feat: enforce workflow naming, dead-input detection, and template compatibility - #529
feat: enforce workflow naming, dead-input detection, and template compatibility#529mkolasinski-splunk wants to merge 2 commits into
Conversation
…e compat Adds two custom pre-commit hooks (stages: [manual], wired into the repo's own pre-commit CI job so they never run on a local commit): - workflow-hygiene: enforces kebab-case naming on job ids and workflow_call inputs, and flags declared inputs/secrets that are never referenced in the reusable workflow. Addresses the agent-readiness naming_consistency and dead_code_detection Level 2 criteria, which no off-the-shelf GHA tool covers. - template-compat: declares, via .github/template-compatibility.yml, which refs of splunk/addonfactory-repository-template this reusable workflow is compatible with, then fetches each ref's caller workflow and asserts every secret/input it passes is declared here, and every required input is supplied. This already caught a real drift: the template's develop caller still passes GH_TOKEN_ADMIN, which this workflow stopped declaring (being fixed in template PR #919) -- CI here will go red until that PR merges. Also renames the three job ids that deviated from the otherwise consistent kebab-case convention (review_secrets, UI-tests-report, Modinput-tests-report) now that the naming hook enforces it; none are referenced via needs.<id> outputs or branch-protection required-check names, so the rename is safe. Co-Authored-By: Claude <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0105402451
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - name: Run CI-only template compatibility hook | ||
| env: | ||
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | ||
| run: pre-commit run template-compat --hook-stage manual --all-files |
There was a problem hiding this comment.
On pull_request runs where repository/org secrets are available, this step executes pre-commit from the checked-out PR while GH_TOKEN contains a freshly minted GitHub App token for addonfactory-repository-template. A PR can change .pre-commit-config.yaml or scripts/check_template_compat.py so this command runs attacker-controlled code with whatever permissions that app token has on the template repo; run this check only on trusted refs or execute a pinned/base-revision script before exposing the token.
Useful? React with 👍 / 👎.
Closes the Level 1 agent-readiness blockers from the readiness report: routes agents to README/runbooks/scripts, documents all 16 workflow_call secrets, and defines the local validation/build entrypoint and a change-class to validation-depth table. Co-Authored-By: Claude <noreply@anthropic.com>
1 participant
Summary
stages: [manual], run explicitly in.github/workflows/build-test-release.yaml'spre-commitjob — never triggered by a localgit commit), addressing the agent-readiness Level 2naming_consistencyanddead_code_detectioncriteria that no off-the-shelf GitHub Actions tool covers:workflow-hygiene(scripts/check_workflow_hygiene.py): enforces kebab-case naming on job ids andworkflow_callinputs, and flags declared inputs/secrets never referenced in the reusable workflow.template-compat(scripts/check_template_compat.py): reads a new.github/template-compatibility.ymldeclaring which refs ofsplunk/addonfactory-repository-templatethis reusable workflow is compatible with, fetches each ref's caller workflow (adjust/.github/workflows/build-test-release.yml), and asserts every secret/input it passes is declared here and every required input is supplied.review_secrets→review-secrets,UI-tests-report→ui-tests-report,Modinput-tests-report→modinput-tests-report. None are referenced vianeeds.<id>.outputsor known as branch-protection required-check names, so this is safe..github/CODEOWNERSnow covers/scripts/;.gitignoreignores__pycache__/.Important: this will fail CI until a companion template PR merges
template-compatalready found a real, pre-existing drift: the template'sdevelopcaller still passesGH_TOKEN_ADMIN, a secret this reusable workflow already stopped declaring. That's exactly what template PRsplunk/addonfactory-repository-template#919fixes.Until #919 merges, this repo's own
pre-commitCI job will report failure on every push/PR todevelop(by design — the check is honestly reporting the drift). Recommended merge order: merge template PR #919 first, then merge this PR.Test plan
pre-commit run --all-files— confirmsworkflow-hygiene/template-compatdo NOT run at default stage (CI-only, no local-commit friction).pre-commit run workflow-hygiene --hook-stage manual --all-files— passes on the renamed workflow.workflow-hygieneby temporarily injecting a snake_case job id and an unused input — both correctly flagged, then reverted.GH_TOKEN=$(gh auth token) pre-commit run template-compat --hook-stage manual --all-files— correctly fails today with theGH_TOKEN_ADMINdrift described above; will pass once template PR #919 merges.actionlinton both modified workflow files — no new errors (pre-existingclient-id/app-idschema warnings are a local actionlint-version mismatch already present ondevelop, not introduced here; CI's pinned actionlint v1.6.26 doesn't flag them).🤖 Generated with Claude Code