ci: repair ci/lint-test/trufflehog workflows (newline-swallow + phantom actions) by KooshaPari · Pull Request #1015 · KooshaPari/cliproxyapi-plusplus

KooshaPari · 2026-06-02T12:45:45Z

Problem

A SHA-pinning pass corrupted 23 of 28 workflow files by swallowing the newline after # vN pin comments — mashing the following line onto the pin and appending a second @sha. Examples:

uses: actions/checkout@<sha1>@<sha2> # v4- name: Initialize CodeQL
uses: github/codeql-action/init@<sha> # v4with:

This makes 18 of them invalid YAML. Several also reference the nonexistent KooshaPari/phenotypeActions reusable-actions repo and the wrong trufflehog/actions path.

This PR (the 3 most important / PR-blocking)

ci.yml — rebuilt the test job (checkout/setup-go/cache/codecov steps were all mashed) and removed the phenotype-validate job that called the nonexistent KooshaPari/phenotypeActions/.github/workflows/validate-governance.yml (also structurally invalid: a job cannot set both uses: and runs-on:).
lint-test.yml — replaced the corrupted checkout + phantom-action step with real inline Go vet + test.
trufflehog.yml — trufflehog/actions/setup@main (nonexistent) → canonical trufflesecurity/trufflehog; fixed the escaped \${{ }} interpolation that never expanded.

All three validated as well-formed YAML locally.

Follow-up

The remaining ~18 corrupted workflow files (auto-merge, codeql, docker-image, docs, generate-sdks, journey-gate, pages-deploy, pr-path-guard, pr-test-build, release*, sast-*, scorecard, security-guard-hook-audit, …) carry the identical newline-swallow corruption and are tracked for a careful follow-up PR (each needs per-file boundary reconstruction; not safe to mass-rush).

Traceability

dom-cli-ax CLI/AX CI coherence — corrupted/phantom workflow references.

🤖 Generated with Claude Code

…om actions) A SHA-pinning pass corrupted many workflows by swallowing the newline after `# vN` pin comments, mashing the next line onto the pin (and appending a second `@sha`). This fixes the three most important / PR-blocking ones: - ci.yml: rebuilt the `test` job (the checkout/setup-go/cache/codecov steps had `@sha@sha` double-pins and `# v4-`/`# v5with:`/`# v3with:` mashed lines), and removed the `phenotype-validate` job that called the nonexistent KooshaPari/phenotypeActions reusable workflow (also invalid: a job cannot set both `uses:` and `runs-on:`). - lint-test.yml: replaced the corrupted checkout+phantom-action step with real inline Go vet+test. - trufflehog.yml: `trufflehog/actions/setup@main` (nonexistent) -> canonical trufflesecurity/trufflehog; fixed the escaped `\${{ }}` token interpolation. All three validated as well-formed YAML. The remaining ~18 workflow files carry the same newline-swallow corruption and are tracked for follow-up. Traces to CLI/AX CI coherence (dom-cli-ax audit). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

gemini-code-assist · 2026-06-02T12:45:52Z

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

coderabbitai · 2026-06-02T12:45:54Z

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 883c4a2d-7dc2-4616-a132-a15795715c10

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Note

`.coderabbit.yaml` has unrecognized properties

CodeRabbit is using all valid settings from your configuration. Unrecognized properties (listed below) have been ignored and may indicate typos or deprecated fields that can be removed.

⚠️ Parsing warnings (1)

Validation error: Unrecognized key: "pre_merge_checks"

⚙️ Configuration instructions

Please see the configuration documentation for more information.
You can also validate your configuration using the online YAML validator.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch dx/rehab-corrupted-workflows

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Same newline-swallow corruption: `# v3with:` had the `with:` mapping mashed onto the pin comment. Split back into a `# v3` pin + a properly-indented `with:` block. Validated as well-formed YAML. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Same newline-swallow corruption from the SHA-pinning pass. Fixed by dropping the spurious second `@sha` pin and restoring the swallowed line/indentation: - ci-rerun-flaky, coderabbit-rate-limit-retry: `# v7with:` -> `# v7` + `with:` - policy-gate, quality-gate, required-check-names-guard, tag-automation: `# v4- name: X` -> `# v4` + a separate `- name: X` step - journey-gate: stray double `@sha@sha` checkout pin -> single pinned `# v4` - release-drafter: `# v6env:` -> `# v6` + `env:` - security-guard-hook-audit: `# v4with:` -> `# v4` + `with:` All nine validated as well-formed YAML. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…ease-batch) Same newline-swallow corruption, including multi-step chains: - codeql: separated the mashed Checkout/Initialize-CodeQL steps and the second `analyze-skip-for-migrated-router-fix` JOB that was swallowed onto an analyze step's pin; restored with:/v4 boundaries. - pages-deploy: three `- uses:` steps (checkout/configure-pages/ upload-pages-artifact) were mashed onto one line; split into three steps. - scorecard: fixed `# v4with:`/`# v2.4.2with:`/`# v3with:` and a double `@sha@sha` upload-artifact pin. - pr-path-guard, release-batch: `# v4with:`/`# v45with:`/`# v5with:` splits. All five validated as well-formed YAML. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Same newline-swallow corruption (with:/env:/if:/`- name:` steps and double `@sha@sha` pins mashed onto `# vN` comments). docs.yml (4 spots incl a swallowed Deploy step + double-sha setup-node), release.yaml (5 spots incl a swallowed `if:` on the gh-release step), generate-sdks.yaml (6 spots incl swallowed Setup Python/Node steps). All validated as well-formed YAML. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Same newline-swallow corruption: separated mashed Checkout/Initialize-CodeQL steps, a swallowed `trivy-repo` JOB boundary, chained `- uses:` step pairs, and swallowed `with:`/`env:`/`if:`/`continue-on-error:` keys across both SAST workflows. All validated as well-formed YAML. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Separated the mashed Checkout/Refresh-models/Set-up-Buildx/Login steps (incl a triple-`- uses:` chain in docker_manifest) and the swallowed `with:` blocks on the login and build-push steps across all three jobs. Validated YAML. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The most heavily corrupted workflow (13 jobs). Fixed the recurring mashed Checkout/Set-up-Go step pairs and swallowed `with:` blocks across all jobs, the double `@sha@sha` checkout/upload-artifact/setup-node pins, and the swallowed `- name: Refresh models catalog` / `Setup Node` steps. Also fixed the `arduino/setup-task` ref, which the SHA-pinning pass had replaced with a literal GitHub API 404 JSON blob — pinned to v2.0.0 (b91d5d2c96a56797b48ac1e0e89220bf64044611). Validated as well-formed YAML. With this, all 25 corrupted workflows in the repo are repaired. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

sonarqubecloud · 2026-06-02T13:09:38Z

Quality Gate failed

Failed conditions
2 Security Hotspots
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

KooshaPari and others added 7 commits June 2, 2026 05:55

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: repair ci/lint-test/trufflehog workflows (newline-swallow + phantom actions)#1015

ci: repair ci/lint-test/trufflehog workflows (newline-swallow + phantom actions)#1015
KooshaPari wants to merge 8 commits into
mainfrom
dx/rehab-corrupted-workflows

KooshaPari commented Jun 2, 2026

Uh oh!

gemini-code-assist Bot commented Jun 2, 2026

Uh oh!

coderabbitai Bot commented Jun 2, 2026 •

edited

Loading

Review skipped

`.coderabbit.yaml` has unrecognized properties

Uh oh!

sonarqubecloud Bot commented Jun 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

KooshaPari commented Jun 2, 2026

Problem

This PR (the 3 most important / PR-blocking)

Follow-up

Traceability

Uh oh!

gemini-code-assist Bot commented Jun 2, 2026

Uh oh!

coderabbitai Bot commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

.coderabbit.yaml has unrecognized properties

Uh oh!

sonarqubecloud Bot commented Jun 2, 2026

Quality Gate failed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Jun 2, 2026 •

edited

Loading

`.coderabbit.yaml` has unrecognized properties