.agents/skills/workflow-ci-contract/SKILL.md's ## After Any Workflow Edit section names one local check:
Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint
scripts/docker_lint.py scopes actionlint to .github/workflows/*.yml and .github/workflows/*.yaml, and .github/workflows/validate-*.yml scopes the CI step the same way. A composite action at .github/actions/<hook>/action.yml is therefore validated by nothing, locally or in CI, and this repository carries nine of them.
The command still exits zero over a change set containing none of the edited lines, so an agent that edits only a composite action runs the check the skill names, reads a clean result, and reports the edit locally verified. That is worse than no check, since the green result is evidence of nothing.
This surfaced now because #1207's fix adds .github/actions/ to the skill's trigger description, which is correct on its own terms: D1.3 carries a rule that applies only inside a composite action, inputs.smoke != 'true', whose inputs are strings. The skill now fires on an edit it cannot tell the agent how to verify.
Two things would close it, and they are separable. The narrow one is a sentence in the skill saying what does and does not cover a composite action, so a reader stops reading a clean actionlint run as coverage. The wider one is actual coverage, whether by widening the linter's scope where the tool supports it or by naming another check.
Deferred out of the pull request settling #1225, #1208 and #1207, whose file list did not include the linter or the workflows.
Related: #1207.
.agents/skills/workflow-ci-contract/SKILL.md's## After Any Workflow Editsection names one local check:scripts/docker_lint.pyscopes actionlint to.github/workflows/*.ymland.github/workflows/*.yaml, and.github/workflows/validate-*.ymlscopes the CI step the same way. A composite action at.github/actions/<hook>/action.ymlis therefore validated by nothing, locally or in CI, and this repository carries nine of them.The command still exits zero over a change set containing none of the edited lines, so an agent that edits only a composite action runs the check the skill names, reads a clean result, and reports the edit locally verified. That is worse than no check, since the green result is evidence of nothing.
This surfaced now because #1207's fix adds
.github/actions/to the skill's trigger description, which is correct on its own terms: D1.3 carries a rule that applies only inside a composite action,inputs.smoke != 'true', whose inputs are strings. The skill now fires on an edit it cannot tell the agent how to verify.Two things would close it, and they are separable. The narrow one is a sentence in the skill saying what does and does not cover a composite action, so a reader stops reading a clean actionlint run as coverage. The wider one is actual coverage, whether by widening the linter's scope where the tool supports it or by naming another check.
Deferred out of the pull request settling #1225, #1208 and #1207, whose file list did not include the linter or the workflows.
Related: #1207.