review

Author: snazy

.github/workflows/check_action_tags.yml

@@ -24,12 +24,20 @@ on:
     branches:
       - main
     paths:
-      - ".github/workflows/dummy.yml"
+      - ".github/workflows/check_action_tags.yml"
+      - ".github/workflows/update.yml"
+      - ".github/actions/for-dependabot-triggered-reviews/action.yml"
+      - "actions.yml"
+      - "approved_patterns.yml"
+      - "gateway/**"
   pull_request:
     paths:
-      - ".github/workflows/update_actions.yml"
-      - ".github/workflows/dummy.yml"
-      - gateway/*
+      - ".github/workflows/check_action_tags.yml"
+      - ".github/workflows/update.yml"
+      - ".github/actions/for-dependabot-triggered-reviews/action.yml"
+      - "actions.yml"
+      - "approved_patterns.yml"
+      - "gateway/**"
 
 permissions:
   contents: read

README.md

@@ -273,8 +273,9 @@ Two workflows in `.github/workflows/` run `verify-action-build` on PRs that touc
 
 - **`verify` job in `verify_dependabot_action.yml`** — triggers on Dependabot PRs that modify `.github/actions/for-dependabot-triggered-reviews/action.yml`. Extracts the action reference from the PR, rebuilds the compiled JavaScript in Docker, and compares it against the published version.
 - **`verify` job in `verify_manual_action.yml`** — triggers on human-authored PRs that modify `actions.yml` or `approved_patterns.yml` (i.e. manual allow-list additions / version bumps). Dependabot-authored PRs are skipped, since they are already covered by the workflow above.
+- **`check_action_tags` job in `check_action_tags.yml`** — triggers when `actions.yml`, `approved_patterns.yml`, the generated Dependabot composite action, the update workflow, or gateway verification code changes. It verifies that configured action SHAs exist and, when a `tag` is recorded, that the SHA is reachable from that Git tag or branch.
 
-Both workflows use a regular `pull_request` trigger with read-only permissions and no PR comments — pass/fail is surfaced through the status check. Neither workflow auto-approves or merges; a human reviewer must still approve.
+These workflows use regular `pull_request` triggers with read-only permissions and no PR comments — pass/fail is surfaced through the status check. They do not auto-approve or merge; a human reviewer must still approve.
 
 The script exits with code **1** (failure) when something is unexpectedly broken — for example, the action cannot be compiled, the rebuilt JavaScript is invalid, or required tools are missing. In all other cases it exits with code **0** and produces reviewable diffs: a large diff does not by itself cause an error (e.g. major version bumps will naturally have big diffs). It is always up to a human reviewer to inspect the output, assess the changes, and decide whether the update is safe to approve.
 

gateway/action_tags.py

@@ -85,7 +85,7 @@ def _gh_api_get(url_abspath: str) -> ApiResponse:
     # Unauthorized GH API requests are quite rate-limited.
     # Tip: add an extra space before 'export' to prevent adding the line to the shell history.
     #    export GH_TOKEN=$(gh auth token)
-    gh_token = os.environ['GH_TOKEN']
+    gh_token = os.environ.get('GH_TOKEN')
     if gh_token:
         headers['Authorization'] = f"Bearer {gh_token}"
     req_url = f"https://api.github.com{url_abspath}"
@@ -120,7 +120,7 @@ def _gh_compare(owner_repo: str, tag: str, requested_sha: str) -> ApiResponse:
     requested_sha = urllib.parse.quote(requested_sha, safe="")
     return _gh_api_get(f"/repos/{owner_repo}/compare/{requested_sha}...{tag}")
 
-def verify_actions(actions: Path | ActionsYAML | str, log_to_console: bool = True, today: date = date.today()) -> ActionTagsCheckResult:
+def verify_actions(actions: Path | ActionsYAML | str, log_to_console: bool = True, today: date | None = None) -> ActionTagsCheckResult:
     """
     Validates the contents of the actions file against GitHub.
 
@@ -152,9 +152,12 @@ def verify_actions(actions: Path | ActionsYAML | str, log_to_console: bool = Tru
         log_to_console: Whether to log messages immediately to the console (default: True)
         today: The current date (default: today)
     """
+    if today is None:
+        today = date.today()
+
     if on_gha():
         print(f"::group::Verify GitHub Actions")
-        gh_token = os.environ['GH_TOKEN']
+        gh_token = os.environ.get('GH_TOKEN')
         if not gh_token or len(gh_token) == 0:
             raise Exception("GH_TOKEN environment variable is not set or empty")
 
@@ -280,7 +283,6 @@ def verify_actions(actions: Path | ActionsYAML | str, log_to_console: bool = Tru
                         result.warning(f"GitHub action {name} references an invalid Git SHA but 'ignore_invalid_git_sha' is set: will ignore invalid Git SHA '{ref}'", "  ..")
                     else:
                         result.failure(f"GitHub action {name} references an invalid Git SHA '{ref}'", "  ..")
-                        raise Exception("foo")
 
             for req_tag, req_shas in requested_shas_by_tag.items():
                 result.log(f"  .. checking tag '{req_tag}'")
@@ -377,7 +379,7 @@ def verify_actions(actions: Path | ActionsYAML | str, log_to_console: bool = Tru
                     f.write('```\n')
                     for msg in result.warnings:
                         f.write(f"{msg}\n\n")
-                f.write('```\n')
+                    f.write('```\n')
                 f.write(f"## Log\n")
                 f.write('```\n')
                 for msg in result.logs:

gateway/run_action_tags.py

@@ -20,7 +20,7 @@
 
 # Helper script to run the action tag verification.
 #
-# You must have a GH_TOKEN environment variable set to a GitHub PAT w/ read accessto public repos.
+# You must have a GH_TOKEN environment variable set to a GitHub PAT w/ read access to public repos.
 #
 # From a local environment use:
 #       uvx --with ruyaml python gateway/run_action_tags.py
@@ -36,7 +36,7 @@
 
 def run_main():
     if not 'GH_TOKEN' in os.environ:
-        raise Exception("GH_TOKEN environment variable should be must.")
+        raise Exception("GH_TOKEN environment variable must be set.")
 
     cwd = Path(os.getcwd())
     dummy_workflow = cwd / ".github/actions/for-dependabot-triggered-reviews/action.yml"
@@ -46,6 +46,8 @@ def run_main():
     if not dummy_workflow.exists() or not actions_yaml.exists() or not approved_patterns_yaml.exists():
         raise Exception(f"Missing required files: {dummy_workflow.absolute()}, {actions_yaml.absolute()}, {approved_patterns_yaml.absolute()}")
 
+    # Keep the verification inputs in sync with the generated allowlist artifacts
+    # before checking tags, matching the update workflow's behavior.
     update_actions(dummy_workflow, actions_yaml)
     update_patterns(approved_patterns_yaml, actions_yaml)
 

gateway/test_action_tags.py

@@ -63,6 +63,20 @@ def test_sha_non_existent():
     ]
     assert result.warnings == []
 
+def test_invalid_sha_records_failure_without_crashing():
+    # noinspection PyTypeChecker
+    result = verify_actions({
+        "dtolnay/rust-toolchain": {
+            "stable": {
+            },
+        },
+    })
+
+    assert result.failures == [
+        "GitHub action dtolnay/rust-toolchain references an invalid Git SHA 'stable'"
+    ]
+    assert result.warnings == []
+
 @pytest.mark.skipif(os.environ.get('GH_TOKEN') is None, reason="GH_TOKEN environment variable should be set for this test as it issues GitHub API requests.")
 def test_tag_sha_vs_commit_sha():
     # noinspection PyTypeChecker
@@ -195,6 +209,59 @@ def test_branch_compare_api_failure():
     ]
     assert result.warnings == []
 
+def test_branch_compare_api_failure_can_be_ignored():
+    with (
+        mock.patch("action_tags._gh_matching_tags", return_value=_api_response(200, "[]")),
+        mock.patch("action_tags._gh_get_branch", return_value=_api_response(200, "{}")),
+        mock.patch(
+            "action_tags._gh_compare",
+            return_value=_api_response(500, "compare failed", "Internal Server Error"),
+        ),
+    ):
+        # noinspection PyTypeChecker
+        result = verify_actions({
+            "dtolnay/rust-toolchain": {
+                DTOLNAY_RUST_TOOLCHAIN_SHA: {
+                    "tag": "stable",
+                    "ignore_gh_api_errors": True,
+                },
+            },
+        })
+
+    assert result.failures == []
+    assert result.warnings == [
+        "ignore_gh_api_errors is set to true: will ignore GH API errors for action "
+        f"dtolnay/rust-toolchain ref '{DTOLNAY_RUST_TOOLCHAIN_SHA}'",
+        "Failed to find Git SHA "
+        f"'{DTOLNAY_RUST_TOOLCHAIN_SHA}' on Git branch 'stable' in GitHub repo "
+        "'https://github.com/dtolnay/rust-toolchain': HTTP/500: Internal Server Error, "
+        "API URL: https://api.github.test\ncompare failed",
+    ]
+
+def test_branch_lookup_api_failure_can_be_ignored():
+    with (
+        mock.patch("action_tags._gh_matching_tags", return_value=_api_response(200, "[]")),
+        mock.patch("action_tags._gh_get_branch", return_value=_api_response(500, "branch failed", "Internal Server Error")),
+    ):
+        # noinspection PyTypeChecker
+        result = verify_actions({
+            "dtolnay/rust-toolchain": {
+                DTOLNAY_RUST_TOOLCHAIN_SHA: {
+                    "tag": "stable",
+                    "ignore_gh_api_errors": True,
+                },
+            },
+        })
+
+    assert result.failures == []
+    assert result.warnings == [
+        "ignore_gh_api_errors is set to true: will ignore GH API errors for action "
+        f"dtolnay/rust-toolchain ref '{DTOLNAY_RUST_TOOLCHAIN_SHA}'",
+        "Failed to check Git branch 'stable' against GitHub repo "
+        "'https://github.com/dtolnay/rust-toolchain': HTTP/500: Internal Server Error, "
+        "API URL: https://api.github.test\nbranch failed",
+    ]
+
 def test_missing_branch_falls_back_to_missing_tag_failure():
     with (
         mock.patch("action_tags._gh_matching_tags", return_value=_api_response(200, "[]")),