🏗️🔧：stop reading a step's input as an action

[DerekNonGeneric]

Found while reviewing the port of this file into the portal, where the fix landed as 4ec195f.

The visitor matched every uses key in the document, and with: and env: hold names the action being called chose. A step passing an input that happens to be called uses was read as naming an action, so an ordinary workflow failed a check it had no way to satisfy. Those two mappings are skipped now.

Why not narrow the walk instead

The review that found this suggested restricting the visitor to jobs.<job_id>.uses and jobs.<job_id>.steps[*].uses — the two paths GitHub actually executes from. That would open a hole rather than close one.

A step written once under a YAML anchor and aliased into a job is a scalar only where the anchor is defined, which is nowhere near either path; the alias itself is not a scalar for the visitor to read. Tested:

x-defs:
  s: &anchored
    uses: hidden/action@main
jobs:
  j:
    steps:
      - *anchored

The broad walk reports this at the anchor line. Narrowed, it is missed entirely. So the walk stays broad and only the two input mappings are excluded.

How it was checked

One fixture carrying all five cases:

case	result
uses input under with:	ignored ✅
uses input under env:	ignored ✅
actions/setup-node@v4	reported ✅
anchored hidden/action@main	reported ✅
docker://alpine@sha256:…	passes ✅

The five real workflows here still pass; verify.ts clean; no new failures in verify.all. With this the file is byte-identical to the portal's, but for the package name in its import.

Summary by CodeRabbit

• Bug Fixes
  • Improved workflow validation to avoid misinterpreting uses values inside action inputs or environment variables as action references.
  • Continued recognizing valid action references in other workflow locations, including anchored definitions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 4521f9f3-3eac-4245-b872-5220d4ddaaf8

📥 Commits

Reviewing files that changed from the base of the PR and between 09ad280 and abeb66f.

📒 Files selected for processing (1)

• build/tasks/verify/verify-workflows.mts

Included review availability: Your plan provides up to 8 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

The workflow verifier now receives YAML ancestor paths and excludes uses values nested under with or env from action-reference collection. Other YAML locations remain scanned.

Changes

Workflow action reference filtering

Layer / File(s)	Summary
Path-aware uses filtering build/tasks/verify/verify-workflows.mts	The YAML visitor passes ancestor paths. The verifier ignores scalar uses values under with or env and continues to scan other locations, including anchored definitions.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to abeb6

Workflow verification now ignores input and environment values named uses without changing action detection elsewhere, including anchored action definitions. The change is ready to merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main fix: prevent workflow step inputs from being interpreted as action references. It is concise and related to the pull request objectives.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch infra/uses-is-not-always-an-action

---

_{Comment @coderabbitai help to get the list of available commands.}