Filter matrix expressions from runner label warnings by nodeselector · Pull Request #59 · github/gh-actions-lock · GitHub
Skip to content

Filter matrix expressions from runner label warnings - #59

Merged
nodeselector merged 3 commits into
mainfrom
nodeselector/fix-matrix-expression-in-allow-runners-h
Jun 16, 2026
Merged

nodeselector merged 3 commits into
mainfrom
nodeselector/fix-matrix-expression-in-allow-runners-h

Conversation

@nodeselector

Copy link
Copy Markdown
Collaborator

When runs-on uses a template expression like ${{ matrix.os }}, the tool
previously lumped it into the self-hosted-runner bucket. This was confusing:
the --allow-runners hint would print raw ${{ matrix.os }} as a label to
pass, and users couldn't tell whether a workflow was skipped because it uses
a real custom runner vs. a dynamic expression that might resolve to a hosted
runner at runtime.

Changes:

  • extractBracketedLabels now filters out ${{ }} expressions so the
    --allow-runners hint only shows actionable literal labels
  • New ExpressionRunner category splits expression-based runs-on into its
    own warning with distinct messaging and guidance:
    ! 1 workflow skipped -- runs-on uses expressions that can't be resolved statically
     ↳ build-fluent-bit.yml -- if the matrix resolves to hosted runners, pin manually
    
  • JSON output filter updated to suppress expression-runner warnings (same
    treatment as local-action and self-hosted-runner)
  • IsWarning() extended to recognize the new category

The self-hosted-runner warning is now reserved for literal non-hosted labels
only, keeping the --allow-runners remediation hint clean and actionable.

Expressions like ${{ matrix.os }} can't be passed as literal runner
labels. Strip them from extractBracketedLabels so the remediation hint
only shows actionable labels. When all labels are expressions, the
generic <label> placeholder is shown instead.
Workflows where runs-on is a template expression (e.g. ${{ matrix.os }})
were lumped into the self-hosted-runner bucket. The user couldn't tell
whether a workflow was skipped because it uses a custom runner vs.
because runs-on is a dynamic expression that might resolve to a hosted
runner at runtime.

New ExpressionRunner category with distinct terminal output:

  ! 2 workflows skipped — runs-on uses expressions that can't be resolved statically
   ↳ ci.yaml, maccloud-unified.yml
   ↳ if the matrix resolves to hosted runners, pin these workflows manually

The self-hosted-runner warning now only shows literal non-hosted labels
and the --allow-runners hint no longer includes raw ${{ }} expressions.
Copilot AI review requested due to automatic review settings June 16, 2026 21:42
GitHub Advanced Security started work on behalf of nodeselector June 16, 2026 21:43
GitHub Advanced Security finished work on behalf of nodeselector June 16, 2026 21:44

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Not ready to approve

ExpressionRunner findings are not fully integrated into validity/actionability logic, which can make expression-only workflows incorrectly fail validation and be treated as needing pin-planning attention.

Pull request overview

This PR improves runner-label diagnostics by separating dynamic runs-on template expressions (e.g. ${{ matrix.os }}) from literal non-hosted runner labels, keeping --allow-runners guidance actionable and less confusing.

Changes:

  • Split non-hosted runner labels into expression vs literal labels during diagnosis, emitting a new ExpressionRunner category for expression-only cases.
  • Update terminal rendering to (a) filter expressions out of --allow-runners hints and (b) show a dedicated “expression-runner” skipped-workflow warning with distinct guidance.
  • Suppress expression-runner warnings from JSON output (same treatment as other informational skip warnings) and extend warning classification to recognize the new category.
File summaries
File Description
internal/pipeline/diagnose.go Splits non-hosted labels and emits ExpressionRunner findings for expression-only runs-on.
internal/pipeline/checks/finding.go Extends warning classification to include ExpressionRunner.
internal/pipeline/checks/category.go Introduces the expression-runner category and updates category documentation.
cmd/gh-actions-lock/format/terminal.go Filters expressions from --allow-runners hints and adds a dedicated expression-runner warning block.
cmd/gh-actions-lock/format/terminal_test.go Adds coverage for expression filtering and the new terminal warning output.
cmd/gh-actions-lock/format/json.go Suppresses ExpressionRunner warnings in JSON output.

Copilot's findings

  • Files reviewed: 6/6 changed files
  • Comments generated: 4

Note

Your feedback helps us improve the quality of this feature.
Please use 👍 or 👎 to tell us whether this assessment is correct.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread internal/pipeline/checks/finding.go
Comment thread internal/pipeline/checks/finding.go
Comment thread internal/pipeline/diagnose.go
Comment thread cmd/gh-actions-lock/format/terminal.go
- Use "${" instead of "${{" in diagnose.go and isExpression() to
  match the parser's expression detection in runson.go:132
- Add ExpressionRunner to IsValid() and NeedsAttention() skip lists so
  expression-only workflows don't cause non-zero exit or trigger pin
  planning
- Key IsWarning() off Severity (matching LocalAction/SelfHostedRunner)
  so future error elevation works correctly
GitHub Advanced Security started work on behalf of nodeselector June 16, 2026 21:54
GitHub Advanced Security finished work on behalf of nodeselector June 16, 2026 21:56
@nodeselector
nodeselector merged commit 6afaed3 into main Jun 16, 2026
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants