Objective
Add compile-time glob validation to the workflow compiler using actionlint.ValidateRefGlob() and actionlint.ValidatePathGlob() from the already-available Go API.
Context
From discussion #22839: The workflow compiler generates branch/tag/path glob patterns (e.g., in on.push.branches). These are currently only validated by actionlint at lint time (via Docker). Since github.com/rhysd/actionlint is already a direct Go dependency, we can validate these patterns immediately at compile time — catching errors before even writing the .lock.yml file and without needing Docker. A notable v1.7.11 check is that ./ path filter prefixes (e.g., ./src/**/*.go) are always invalid in GitHub Actions.
Approach
- Identify where the compiler generates or processes glob patterns for
on.push.branches, on.push.tags, on.push.paths, on.pull_request.branches, etc.
- Start in
pkg/workflow/ — likely in the trigger/on-event compilation code
- Import
github.com/rhysd/actionlint and call:
actionlint.ValidateRefGlob(pattern) for branch and tag patternsactionlint.ValidatePathGlob(pattern) for path patterns
- Return validation errors as compiler errors with helpful messages
- Add tests covering valid globs, invalid globs, and the
./ prefix edge case
Files to Modify
- Relevant file(s) in
pkg/workflow/ that compile trigger patterns
- Add test coverage for the new validation
Acceptance Criteria
Generated by Plan Command for issue #discussion #22839 · ◷
Objective
Add compile-time glob validation to the workflow compiler using
actionlint.ValidateRefGlob()andactionlint.ValidatePathGlob()from the already-available Go API.Context
From discussion #22839: The workflow compiler generates branch/tag/path glob patterns (e.g., in
on.push.branches). These are currently only validated by actionlint at lint time (via Docker). Sincegithub.com/rhysd/actionlintis already a direct Go dependency, we can validate these patterns immediately at compile time — catching errors before even writing the.lock.ymlfile and without needing Docker. A notable v1.7.11 check is that./path filter prefixes (e.g.,./src/**/*.go) are always invalid in GitHub Actions.Approach
on.push.branches,on.push.tags,on.push.paths,on.pull_request.branches, etc.pkg/workflow/— likely in the trigger/on-event compilation codegithub.com/rhysd/actionlintand call:actionlint.ValidateRefGlob(pattern)for branch and tag patternsactionlint.ValidatePathGlob(pattern)for path patterns./prefix edge caseFiles to Modify
pkg/workflow/that compile trigger patternsAcceptance Criteria
./-prefixed path patterns are caught at compile timemake test-unitpasses