chore: align with j4k-align 17.17.1 #18

jercik · 2026-11-04T06:42:07Z

jercik commented

2026-11-04 06:42:07 +00:00

Adds j4k-align's baked-Node guard before every actions/setup-node step in the checks, dedupe-check and release workflows. The guard fails the job when its image does not already bake the Node version in .node-version (26.13.0), so setup-node never downloads Node from GitHub.

The same repair updates the commit-msg workflow and scripts/check-msg.sh to align 17.17.1, including a header-rejection message that lists the allowed types.

After this repair, align's audit is clean. The tsconfig drift, refused typed-lint solution and typecheck findings it reported before are gone without changes to those files.

Adds j4k-align's baked-Node guard before every `actions/setup-node` step in the checks, dedupe-check and release workflows. The guard fails the job when its image does not already bake the Node version in `.node-version` (26.13.0), so setup-node never downloads Node from GitHub. The same repair updates the commit-msg workflow and `scripts/check-msg.sh` to align 17.17.1, including a header-rejection message that lists the allowed types. After this repair, align's audit is clean. The tsconfig drift, refused typed-lint solution and `typecheck` findings it reported before are gone without changes to those files.

jercik added 1 commit

2026-11-04 06:42:07 +00:00

chore: align with j4k-align 17.17.1

Checks / reuse (pull_request) Has been skipped

Details

commit-msg / same-repo-pr (pull_request) Has been skipped

Details

commit-msg / commitlint (pull_request) Successful in 4s

Details

Checks / quality-checks (pull_request) Successful in 24s

Details

Checks / qc-result (pull_request) Has been skipped

Details

Review / Review (pull_request_target) Successful in 8m41s

Details

50827e4233

forgejo-actions commented

2026-11-04 06:50:49 +00:00

Review 01M6JMPF0GAKSXRDCWWY4PWWPS — head 50827e423386afe86b8276eb45ac5770d218eeab

Review — j4k-oss/askpplx @ `79e3d6fe57`

Scope: diff against base tree ad8b94c112f5
Review finished: 6 succeeded, 0 failed, 4 skipped by dispatch
Triage: settled
Facts: current review-wide projection

Computed under:

{
  "abandonment": "abandonment-v1",
  "anchor_recipe": 1,
  "batch_policy": "batch-v1",
  "coverage": "coverage-v3",
  "dispatch_policy": "dispatch-v2",
  "grounder_version": 1,
  "grounding_read_rule": "grounding-read-v1",
  "promotion_policy": "promotion-v1",
  "report": "report-v5",
  "tally": "tally-v1",
  "triage_settle": "triage-settle-v2"
}

Findings (2)

medium — The 28-line baked-Node policy step is pasted verbatim into checks.yml, dedupe-check.yml and release.yml

claim: 01M6JMXKY02WPD5EYVEJNF73R9
anchor: .forgejo/workflows/checks.yml (snippet)

      - name: Require the job image's baked Node
        env:
          REQUIRED_NODE_VERSION_FILE: ".node-version"

lens: aposd-plain · arm: default
verdicts: 1 valid / 0 invalid / 0 uncertain
- pass 01M6JMZAGJE9Q8RVB6EDW3P93S · valid: Grounded (exact) anchor confirms the baked-Node step with REQUIRED_NODE_VERSION_FILE in checks.yml. Reviewer reports the diff adds the identical step body to checks.yml, dedupe-check.yml and release.yml. They quote the shared pieces: the version-shape case pattern, the tool-cache marker path with a hard-coded x64, and the j4k-align/j4k/cluster remediation text. Three copies of a ~28-line shell policy that must change together, with nothing comparing them, is the Repetition red flag, and the diff adds it, so it is in scope. That the baked-pnpm step is already triplicated shows precedent, not a refutation. The open template question does not hold up: the reviewer says review.yml carries a 'Rendered by j4k-align' header and these three files do not, so there is no evidence of an upstream renderer. The error text pointing to concerns fixing the pin, not regenerating the workflow. The extra point about naming .node-version twice per job is minor but follows from the same structure. The proposed remedy is reasonable: one local composite action or one script that reads the pin from the same input setup-node uses. Medium fits because the maintenance cost spans three files.
disposition: none

Every rule of the baked-Node policy now has three homes: the version-shape case pattern ("" | *[!0-9.]* | .* | *. | *..* | *.*.*.*) exact=false), the tool-cache marker path ${RUNNER_TOOL_CACHE:-/opt/hostedtoolcache}/node/$version/x64.complete, and the remediation text naming j4k-align --fix and j4k/cluster node_ci_node_versions. A later change to any of them (an arm64 runner, a different cache layout, a renamed remediation) must be made identically in three files. A missed copy is not caught: that workflow keeps either failing or passing on the old rule, and nothing compares the copies. This is the Repetition red flag. The step also restates the .node-version decision. Each job names the file twice, once in this step's env and once in actions/setup-node's node-version-file: ".node-version". If only one of the two names changes, the check approves a different version than setup-node installs, which defeats the step's purpose of stopping a GitHub download.

The diff adds the identical step body after Setup pnpm in checks.yml, dedupe-check.yml and release.yml. Each copy sets only REQUIRED_NODE_VERSION_FILE: ".node-version". The neighbouring Check for baked pnpm step is already triplicated the same way, so the change extends an existing pattern rather than starting one.

Correction: give the policy one home, either a local composite action (for example .forgejo/actions/baked-node) or a script under scripts/ called by all three jobs. That home should read the pin from the same input that feeds setup-node, so the file name is stated once per job.

I compared the three added hunks in the diff and the subject files, grepped .forgejo for REQUIRED_NODE and node-version, and found no composite action or shared script. Not verified: whether j4k-align renders these three workflows from one template. review.yml carries a Rendered by j4k-align header, but checks.yml, dedupe-check.yml and release.yml do not; the error text tells users to run j4k-align --fix. If a single upstream template generates all three copies, the duplication is managed upstream and this finding belongs to that template, not to this repository.

low — Baked-Node step accepts a REQUIRED_NODE_VERSION input that no job sets, plus an exactly-one guard to arbitrate it

claim: 01M6JMXWNTRM57R8W9YCJ997PC
anchor: .forgejo/workflows/checks.yml (snippet)

if [ -n "${REQUIRED_NODE_VERSION:-}" ] && [ -z "${REQUIRED_NODE_VERSION_FILE:-}" ]; then

lens: aposd-plain · arm: default
verdicts: 1 valid / 0 invalid / 0 uncertain
- pass 01M6JMZAGJE9Q8RVB6EDW3P93S · valid: Grounded (exact) anchor confirms the selector branch . Reviewer reports, from a grep of the subject tree, that all three copies set only REQUIRED_NODE_VERSION_FILE. That leaves the inline-version branch and the 'exactly one of' error branch unreachable in every job. The step is inline workflow shell, not a shared module with other callers, so the generality buys nothing and every reader of three workflows pays for it. The repository's AGENTS.md rule the reviewer quotes ('No parameter or option no caller passes') applies directly. The Overexposure label fits loosely: readers carry the cost, not callers. The supported defect is still an unused option plus extra nonobvious code. The external-template caveat is not supported by evidence: these files lack the 'Rendered by j4k-align' header that review.yml carries. The correction keeps the version-shape and tool-cache checks while reading .node-version directly. If claim ...R9's single-home fix is adopted, that home should take only the file input. Low severity is appropriate.
disposition: none

About a third of each copy of the step is interface that no caller in this repository uses. Readers of three workflows have to parse a two-way input contract and an "exactly one of" error branch, but every job always takes the same path. This is the Overexposure red flag, and AGENTS.md rules it out directly: "No parameter or option no caller passes".

The step opens with if [ -n "${REQUIRED_NODE_VERSION:-}" ] && [ -z "${REQUIRED_NODE_VERSION_FILE:-}" ], then an elif for the file case, then echo "::error::The baked Node check needs exactly one of REQUIRED_NODE_VERSION and REQUIRED_NODE_VERSION_FILE.". In checks.yml, dedupe-check.yml and release.yml the only env entry is REQUIRED_NODE_VERSION_FILE: ".node-version". No workflow sets REQUIRED_NODE_VERSION, so the first branch and the error branch never run. The pin variable exists only so the messages can name whichever of the two inputs was used.

Correction: read .node-version directly (version="$(cat .node-version)", with the messages naming .node-version) and drop the selector and its error branch. Keep the version-shape and tool-cache checks unchanged.

I grepped the subject tree for REQUIRED_NODE_VERSION. The only hits are inside the three added steps, and each sets only the _FILE variant. Not verified: whether j4k-align renders this step from a shared template for other repositories that pin Node inline. In that case the template's callers are external, the option has real users, and only the rendering of an unused branch here is the cost.

Other claims

grounding-pending (0)
ungrounded (0)
rejected (0)
duplicate-of (0)
unadjudicated (0)

Coverage

Coverage pass: 01M6JMPF0KXS83CMXHZK4XQDBG
Accounting: complete (all slots terminal; see slot results for failures)
Slot health: healthy

lens	part	arm	unit status	runs	loss
general-bug	whole	default	no-claims	1	no
writing-quality	whole	default	no-claims	1	no
restated-sets	whole	default	no-claims	1	no
unix-cli	whole	default	no-claims	1	no
module-design	whole	default	no-claims	1	no
aposd-plain	whole	default	claims-emitted	1	no

test-trimming — skipped-by-dispatch: no tests changed
project-docs — skipped-by-dispatch: no project documentation changed
use-effect — skipped-by-dispatch: no React code changed
react — skipped-by-dispatch: no React code changed

**Review** `01M6JMPF0GAKSXRDCWWY4PWWPS` — head `50827e423386afe86b8276eb45ac5770d218eeab` # Review — j4k-oss/askpplx @ 79e3d6fe572e Scope: diff against base tree `ad8b94c112f5` Review finished: 6 succeeded, 0 failed, 4 skipped by dispatch Triage: settled Facts: current review-wide projection Computed under: ```json { "abandonment": "abandonment-v1", "anchor_recipe": 1, "batch_policy": "batch-v1", "coverage": "coverage-v3", "dispatch_policy": "dispatch-v2", "grounder_version": 1, "grounding_read_rule": "grounding-read-v1", "promotion_policy": "promotion-v1", "report": "report-v5", "tally": "tally-v1", "triage_settle": "triage-settle-v2" } ``` ## Findings (2) ### medium — The 28-line baked-Node policy step is pasted verbatim into checks.yml, dedupe-check.yml and release.yml - claim: `01M6JMXKY02WPD5EYVEJNF73R9` - anchor: `.forgejo/workflows/checks.yml` (snippet) ``` - name: Require the job image's baked Node env: REQUIRED_NODE_VERSION_FILE: ".node-version" ``` - lens: aposd-plain · arm: default - verdicts: 1 valid / 0 invalid / 0 uncertain - pass `01M6JMZAGJE9Q8RVB6EDW3P93S` · valid: Grounded (exact) anchor confirms the baked-Node step with REQUIRED_NODE_VERSION_FILE in checks.yml. Reviewer reports the diff adds the identical step body to checks.yml, dedupe-check.yml and release.yml. They quote the shared pieces: the version-shape case pattern, the tool-cache marker path with a hard-coded x64, and the j4k-align/j4k/cluster remediation text. Three copies of a ~28-line shell policy that must change together, with nothing comparing them, is the Repetition red flag, and the diff adds it, so it is in scope. That the baked-pnpm step is already triplicated shows precedent, not a refutation. The open template question does not hold up: the reviewer says review.yml carries a 'Rendered by j4k-align' header and these three files do not, so there is no evidence of an upstream renderer. The error text pointing to concerns fixing the pin, not regenerating the workflow. The extra point about naming .node-version twice per job is minor but follows from the same structure. The proposed remedy is reasonable: one local composite action or one script that reads the pin from the same input setup-node uses. Medium fits because the maintenance cost spans three files. - disposition: none > Every rule of the baked-Node policy now has three homes: the version-shape `case` pattern (`"" | *[!0-9.]* | .* | *. | *..* | *.*.*.*) exact=false`), the tool-cache marker path `${RUNNER_TOOL_CACHE:-/opt/hostedtoolcache}/node/$version/x64.complete`, and the remediation text naming `j4k-align --fix` and `j4k/cluster node_ci_node_versions`. A later change to any of them (an arm64 runner, a different cache layout, a renamed remediation) must be made identically in three files. A missed copy is not caught: that workflow keeps either failing or passing on the old rule, and nothing compares the copies. This is the Repetition red flag. The step also restates the `.node-version` decision. Each job names the file twice, once in this step's `env` and once in `actions/setup-node`'s `node-version-file: ".node-version"`. If only one of the two names changes, the check approves a different version than setup-node installs, which defeats the step's purpose of stopping a GitHub download. > > The diff adds the identical step body after `Setup pnpm` in checks.yml, dedupe-check.yml and release.yml. Each copy sets only `REQUIRED_NODE_VERSION_FILE: ".node-version"`. The neighbouring `Check for baked pnpm` step is already triplicated the same way, so the change extends an existing pattern rather than starting one. > > Correction: give the policy one home, either a local composite action (for example `.forgejo/actions/baked-node`) or a script under `scripts/` called by all three jobs. That home should read the pin from the same input that feeds setup-node, so the file name is stated once per job. > > I compared the three added hunks in the diff and the subject files, grepped `.forgejo` for `REQUIRED_NODE` and `node-version`, and found no composite action or shared script. Not verified: whether j4k-align renders these three workflows from one template. review.yml carries a `Rendered by j4k-align` header, but checks.yml, dedupe-check.yml and release.yml do not; the error text tells users to run `j4k-align --fix`. If a single upstream template generates all three copies, the duplication is managed upstream and this finding belongs to that template, not to this repository. ### low — Baked-Node step accepts a REQUIRED_NODE_VERSION input that no job sets, plus an exactly-one guard to arbitrate it - claim: `01M6JMXWNTRM57R8W9YCJ997PC` - anchor: `.forgejo/workflows/checks.yml` (snippet) ``` if [ -n "${REQUIRED_NODE_VERSION:-}" ] && [ -z "${REQUIRED_NODE_VERSION_FILE:-}" ]; then ``` - lens: aposd-plain · arm: default - verdicts: 1 valid / 0 invalid / 0 uncertain - pass `01M6JMZAGJE9Q8RVB6EDW3P93S` · valid: Grounded (exact) anchor confirms the selector branch . Reviewer reports, from a grep of the subject tree, that all three copies set only REQUIRED_NODE_VERSION_FILE. That leaves the inline-version branch and the 'exactly one of' error branch unreachable in every job. The step is inline workflow shell, not a shared module with other callers, so the generality buys nothing and every reader of three workflows pays for it. The repository's AGENTS.md rule the reviewer quotes ('No parameter or option no caller passes') applies directly. The Overexposure label fits loosely: readers carry the cost, not callers. The supported defect is still an unused option plus extra nonobvious code. The external-template caveat is not supported by evidence: these files lack the 'Rendered by j4k-align' header that review.yml carries. The correction keeps the version-shape and tool-cache checks while reading .node-version directly. If claim ...R9's single-home fix is adopted, that home should take only the file input. Low severity is appropriate. - disposition: none > About a third of each copy of the step is interface that no caller in this repository uses. Readers of three workflows have to parse a two-way input contract and an "exactly one of" error branch, but every job always takes the same path. This is the Overexposure red flag, and AGENTS.md rules it out directly: "No parameter or option no caller passes". > > The step opens with `if [ -n "${REQUIRED_NODE_VERSION:-}" ] && [ -z "${REQUIRED_NODE_VERSION_FILE:-}" ]`, then an `elif` for the file case, then `echo "::error::The baked Node check needs exactly one of REQUIRED_NODE_VERSION and REQUIRED_NODE_VERSION_FILE."`. In checks.yml, dedupe-check.yml and release.yml the only `env` entry is `REQUIRED_NODE_VERSION_FILE: ".node-version"`. No workflow sets `REQUIRED_NODE_VERSION`, so the first branch and the error branch never run. The `pin` variable exists only so the messages can name whichever of the two inputs was used. > > Correction: read `.node-version` directly (`version="$(cat .node-version)"`, with the messages naming `.node-version`) and drop the selector and its error branch. Keep the version-shape and tool-cache checks unchanged. > > I grepped the subject tree for `REQUIRED_NODE_VERSION`. The only hits are inside the three added steps, and each sets only the `_FILE` variant. Not verified: whether j4k-align renders this step from a shared template for other repositories that pin Node inline. In that case the template's callers are external, the option has real users, and only the rendering of an unused branch here is the cost. ## Other claims - grounding-pending (0) - ungrounded (0) - rejected (0) - duplicate-of (0) - unadjudicated (0) ## Coverage Coverage pass: 01M6JMPF0KXS83CMXHZK4XQDBG Accounting: complete (all slots terminal; see slot results for failures) Slot health: healthy | lens | part | arm | unit status | runs | loss | | --- | --- | --- | --- | --- | --- | | general-bug | whole | default | no-claims | 1 | no | | writing-quality | whole | default | no-claims | 1 | no | | restated-sets | whole | default | no-claims | 1 | no | | unix-cli | whole | default | no-claims | 1 | no | | module-design | whole | default | no-claims | 1 | no | | aposd-plain | whole | default | claims-emitted | 1 | no | - test-trimming — skipped-by-dispatch: no tests changed - project-docs — skipped-by-dispatch: no project documentation changed - use-effect — skipped-by-dispatch: no React code changed - react — skipped-by-dispatch: no React code changed

🚀 1

forgejo-actions reviewed

2026-11-04 06:50:49 +00:00

.forgejo/workflows/checks.yml

Lines 184-186

					
				@ -181,6 +181,36 @@ jobs:

				        if: steps.baked-pnpm.outputs.match != 'true'

				        uses: pnpm/action-setup@v5

				      - name: Require the job image's baked Node

				        env:

				          REQUIRED_NODE_VERSION_FILE: ".node-version"

medium — The 28-line baked-Node policy step is pasted verbatim into checks.yml, dedupe-check.yml and release.yml

Every rule of the baked-Node policy now has three homes: the version-shape case pattern ("" | *[!0-9.]* | .* | *. | *..* | *.*.*.*) exact=false), the tool-cache marker path ${RUNNER_TOOL_CACHE:-/opt/hostedtoolcache}/node/$version/x64.complete, and the remediation text naming j4k-align --fix and j4k/cluster node_ci_node_versions. A later change to any of them (an arm64 runner, a different cache layout, a renamed remediation) must be made identically in three files. A missed copy is not caught: that workflow keeps either failing or passing on the old rule, and nothing compares the copies. This is the Repetition red flag. The step also restates the .node-version decision. Each job names the file twice, once in this step's env and once in actions/setup-node's node-version-file: ".node-version". If only one of the two names changes, the check approves a different version than setup-node installs, which defeats the step's purpose of stopping a GitHub download.

The diff adds the identical step body after Setup pnpm in checks.yml, dedupe-check.yml and release.yml. Each copy sets only REQUIRED_NODE_VERSION_FILE: ".node-version". The neighbouring Check for baked pnpm step is already triplicated the same way, so the change extends an existing pattern rather than starting one.

Correction: give the policy one home, either a local composite action (for example .forgejo/actions/baked-node) or a script under scripts/ called by all three jobs. That home should read the pin from the same input that feeds setup-node, so the file name is stated once per job.

I compared the three added hunks in the diff and the subject files, grepped .forgejo for REQUIRED_NODE and node-version, and found no composite action or shared script. Not verified: whether j4k-align renders these three workflows from one template. review.yml carries a Rendered by j4k-align header, but checks.yml, dedupe-check.yml and release.yml do not; the error text tells users to run j4k-align --fix. If a single upstream template generates all three copies, the duplication is managed upstream and this finding belongs to that template, not to this repository.

lens aposd-plain · arm default · tally 1 valid / 0 invalid / 0 uncertain
claim 01M6JMXKY02WPD5EYVEJNF73R9 of review 01M6JMPF0GAKSXRDCWWY4PWWPS

**medium** — The 28-line baked-Node policy step is pasted verbatim into checks.yml, dedupe-check.yml and release.yml > Every rule of the baked-Node policy now has three homes: the version-shape `case` pattern (`"" | *[!0-9.]* | .* | *. | *..* | *.*.*.*) exact=false`), the tool-cache marker path `${RUNNER_TOOL_CACHE:-/opt/hostedtoolcache}/node/$version/x64.complete`, and the remediation text naming `j4k-align --fix` and `j4k/cluster node_ci_node_versions`. A later change to any of them (an arm64 runner, a different cache layout, a renamed remediation) must be made identically in three files. A missed copy is not caught: that workflow keeps either failing or passing on the old rule, and nothing compares the copies. This is the Repetition red flag. The step also restates the `.node-version` decision. Each job names the file twice, once in this step's `env` and once in `actions/setup-node`'s `node-version-file: ".node-version"`. If only one of the two names changes, the check approves a different version than setup-node installs, which defeats the step's purpose of stopping a GitHub download. > > The diff adds the identical step body after `Setup pnpm` in checks.yml, dedupe-check.yml and release.yml. Each copy sets only `REQUIRED_NODE_VERSION_FILE: ".node-version"`. The neighbouring `Check for baked pnpm` step is already triplicated the same way, so the change extends an existing pattern rather than starting one. > > Correction: give the policy one home, either a local composite action (for example `.forgejo/actions/baked-node`) or a script under `scripts/` called by all three jobs. That home should read the pin from the same input that feeds setup-node, so the file name is stated once per job. > > I compared the three added hunks in the diff and the subject files, grepped `.forgejo` for `REQUIRED_NODE` and `node-version`, and found no composite action or shared script. Not verified: whether j4k-align renders these three workflows from one template. review.yml carries a `Rendered by j4k-align` header, but checks.yml, dedupe-check.yml and release.yml do not; the error text tells users to run `j4k-align --fix`. If a single upstream template generates all three copies, the duplication is managed upstream and this finding belongs to that template, not to this repository. lens `aposd-plain` · arm `default` · tally 1 valid / 0 invalid / 0 uncertain claim `01M6JMXKY02WPD5EYVEJNF73R9` of review `01M6JMPF0GAKSXRDCWWY4PWWPS`

👎 1

Not a defect in this repository: these copies are generated, not hand-maintained. j4k-align renders the guard into every Forgejo workflow from one source, src/template-scripts/baked-node-check-script.ts (align #1060), through {{templateScript "baked-node-check"}} in each workflow template. These workflow files are align-managed: before this PR, align 17.17.1's audit reported each of them as "Managed artifact is drifted", and j4k-align --fix overwrites any local edit, so a change to the policy is made once in align and reaches every copy on the next repair. Align's src/workflow-baked-node.test.ts also asserts, for every template, that the guard's env names the same input (.node-version or the inline version) that the following actions/setup-node step receives, so the two names cannot diverge. A composite action or script here would be one more managed file with the same single source.

Not a defect in this repository: these copies are generated, not hand-maintained. j4k-align renders the guard into every Forgejo workflow from one source, `src/template-scripts/baked-node-check-script.ts` (align #1060), through `{{templateScript "baked-node-check"}}` in each workflow template. These workflow files are align-managed: before this PR, align 17.17.1's audit reported each of them as "Managed artifact is drifted", and `j4k-align --fix` overwrites any local edit, so a change to the policy is made once in align and reaches every copy on the next repair. Align's `src/workflow-baked-node.test.ts` also asserts, for every template, that the guard's env names the same input (`.node-version` or the inline version) that the following `actions/setup-node` step receives, so the two names cannot diverge. A composite action or script here would be one more managed file with the same single source.

jercik marked this conversation as resolved

.forgejo/workflows/checks.yml

					
				@ -184,0 +186,4 @@

				          REQUIRED_NODE_VERSION_FILE: ".node-version"

				        run: |

				          set -eu

				          if [ -n "${REQUIRED_NODE_VERSION:-}" ] && [ -z "${REQUIRED_NODE_VERSION_FILE:-}" ]; then

low — Baked-Node step accepts a REQUIRED_NODE_VERSION input that no job sets, plus an exactly-one guard to arbitrate it

About a third of each copy of the step is interface that no caller in this repository uses. Readers of three workflows have to parse a two-way input contract and an "exactly one of" error branch, but every job always takes the same path. This is the Overexposure red flag, and AGENTS.md rules it out directly: "No parameter or option no caller passes".

The step opens with if [ -n "${REQUIRED_NODE_VERSION:-}" ] && [ -z "${REQUIRED_NODE_VERSION_FILE:-}" ], then an elif for the file case, then echo "::error::The baked Node check needs exactly one of REQUIRED_NODE_VERSION and REQUIRED_NODE_VERSION_FILE.". In checks.yml, dedupe-check.yml and release.yml the only env entry is REQUIRED_NODE_VERSION_FILE: ".node-version". No workflow sets REQUIRED_NODE_VERSION, so the first branch and the error branch never run. The pin variable exists only so the messages can name whichever of the two inputs was used.

Correction: read .node-version directly (version="$(cat .node-version)", with the messages naming .node-version) and drop the selector and its error branch. Keep the version-shape and tool-cache checks unchanged.

I grepped the subject tree for REQUIRED_NODE_VERSION. The only hits are inside the three added steps, and each sets only the _FILE variant. Not verified: whether j4k-align renders this step from a shared template for other repositories that pin Node inline. In that case the template's callers are external, the option has real users, and only the rendering of an unused branch here is the cost.

lens aposd-plain · arm default · tally 1 valid / 0 invalid / 0 uncertain
claim 01M6JMXWNTRM57R8W9YCJ997PC of review 01M6JMPF0GAKSXRDCWWY4PWWPS

**low** — Baked-Node step accepts a REQUIRED_NODE_VERSION input that no job sets, plus an exactly-one guard to arbitrate it > About a third of each copy of the step is interface that no caller in this repository uses. Readers of three workflows have to parse a two-way input contract and an "exactly one of" error branch, but every job always takes the same path. This is the Overexposure red flag, and AGENTS.md rules it out directly: "No parameter or option no caller passes". > > The step opens with `if [ -n "${REQUIRED_NODE_VERSION:-}" ] && [ -z "${REQUIRED_NODE_VERSION_FILE:-}" ]`, then an `elif` for the file case, then `echo "::error::The baked Node check needs exactly one of REQUIRED_NODE_VERSION and REQUIRED_NODE_VERSION_FILE."`. In checks.yml, dedupe-check.yml and release.yml the only `env` entry is `REQUIRED_NODE_VERSION_FILE: ".node-version"`. No workflow sets `REQUIRED_NODE_VERSION`, so the first branch and the error branch never run. The `pin` variable exists only so the messages can name whichever of the two inputs was used. > > Correction: read `.node-version` directly (`version="$(cat .node-version)"`, with the messages naming `.node-version`) and drop the selector and its error branch. Keep the version-shape and tool-cache checks unchanged. > > I grepped the subject tree for `REQUIRED_NODE_VERSION`. The only hits are inside the three added steps, and each sets only the `_FILE` variant. Not verified: whether j4k-align renders this step from a shared template for other repositories that pin Node inline. In that case the template's callers are external, the option has real users, and only the rendering of an unused branch here is the cost. lens `aposd-plain` · arm `default` · tally 1 valid / 0 invalid / 0 uncertain claim `01M6JMXWNTRM57R8W9YCJ997PC` of review `01M6JMPF0GAKSXRDCWWY4PWWPS`

👎 1

Not a defect: the inline mode has a real caller. The guard is one shared script in j4k-align (src/template-scripts/baked-node-check-script.ts, align #1060), rendered into every managed workflow that sets up Node. templates/workflows/credential-contract-forgejo.yml.hbs passes REQUIRED_NODE_VERSION: "{{nodeExecutionVersion}}" because its actions/setup-node step takes node-version, not a version file; j4k/cluster's credential-contract.yml renders it as REQUIRED_NODE_VERSION: "26.13.0". The exactly-one check rejects a step that sets both or neither. This repository's workflows are align-managed, so dropping the branch here would be overwritten as drift on the next j4k-align --fix.

Not a defect: the inline mode has a real caller. The guard is one shared script in j4k-align (`src/template-scripts/baked-node-check-script.ts`, align #1060), rendered into every managed workflow that sets up Node. `templates/workflows/credential-contract-forgejo.yml.hbs` passes `REQUIRED_NODE_VERSION: "{{nodeExecutionVersion}}"` because its `actions/setup-node` step takes `node-version`, not a version file; j4k/cluster's `credential-contract.yml` renders it as `REQUIRED_NODE_VERSION: "26.13.0"`. The exactly-one check rejects a step that sets both or neither. This repository's workflows are align-managed, so dropping the branch here would be overwritten as drift on the next `j4k-align --fix`.

jercik marked this conversation as resolved

jercik merged commit e49bbcb07f into main

2026-11-04 07:01:09 +00:00

jercik deleted branch chore/align-17-17-1

2026-11-04 07:01:09 +00:00

jercik referenced this pull request from a commit

2026-11-04 07:01:09 +00:00

chore: align with j4k-align 17.17.1 (#18)

Sign in to join this conversation.

No reviewers

No labels

No milestone