Repository navigation
feat(pr-risk): use named risk tiers #272
huang47test-workflow-pins.yml
on: pull_request
unittest + lint this repo
14s
Annotations
2 errors and 1 warning
|
unittest + lint this repo:
/tmp/tmp.Gjca8uIiYc/unguarded.yml#L14
unguarded.yml checks out at `ref: ${{ inputs.workflows_ref }}` with no empty-ref guard earlier in the same job. Copy the `Require a pinned workflows_ref` step in ahead of it: `required: true` is unenforced for workflow_call, so an omitted input arrives as '' and checkout silently takes the default branch. See BE-5546.
|
|
unittest + lint this repo:
/tmp/tmp.aCKrlvFfeC/regressed.yml#L8
regressed.yml declares a `default:` for the `workflows_ref` input. Delete it (and keep `required: true` + the runtime empty-ref guard): a default lets a caller SHA-pin `uses:` while loading scripts from a mutable ref. See BE-5546.
|
|
unittest + lint this repo:
/tmp/tmp.D5R0eyBdkx/escaped.yml#L11
escaped.yml job `run`: its `steps:` could not be read as a step sequence (`steps: [ … ]` / an anchor on the key line, or no `- ` item below it), so the dangling-ref check could NOT run for 1 `ref:` site(s) in this job — one per `ref:` LINE, this lint's unit throughout — and they were passed WITHOUT it. This is lost coverage, not a finding: each of those refs may well be fine, and a real earlier step this lint has no claim on would have been dropped anyway; with the pre-scan defeated, a dangling id and that step are indistinguishable here. Rewrite `steps:` as a block sequence (`steps:` then `- uses: … ` items) to restore it. See BE-9045.
|