[Safe Outputs Conformance] USE-001: Standardize error codes across 4 safe-output handlers

[github-actions]

Conformance Check Failure

Check ID: USE-001
Severity: LOW (grouped — 4 handlers)
Category: Usability

Problem Description

The daily Safe Outputs conformance run reports four USE-001 findings. These handlers throw errors or call core.setFailed using plain new Error(...) strings without the standardized error-code prefixes defined in actions/setup/js/error_codes.cjs (ERR_VALIDATION, ERR_PERMISSION, ERR_API, ERR_CONFIG, ERR_NOT_FOUND, ERR_PARSE, ERR_SYSTEM). Standardized prefixes make failures greppable and consistent for users and tooling.

Affected Components

• actions/setup/js/create_code_scanning_alert.cjs — e.g. line 92 throw new Error("Failed to write file ...") → I/O error (ERR_SYSTEM)
• actions/setup/js/load_experiment_state_from_repo.cjs — lines 122/146/174 directory & file I/O throws (ERR_SYSTEM); API path via octokit.rest.repos.getContent should use ERR_API/ERR_NOT_FOUND
• actions/setup/js/safe_outputs_bootstrap.cjs — line 71 throw new Error(message) (classify as ERR_CONFIG/ERR_VALIDATION)
• actions/setup/js/safe_outputs_config.cjs — line 76 directory-creation throw (ERR_SYSTEM); config-parse failures should use ERR_CONFIG/ERR_PARSE

🔍 Current vs Expected Behavior

Current Behavior

These handlers throw errors like:

throw new Error(`Failed to write file ${sarifFilePath}: ${String(err)}`, { cause: err });

with no standardized error-code prefix. The USE-001 detector requires a match for E[0-9]{3}|ERROR_|ERR_.

Expected Behavior

Errors should be prefixed with a standardized code from error_codes.cjs, e.g.:

const { ERR_SYSTEM } = require("./error_codes.cjs");
throw new Error(`${ERR_SYSTEM}: Failed to write file ${sarifFilePath}: ${String(err)}`, { cause: err });

Remediation Steps

Suitable for a Copilot coding agent:

1. In each handler above, require the appropriate constants from ./error_codes.cjs.
2. Prefix each throw new Error(...) / core.setFailed(...) message with the matching code: I/O and git → ERR_SYSTEM; config/env → ERR_CONFIG; input validation → ERR_VALIDATION; GitHub API → ERR_API; missing resource → ERR_NOT_FOUND; JSON/NDJSON parse → ERR_PARSE.
3. Keep the existing { cause: err } chaining and message text intact; only add the prefix.
4. Check the boxes above as each file is updated.

Verification

After remediation, verify the fix by running:

bash scripts/check-safe-outputs-conformance.sh

Check USE-001 should PASS (All handlers use standardized error codes).

References

• Standardized codes: actions/setup/js/error_codes.cjs
• Safe Outputs Specification: docs/src/content/docs/specs/safe-outputs-specification.md
• Conformance Checker: scripts/check-safe-outputs-conformance.sh
• Run ID: 29676471968
• Date: 2026-07-19

Generated by ✅ Daily Safe Outputs Conformance Checker · 86.7 AIC · ⌖ 13.3 AIC · ⊞ 6.6K · ◷

• expires on Jul 19, 2026, 10:35 PM UTC-08:00