- GitHub Check: Analyze (rust)
- GitHub Check: semgrep-cloud-platform/scan
🧰 Additional context used
🪛 zizmor (1.26.1)
.github/workflows/cargo-semver-checks.yml
[warning] 19-19: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
.github/workflows/cargo-machete.yml
[warning] 24-24: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
.github/workflows/doc-links.yml
[warning] 17-17: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[info] 14-14: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
.github/workflows/fr-coverage.yml
[warning] 16-16: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[info] 13-13: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
.github/workflows/scorecard.yml
[warning] 15-15: overly broad permissions (excessive-permissions): security-events: write is overly broad at the workflow level
(excessive-permissions)
[error] 16-16: overly broad permissions (excessive-permissions): id-token: write is overly broad at the workflow level
(excessive-permissions)
[warning] 14-14: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
.github/workflows/quality-gate.yml
[warning] 18-18: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[info] 14-14: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
🔇 Additional comments (9)
.github/workflows/cargo-audit.yml (1)
12-15: LGTM!.github/workflows/doc-links.yml (1)
4-13: LGTM!.github/workflows/fr-coverage.yml (2)
4-12: LGTM!
16-16: LGTM!.github/workflows/quality-gate.yml (2)
4-12: LGTM!
18-18: LGTM!.github/workflows/cargo-machete.yml (1)
24-24: LGTM!.github/workflows/cargo-semver-checks.yml (1)
19-19: LGTM!.github/workflows/scorecard.yml (1)
29-29: LGTM!
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout11bd71901bbe5b1630ceea73d27597364c9af683 # v4 | ||
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔵 Trivial
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify the checkout action SHA pin is valid for v4
gh api repos/actions/checkout/commits/11bd71901bbe5b1630ceea73d27597364c9af683 --jq '.sha, .commit.message' 2>/dev/null || echo "SHA verification requires network access"
# Check if this commit is on the v4 branch/tag
gh api repos/actions/checkout/commits/11bd71901bbe5b1630ceea73d27597364c9af683/branches-where-head --jq '.[].name' 2>/dev/null || echo "Branch check requires network access"Repository: KooshaPari/rich-cli-kit
Length of output: 320
🌐 Web query:
actions/checkout v4 tag SHA 11bd71901bbe5b1630ceea73d27597364c9af683 github release
💡 Result:
The SHA 11bd71901bbe5b1630ceea73d27597364c9af683 corresponds to the release of version v4.2.2 of the actions/checkout GitHub action [1][2]. This commit, titled "Prepare 4.2.2 Release" (#1953), was merged on October 23, 2024 [1][2]. Key changes included in this version: - The url-helper.ts file was updated to leverage well-known environment variables [1][2]. - Unit test coverage for isGhes was expanded [1][2]. You can reference this specific release or commit in your workflow configuration if needed, although it is generally recommended to use the tagged version (e.g., actions/checkout@v4.2.2) or the major version tag (e.g., actions/checkout@v4) for stability and security [3][4].
Citations:
- 1: actions/checkout@v4.1.7...11bd719
- 2: actions/checkout@d632683...11bd719
- 3: https://github.com/actions/checkout
- 4: https://github.com/actions/checkout/blob/v4/README.md
Checkout action format is valid but consider using version tags instead of commit SHAs.
The @ separator is correct, making actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 syntactically valid. However, this SHA corresponds to v4.2.2, not the generic v4 tag. While pinning to a specific commit is secure, GitHub recommends using major version tags (v4) or specific version tags (v4.2.2) for better maintainability and easier tracking of updates.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 17-17: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/doc-links.yml at line 17, In the
`.github/workflows/doc-links.yml` file, replace the commit SHA in the
`actions/checkout` action with a proper version tag. Change the action reference
from `actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683` to either
`actions/checkout@v4` (for the major version tag) or `actions/checkout@v4.2.2`
(for the specific version tag). This improves maintainability and makes it
easier to track version updates, as GitHub recommends using version tags instead
of commit SHAs.
| actions: read | ||
| security-events: write | ||
| id-token: write |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify the complete workflow-level permissions block in scorecard.yml
echo "=== Workflow-level permissions block ==="
sed -n '/^permissions:/,/^[a-z]/p' .github/workflows/scorecard.yml | head -n -1
echo -e "\n=== Checking for contents: read ==="
rg -n "^\s+contents:\s+read" .github/workflows/scorecard.yml | head -5Repository: KooshaPari/rich-cli-kit
Length of output: 373
Move security-events: write and id-token: write to job-level permissions instead of workflow level.
The workflow-level permissions currently include contents: read, actions: read, security-events: write, and id-token: write. Per GitHub Actions security best practices and the pattern demonstrated in crates/klipdot/.github/workflows/scorecard.yml, workflow-level permissions should be restricted to read-only (or use read-all). Grant specific write permissions only at the job level to follow the principle of least privilege.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 15-15: overly broad permissions (excessive-permissions): security-events: write is overly broad at the workflow level
(excessive-permissions)
[error] 16-16: overly broad permissions (excessive-permissions): id-token: write is overly broad at the workflow level
(excessive-permissions)
[warning] 14-14: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/scorecard.yml around lines 14 - 16, The workflow-level
permissions in the scorecard.yml file currently include write permissions
(security-events: write and id-token: write) which should be restricted per
security best practices. Remove these two write permissions from the
workflow-level permissions section and move them to the job-level permissions
block instead. Keep the workflow-level permissions restricted to read-only
access (contents: read and actions: read) following the principle of least
privilege, and grant the write permissions only where specifically needed at the
job level in the scorecard job definition.
Source: Linters/SAST tools
1 participant
User description
ci: fix workflow YAML syntax errors blocking CI on main
Root cause
Seven workflow files in
.github/workflows/contained invalid YAML that GitHubActions could not parse, so every
pushandpull_requestfailed before anyjob could run. GitHub surfaces this as:
Two distinct defects were present, often in the same file.
1.
actions/checkoutSHA pins were written without the@separatorThe SHA itself (
11bd71901bbe5b1630ceea73d27597364c9af683) is a validactions/checkout@v4commit pin and was preserved verbatim; only the missing@was added.2. Several files declared the
on:key twice — once at the top in inlineor block form, and again later in the body. YAML's last-write-wins semantics
hides this from most parsers, but GitHub Actions rejects workflows with
duplicate top-level keys. The two declarations were merged into a single block
that preserves the union of triggers (
workflow_dispatch,pushtomain,pull_request, and any scheduled cron entries where present).3.
scorecard.ymladditionally had a duplicatepermissions:top-level key(the second instance was an overbroad
read-allscope, which would grantall read scopes including
packages,pages,discussions, etc.).Replaced with the explicit least-privilege scopes the analysis job needs
(
contents: read,actions: read,security-events: write,id-token: write), matching the job-levelpermissions:block.Files changed
.github/workflows/cargo-audit.ymlon:merged.github/workflows/cargo-machete.yml@to checkout pin.github/workflows/cargo-semver-checks.yml@to checkout pin.github/workflows/doc-links.ymlon:merged +@added.github/workflows/fr-coverage.ymlon:merged +@added.github/workflows/quality-gate.ymlon:merged +@added.github/workflows/scorecard.ymlpermissions:fixed +@added7 files changed, 18 insertions(+), 22 deletions(-)— net smaller.Local checks (all green)
actions/checkoutpins resolve to v4 SHAcargo fmt --all -- --checkcargo clippy --all-targets --all-features -- -D warningscargo test --workspacecargo build --releasecargo deny checkcargo audit --no-fetchScope
This PR is intentionally narrow: it does not delete any files, does not
reformat unrelated YAML, and does not touch
Cargo.toml, application source,or any pre-existing tag-pinned actions in
release-attestation.yml/trufflehog.yml(those don't run onpush/pull_requesttomain).The
Journey Gateworkflow failure on main is a separate, pre-existing issueunrelated to this fix — it requires the external
phenotype-journeytoolwhich is not available in the CI environment. That is out of scope here.
CodeAnt-AI Description
Fix workflow syntax so CI runs again on pushes and pull requests
What Changed
Impact
✅ CI runs on main and pull requests again✅ Fewer workflow parse failures✅ Cleaner security scan permissions💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.