chore: validate workflow YAML in the pre-commit hook - #265
Merged
Conversation
A broken workflow does not fail CI — it silently stops running, so its checks disappear rather than turn red, and release-only workflows are not exercised by a pull request at all. dicechess-engine-scala had publish.yaml and release.yaml invalid on main for hours with every check green (see that repo's #542). Negative tested: the command exits non-zero on a workflow with that exact defect, and passes on this repo's existing workflows. Ruby ships with macOS and the runners, so this adds no tooling and costs milliseconds.
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@lefthook.yml`:
- Around line 25-27: Update the pre-commit jobs documentation in development.md
to include workflow-yaml alongside betterleaks and scalafmt, matching the job
configured in lefthook.yml. Preserve the existing documentation structure and
descriptions for the other jobs.
- Around line 25-27: Update the workflow-yaml hook in lefthook.yml to remove its
dependency on the unprovisioned Ruby YAML parser, or add a pinned Ruby
installation to mise.toml and supported workflow environments. Ensure
contributors can run this pre-commit validation with the documented toolchain.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 96ff648f-e93d-447d-90da-b57755c9472f
📒 Files selected for processing (1)
lefthook.yml
Addresses both CodeRabbit findings on #265. Ruby was an undeclared dependency: mise.toml provisions only JVM tooling and CLI utilities, and no workflow installs Ruby, so a contributor without it could not commit workflow changes. This repo is public, so that is a real barrier. actionlint is pinned in mise.toml, so `mise install` provides it like every other tool, and it is strictly stronger than the previous check: it rejects the same invalid indentation AND catches duplicate keys, which a plain YAML load accepts silently. Verified both — the malformed-step fixture and a duplicate-key fixture are each rejected, and this repo's own workflows pass. `-shellcheck=` disables the optional shell lint of `run:` bodies. actionlint picks shellcheck up from PATH when present, and a mise shim with no version installed makes it abort with a fatal error, so leaving it off keeps this job dependent on actionlint and nothing else. Also documents the job in development.md, which listed only betterleaks and scalafmt.
github-actions
Bot
added
documentation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
workflow-yamlpre-commit job that parses staged.github/workflows/*.y*ml.A broken workflow does not fail CI — it silently stops running, so its checks disappear rather than turn red, and release-only workflows are not exercised by a pull request at all, so nothing surfaces until a release. This happened for real in
dicechess-engine-scala: an editing mistake leftpublish.yamlandrelease.yamlinvalid onmainfor hours with every check green (rabestro/dicechess-engine-scala#542).Same job, same wording as the one added there, so the hook config stays consistent across repos.
Verification
lefthook validate→All good, and the job shows up inpre-commit- name:with an out-dentedrun:) — a guard never seen failing is not a guardlefthook.ymlchanged, one insertionRuby ships with macOS and the GitHub runners, so this needs no new tooling and costs milliseconds.
🤖 Generated with Claude Code