Skip to content

Emitted .lock.yml fails actionlint with 6 errors (copilot-requests scope, concurrency.queue) #1827

New issue
New issue
Closed
#1854
Closed
Emitted .lock.yml fails actionlint with 6 errors (copilot-requests scope, concurrency.queue)#1827
#1854
Labels
gh-awGitHub Agentic Workflows integrationgo:needs-researchNeeds investigationpriority:p0Blocking releasesquadSquad triage inbox — Lead will assign to a membertriagedIssue has been triagedtype:bugSomething brokenwave:1-nextWave 1 — immediate next sprint
Milestone
M2 — E2E verdict

Description

@bradygaster
bradygaster
opened on Aug 21, 2026

Problem

The .lock.yml emitted by gh-aw compilation fails actionlint with 6 errors. Observed during an empirical cold start against a throwaway repo (run 32520171517).

Errors observed

Two distinct classes:

  1. copilot-requests permission scope — not recognized by actionlint's schema.
  2. concurrency.queue — not a valid key under concurrency in the GitHub Actions workflow schema.

Why it matters

The emitted lock file is the artifact that actually runs. A workflow that does not lint clean is a workflow whose validity is being asserted rather than verified — and it means actionlint cannot be used as a gate on generated output, because it is already red for reasons unrelated to any given change.

That is the same shape as the other findings from this session: a check that cannot distinguish "broken" from "expected noise" provides no signal. Per .squad/decisions.md:604, a gate that is permanently red is equivalent to no gate.

Open question

Whether these are genuine defects in the emitted YAML, or actionlint schema gaps for newer GitHub features (copilot-requests in particular may be legitimately new). That distinction should be resolved first — the fix is different in each case:

  • If emitted YAML is wrong → fix the compiler.
  • If actionlint is behind → pin an actionlint config / ignore list scoped to exactly these two keys, so the remaining 4 errors still gate.

Do not suppress all 6 without determining which bucket each falls into. Blanket suppression would remove the signal entirely.

Related

Also found in the same cold start, worth handling together if someone is already in this area:

  • The documented git add line drops .github/aw/actions-lock.json, so a user following the docs commits an incomplete activation.
  • Three default-token scope gaps observed during activation.

These are smaller and may fold into the same PR.

Owners

FIDO (lint gate) with EECOM (compiler, if the emitted YAML is at fault).

Activity

  1. bradygaster
    added
    gh-awGitHub Agentic Workflows integration
    type:bugSomething broken
    priority:p1This sprint
    wave:1-nextWave 1 — immediate next sprint
    squad:booster
    triagedIssue has been triaged
    on Aug 23, 2026
  2. github-actions
    added
    squadSquad triage inbox — Lead will assign to a member
    on Aug 23, 2026
  3. bradygaster
    added
    go:needs-researchNeeds investigation
    on Aug 23, 2026

  4. bradygaster commented on Aug 23, 2026

    @bradygaster
    bradygaster
    on Aug 23, 2026
    CollaboratorAuthor

    1. Owner & rationale

    Owner: squad:booster. This is generated workflow validity plus CI/lint gating, which sits with Booster; EECOM may need to review if classification shows compiler-emitted YAML is invalid.

    Labels reconciled as: gh-aw, type:bug, priority:p1, wave:1-next, squad:booster, triaged, go:needs-research because the first task is to classify each actionlint diagnostic as real emitted-YAML invalidity vs actionlint schema lag.

    2. Files in scope

    Verified existing paths:

    • workflows/squad.md
    • workflows/squad-implement-worker.md
    • .github/actionlint.yaml
    • test/gh-aw-quality.test.ts
    • test/workflows.test.cjs

    3. Reproduction / measurement

    These commands were execution-tested and use no output suppression. They fetch the emitted lock from the cold-start repo into a project-local scratch path, then run actionlint directly without gh-aw's ignore list:

    New-Item -ItemType Directory -Force -Path .squad\\triage-work | Out-Null
gh api repos/bradygaster/squad-coldstart-scratch-2026-08-21/contents/.github/workflows/squad.lock.yml -H "Accept: application/vnd.github.raw" | Out-File -FilePath .squad\\triage-work\squad.lock.yml -Encoding utf8
docker run --rm -v "${PWD}:/workdir" -w /workdir rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667 -shellcheck= -pyflakes= .squad/triage-work/squad.lock.yml

    The current fetched lock reproduces the two reported classes (copilot-requests, concurrency.queue). The issue reports six diagnostics in the original emitted set; classify the current emitted set rather than assuming the count.

    4. Verification bar

    A regenerated .lock.yml must either pass direct actionlint with no project-specific suppression, or fail only on a minimal, documented ignore list where each ignored diagnostic is proven to be actionlint schema lag. The gate must remain capable of failing on any other invalid generated YAML.

    5. Traps

    Do not blanket-suppress all six reported errors. Classify each diagnostic first: concurrency.queue looks like compiler-emitted invalid YAML unless GitHub Actions has a matching schema extension; copilot-requests may be actionlint schema lag. The fixes differ, and broad suppression destroys the remaining signal.

    6. Out of scope

    Do not rewrite unrelated workflow prompts, change runtime permissions beyond the classified fix, or turn this into a general actionlint cleanup. Related doc/git-add and token-scope gaps noted in the issue body should be separate follow-ups unless the same line is already being touched.

    7. Session-stall guard

    Before starting: this repo has phantom CRLF diffs (#1793). If git status shows files modified that you did not touch, run git diff --ignore-cr-at-eol. If that output is empty, the diff is line-ending churn, not real edits — run git add --renormalize . and continue. Do not halt and ask for confirmation; halting on phantom diffs is the documented cause of stuck sessions in this repo.

  5. bradygaster
    added
    priority:p0Blocking release
    and removed
    priority:p1This sprint
    on Aug 24, 2026
  6. bradygaster
    added this to the M2 — E2E verdict milestone on Aug 24, 2026
  7. bradygaster
    closed this as completedin #1854on Aug 24, 2026
  8. bradygaster
    added a commit that references this issue on Aug 24, 2026

    fix(ci): scope an SC2016 suppression and restore its coverage by test

    2390557
  9. q-qp-p
    added a commit that references this issue on Aug 25, 2026

    fix(ci): lint gh-aw generated workflows instead of skipping them (git…

    cd02b72
  10. bradygaster
    removed
    squad:booster
    on Sep 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    gh-awGitHub Agentic Workflows integrationgo:needs-researchNeeds investigationpriority:p0Blocking releasesquadSquad triage inbox — Lead will assign to a membertriagedIssue has been triagedtype:bugSomething brokenwave:1-nextWave 1 — immediate next sprint

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions