Files
wrkflw/crates/validators/src
Gokul ebabe6414a feat(validate): cross-check local composite action required inputs (#78)
* feat(validate): cross-check local composite action required inputs

The validate command was happily declaring workflows "valid" even
when they used a local composite action without providing its
required inputs. The workflow would then blow up at runtime, which
is *exactly* the kind of thing a validator should catch.

The problem was that validate_action_reference() only checked
whether the local action path existed on disk. It never bothered
to read the action.yml, look at the inputs section, or verify
that required inputs were actually provided in the step's `with:`
block. So it was doing about half its job.

Thread the repo root path through the validator call chain
(evaluate_workflow_file → validate_jobs → validate_steps →
validate_action_reference) so we can resolve local action paths.
Then read and parse the action.yml, extract inputs with
`required: true` and no default, and flag any that are missing
from the step's `with:` params. Case-insensitive matching because
that's what GitHub Actions does.

Graceful degradation: if we can't find the repo root or the
action file is unreadable, we silently skip rather than blowing
up. 10 new unit tests cover the various cases.

Closes #67

* fix(validate): handle string `required` and drop unsafe cwd fallback

Two bugs in the local action input validation that just landed:

First, `find_repo_root` was falling back to `current_dir()` when no
`.git` directory was found. This is *wrong* — if you're validating a
workflow outside a git repo, the cwd could be literally anywhere, and
you'd end up resolving local action paths against some random
directory. Return `None` and skip the check instead.

Second, `required: 'true'` (as a YAML string) was silently treated as
not required, because we only checked `as_bool()`. GitHub Actions
treats the string "true" as truthy, so we should too. Add
case-insensitive string matching alongside the bool check.

While at it, add a test for the string `required` case so we don't
regress on this.
2026-04-02 13:49:47 +05:30
..
2025-08-09 17:03:03 +05:30