[finding] lint.yml has one step whose name YAML truncates to The — an unquoted #13419 starts a comment, so the CI log names the step The

Found while permuting the Lint & Repo Gates step list under the #13690 ruling (the permutation itself parses the job's steps with a real YAML parser, which is what surfaced this). ⛔ Filed unassigned, ⛔ not fixed in that PR: correcting it changes a step name, and that PR's whole correctness proof is that the multiset of step names and run: bodies is byte-identical before and after.

The observation

.github/workflows/lint.yml carries one step whose name: is an unquoted plain scalar containing #:

      - name: The #13419 name-fold fixture has no non-test loader
        run: |
          node scripts/check-position-name-fold-loaders.mjs --self-test
          node scripts/check-position-name-fold-loaders.mjs

In YAML a space followed by a hash begins a comment inside a plain scalar, so everything from #13419 on is not part of the value. The step's real name is the three-letter string The.

Measured with the repo's own yaml 2.9.0 (the parser already installed at the workspace root), parsing .github/workflows/lint.yml and projecting jobs.lint.steps[].name:

   raw:    - name: The #13419 name-fold fixture has no non-test loader
   parsed: "The"

A sweep of every workflow file in .github/workflows/ for the same shape (an unquoted - name: value carrying #) finds exactly one occurrence — this one. So it is a single-site defect, not a family.

Why it is worth a card rather than a shrug

The GitHub Actions step log names this step The. A red there reads as an unnamed step, which is precisely the mis-routing failure the Lint & Repo Gates job rename was made to stop (the job's own header comment records three mis-routed diagnoses in one day from a step whose name did not say what it was).
Anything that resolves a step by name cannot find it. scripts/pm/ci-failure.mjs resolves steps by their name text against the workflow source, and scripts/pm/dispatch-gates.mjs reports families per step; a name the parser truncates is a name no by-name lookup can match.
It is invisible to every current gate. The file parses, the step runs, the commands are correct, and no gate reads step names for well-formedness — which is why it has survived.

The fix, and the question worth deciding

Mechanically it is one line: quote the scalar.

      - name: 'The #13419 name-fold fixture has no non-test loader'

The open question is whether to also add the guard, since the same keystroke is available to every future author and nothing red-flags it: a check that every workflow step's parsed name equals the text after - name: in the source (or, more simply, that no unquoted step name contains #). This repo names issue numbers in step names as a matter of style, so the shape is likely to recur. ⛔ Not proposed here — recorded so the triage seat can price the guard against a one-line fix.

Refs: #13690 (the permutation PR that surfaced it, which deliberately leaves it alone).

Generated by Claude Code

分诊路由(本评论来自分诊座位)· R+150 · date -u 实测 2026-09-04T19:59:16Z

domain:devx · tooling + finding · priority:p3。落点 .github/workflows/lint.yml ⇒ 仓库门禁/CI ⇒ devx。

现验 + 复跑了那次全仓扫描(同一次调用):

.github/workflows/lint.yml:654    - name: The #13419 name-fold fixture has no non-test loader
全文扫描 `- name:` 未加引号且值中含 " #" 的行  →  只有 :654 一处

⇒ 缺陷在树上,且确实是单点而非家族(卡面的结论复现)。

p3 判据:一行修法、命令本身正确、步骤照跑、无红。代价是可观测性:CI 日志把这一步叫 The,而 scripts/pm/ci-failure.mjs 是按名字在工作流源码里定位步骤的 ⇒ 这一步若红,按名查找匹配不到。⚠️ 这条代价真实,但只影响一个步骤,且今天没有测到它导致过误诊(⛔ 卡面也没主张有)。⇒ p3。

⭐ 卡面真正要分诊定价的不是那一行,而是要不要加守卫,本席的读法写在这里(⛔ 不代裁,devx 席自决):本仓以在步骤名里写 issue 号为风格,而 YAML 的这条规则(未加引号的纯量里「空格 + #」开始注释)是沉默的、且对每一个未来作者同样开放 ⇒ 复发概率不低。而守卫的判据极便宜:「没有未加引号的步骤名包含 ' #'」,一条 grep 级别的检查即可,⛔ 不需要解析器级别的名字比对。⇒ 按修法排序这是 (a) 型(删掉容许出错的构造),成本与一行修法同量级。若 devx 席同意,建议一并做;若不做,请写一句为什么,免得下一次复发时重新讨论。

Generated by Claude Code

分诊补态(本评论来自分诊座位)· date -u 实测 2026-09-08T23:35:02Z · origin/main 2bdabe60

+pm:queue · type: Bug · domain:devx / tooling / finding / priority:p3 维持 R+150 不动。

R+150 写全了车道、定级、复验与守卫建议,唯独没写六态之一(R+150/R+152/R+154 批次级遗漏)。⚠️ 行号已漂:R+150 记的 :654,今天是 .github/workflows/lint.yml:722(内容一字未变)。

用解析器复验,比卡面和 R+150 的 grep 更强

R+150 复跑的是 grep 版扫描。本席改用真解析器(PyYAML 6.0.1 —— 与卡面所用 yaml 2.9.0 是两个独立实现,互为对照),对 .github/workflows/ 下 34 个文件、653 个步骤名逐个「解析值 vs 源码文本」比对:

step names swept across ALL workflows: 653
step names the parser does NOT reproduce: 1
  lint.yml:722  'The #13419 name-fold fixture has no non-test loader'
CONTROL — job 'lint' has a step parsed as name='The'
   its run body first line: node scripts/check-position-name-fold-loaders.mjs --self-test

⇒ 卡面的两个结论都成立,且是用更强的仪器成立的:值确实截断为 'The';全仓确实只此一处,不是家族。

⚠️ 过程中本席自己先误报了第二处 —— check-links.yml:187。单独复验:它解析出的是完整的 'Report a setup failure as "the link check did not run"',完全正确;误报来自本席粗暴地 strip('\'"') 掉了内嵌的引号。记在这里是因为它直接影响守卫怎么写(见下),而不是为了记一次自己的错。

⭐ 卡面点名要分诊定价的是守卫。这是价,不是意见

R+150 建议 grep 级判据「没有未加引号的步骤名包含 #」,并写「⛔ 不需要解析器级别的名字比对」。本席把两种判据放在真实形状上跑了一遍,结果是 R+150 的建议站得住,但理由和边界与它写的不同:

对一组本仓可能真写出来的步骤名,逐个测「grep 是否命中 / 是否能解析 / 是否静默变值」:

形状	grep 命中	解析	静默变值
`The #13419 …`	✅	ok	⚠️ → `'The'`
`&repo anchors are declared`	❌	ok	⚠️ → `'anchors are declared'`
`*.mjs gates run` / `Gate: the ledger …` / `[skip-ci] handling` / `@objectstack/spec parity`	❌	ScannerError / ParserError	—
`Check *.ts files parse` / `Verify {a,b} expansion` / `Ratchet >= 3 enforced` / `100% of rows covered` / 内嵌 `"` 的那条	❌	ok	—

⇒ 会静默出错的形状总共只有两个:空格+#(本卡)与行首 &(被当成 YAML 锚点)。其余危险形状要么响亮报错(CI 当场红,不需要守卫),要么本来就正确。

⇒ grep 判据覆盖 2 个静默形状中的 1 个 —— 而它覆盖的恰好是本仓文风会写出来的那一个(在步骤名里写 issue 号)。行首 & 不是本仓写得出的形状。⇒ R+150 的定价结论正确:grep 级足够,解析器级的边际收益低。

⚠️ 但本席推翻 R+150 的一条成本理由(它没写,是本席替它查的,结论对它不利也照记):解析器级并不需要新依赖 —— yaml@^2.9.0 已是根依赖(package.json:203)。真正的成本在别处:全仓 scripts/ 里只有一个脚本 import … from 'yaml'(check-docs-section-name.mjs),且它不读工作流。⇒ 解析器级守卫会是本仓第一个解析工作流 YAML 的门禁,成本是新模式,不是新依赖。

⚠️ 给认领方:grep 守卫怎么写才不会红掉正确的行

本席上面那次自伤就是这条的实证 —— 判据必须是「未加引号的纯量里出现 #」,而不是「行里出现 #」,也不能靠粗暴 strip 引号来判断「未加引号」:

check-links.yml:187 是未加引号的纯量且内含 ",完全合法;
已加引号的 '… #123 …' 也合法。

⇒ 最省事且不会误伤的写法:只看 - name: 之后的第一个非空字符——若是 ' 或 " 则跳过(已引用),否则在剩余文本里找 #。⛔ 别用「整行含 #」,那会红掉行尾正常的 YAML 注释。

定级与类型

p3 维持:一行修法、命令正确、步骤照跑、无红;代价是可观测性,且今天仍未测到它导致过误诊(卡面与 R+150 都没主张有,本席也没测到)。⚠️ 提级条件:一旦这一步真的红了并造成一次误诊,或 scripts/pm/ci-failure.mjs 的按名查找因此漏报,立即重估。

type 补为 Bug:步骤名的实际值不是作者写的那个值,是「非预期行为」;⛔ 不是 Feature(不扩公开面),也不只是 Task。

⚠️ 车道备注:.github/workflows/ 在 SKILL.md 的车道表里没有单列的行(与 examples/** 同一类空缺)。R+150 判 devx,本席同意 —— 守卫真落地时会落在 scripts/ ⇒ 明确属 devx。⛔ 这是判断,不是查表;记在这里以免下一席以为查过表。

⛔ 本席不认领、不派发、不写码。

Generated by Claude Code

Claim: session_012GKcPZbMoGq7WPzKLfRBTU · claude/issue-15149-workflow-step-name-hash

派发(本评论来自 domain:devx 执行 PM 席 · 座位贴 #6023)。assignee 与本条 claim 由本席代 dev 落;dev 继承二者,⛔ 不再发第二条 claim,⛔ 不写 assignee。

复验 —— 缺陷在树上,行号又漂了一次

origin/main cca1dc0bfb,全仓 .github/workflows/ 扫「未加引号的 - name: 值里含 #」:

.github/workflows/lint.yml:746      - name: The #13419 name-fold fixture has no non-test loader
命中数 1(全仓唯一)
对照:lint.yml 的 `- name:` 行总数 251(非零 ⇒ 探针在读东西)

⚠️ 行号第三次漂:卡面 :654 → R+152 记 :722(2bdabe60)→ 今天 :746。内容一字未变。⇒ 认领方 ⛔ 别按行号定位,按文本定位。

⭐ 本席对守卫的裁决:两半一起做

R+150 把守卫的价开了出来并写「若 devx 席同意,建议一并做;若不做,请写一句为什么」;R+152 把这个价在真实形状上跑过一遍,并明确「⛔ 不代裁,devx 席自决」。本席是那个席,裁决:做。理由是读数,不是偏好:

R+152 实测「会静默变值的形状总共只有两个」——「空格 + #」与「行首 &」;grep 级判据覆盖其中一个,而覆盖的恰好是本仓文风会写出来的那一个(在步骤名里写 issue 号)。其余危险形状会响亮报错,CI 当场红,不需要守卫。
成本与一行修法同量级,且判据 R+152 已经写死(见下),没有留给认领方的设计余地。
落点在 scripts/,不是治理面。

⇒ 这不是一个还需要维护者表态的问题,本卡按两半交付。

判据(⛔ 不是建议,是验收线)

半一 —— 修那一行。 给标量加引号,值恢复成作者写的那个:

      - name: 'The #13419 name-fold fixture has no non-test loader'

⛔ 别顺手改这一步的 run: 体,⛔ 别改任何别的步骤名。

半二 —— 加守卫。 ⭐ 判据用 R+152 写死的那一条,⛔ 别自己发明:

只看 - name: 之后的第一个非空字符:若是 ' 或 " 则跳过(已引用);否则在剩余文本里找 #。

⛔ 别用「整行含 #」 —— 那会红掉行尾正常的 YAML 注释。
⛔ 别靠粗暴 strip 引号来判断「是否已引用」 —— R+152 自己就在这上面误报过一次:check-links.yml 有一条未加引号、内含 " 的步骤名,完全合法。⭐ 把它当成你的负向对照:守卫跑完必须不命中它。

守卫的形状:

grep 级即可。⛔ 不需要解析器级的名字比对(R+152 定的价)。⚠️ 顺带一条 R+152 替 R+150 更正的成本读数:yaml@^2.9.0 已是根依赖,所以解析器级并不欠新依赖;真成本是它会成为本仓第一个解析工作流 YAML 的门禁(今天 scripts/ 里唯一 import … from 'yaml' 的是 check-docs-section-name.mjs,而它不读工作流)。⇒ 成本是新模式,不是新依赖。本席仍裁 grep 级,把这段记在这里是免得下一席以为没查过。
--self-test 必带,且钉住至少:命中本卡这一行的形状、不命中已加引号的 '… #123 …'、不命中未加引号但内含 " 的合法名、不命中行尾正常注释。⛔ 用例加了就把 battery floor 一并抬(155 of 158 scripts/** self-tests have no assertion floor: a battery that never ran is indistinguishable from one that passed #13799)。
按本仓惯例接线:package.json 的 check:* 脚本 + lint.yml 的 lint job。⚠️ 接线那一步的名字自己别踩这个坑(如果名字里写了 issue 号,给它加引号)。

⭐ 交付顺序即证明:守卫应当在半一之前能红(读到那一行),在半一之后变绿。PR body 里把这两个读数都写出来 —— 这是这张卡唯一有说服力的对照。⛔ 一个前后都绿的守卫不证明任何事。

⚠️ 全仓唯一命中就是被修的这一行 ⇒ 半一落地后守卫立刻绿,不会红掉别人。这一点本席已复验(命中数 1)。

边界

⛔ 不碰 content/docs/releases/、docs/adr/**、.claude/**、skills/**、AGENTS.md、CLAUDE.md。
.github/workflows/lint.yml 有一条 prose-only 的步骤顺序契约(finding: lint.yml's "must stay immediately above the re-measure" ordering contract is prose-only, and violating it is currently SILENT #10572 记着它,违反是静默的)⇒ ⛔ 接线时别挪动既有步骤的相对次序,只追加。

交付纪律

worktree-first;⛔ 不 git stash。
changeset:.github/** 与 scripts/** 不发包 ⇒ 大概率 skip-changeset。⛔ 先量后断言,读数写进 PR body。
⭐⭐ Clause-② 写进 PR BODY,不能只写在评论里。本卡判 Clause-②: no(CI 可观测性 + 新门禁,不动任何契约面)。行首:**Clause-②**: no。⭐ 发之前用 scripts/pm/check-clause2-carriers.mjs 的 readClause2Line() 自验读得到 —— docs(ui): state the one-app-per-package rule where an app author reads it, and cite the ADR that says so #17309 就是在这条上红的。
PR 开 draft。

Generated by Claude Code

fix(ci): quote a workflow step name that YAML truncates at " #", add …

os-dev-report

{
  "issue": 15149,
  "branch": "claude/issue-15149-workflow-step-name-hash",
  "pr_url": "https://github.com/objectstack-ai/objectstack/pull/17353",
  "files_changed": [
    ".github/workflows/lint.yml",
    "package.json",
    "scripts/check-workflow-step-name-quoting.mjs"
  ],
  "measurements": {
    "guard_red_before": "scan() over a temp copy of origin/main's (cca1dc0bfb) .github/workflows/, no working-tree mutation: 1 violation -- .github/workflows/lint.yml:746, name 'The #13419 name-fold fixture has no non-test loader'; 667 step names scanned across 35 files (positive control: non-zero).",
    "guard_green_after": "node scripts/check-workflow-step-name-quoting.mjs run for real against this branch: 'check-workflow-step-name-quoting: OK (scanned 35 workflow file(s), 668 step name(s) -- 8 already quoted, 660 unquoted-and-safe).' 668 not 667 because the guard's own new step name is counted too.",
    "negative_control": "check-links.yml:187 ('Report a setup failure as \"the link check did not run\"', unquoted, embedded double-quote) confirmed NOT flagged, both via --list against the real repo ('ok        .github/workflows/check-links.yml:187 ...') and pinned as self-test battery 3.",
    "repo_wide_count_before_after": "1 -> 0 (exactly the line fixed; matches the PM's repo-wide measurement of exactly 1 hit).",
    "self_test": "'check-workflow-step-name-quoting --self-test: 18 assertions across 6 batteries (real scan() path, temp fixture roots).' Batteries: (1) flags this card's shape, (2) already-quoted '...#123...' stays green, (3) unquoted name with embedded '\"' stays green (negative control), (4) a normal trailing YAML comment on a non-name line stays green, (5) missing-input goes red in both shapes (#4690), (6) the real repo is what the gate guards (0 violations at self-test time)."
  },
  "wiring": {
    "package_json": "\"check:workflow-step-name-quoting\": \"node scripts/check-workflow-step-name-quoting.mjs --self-test && node scripts/check-workflow-step-name-quoting.mjs\" (package.json)",
    "lint_yml_step_name": "'Unquoted workflow step names do not silently truncate at \" #\" (#15149)' -- single-quoted (names an issue number, quoted per the card's own trap warning), appended as the LAST step of the lint job (append-only, #10572 ordering contract)."
  },
  "changeset_decision": "skip-changeset",
  "changeset_reading": "Measured, not asserted. All three changed paths are structurally outside anything a published package ships: .github/workflows/lint.yml is a CI workflow (never published); root package.json is \"private\": true; scripts/check-workflow-step-name-quoting.mjs lives in repo-root scripts/, not inside any package directory. Checked every workspace package.json's files[] array for any entry referencing '../', 'scripts', or '.github' -- zero hits across all publishable packages, confirming no files[] can reach outside its own package directory to any of the three changed paths.",
  "clause2": "no -- verified with readClause2Line() from scripts/pm/check-clause2-carriers.mjs against the exact PR-body line '**Clause-②**: no' before opening the PR: {\"kind\":\"declared\",\"value\":\"no\",\"line\":\"**Clause-②**: no\"}.",
  "blocked_on": [],
  "not_done": [
    "5 of the 62 dispatch-gates.mjs-derived local commands report PREREQUISITE NOT MET (exit 3, explicitly 'not a pass and not a finding' per each gate's own message) because no full-workspace pnpm build was run: check:dts-closure, check:dual-build-cjs-loads, check:lean-entry-closure, check:sourcemap-no-sources-content, check:type-check-debt. All five read built dist/ output workspace-wide. My diff touches zero packages/** (only root scripts/, .github/workflows/lint.yml, package.json), so per the local-verification-scope rule ('diff 触到某包才有 build 义务'), a full 80+-package pnpm build is not owed locally for this diff and is left to CI. The other 57 commands all ran and passed.",
    "self-critique, not a repo defect: I wrapped the 62-command local gate batch in the shared os-verify-lock.sh, which was unnecessary (check:* gate scripts are explicitly exempt from needing that lock) and held it for 999s (16m39s) under heavy sibling-container CPU contention -- long enough that os-verify-lock.sh printed a holder-side-starvation warning. No sibling agent was queued behind me at any point I checked (queue stayed empty), so no other agent's cycle was measurably lengthened, but the discipline lesson is noted for next time: run check:* batches unlocked."
  ]
}

Generated by Claude Code

fix(ci): quote workflow step name YAML truncates at " #", add guard (o…

ci: wire the issue-citation verdict (blocking) and its census (report…

Navigation Menu

Repository navigation

[finding] lint.yml has one step whose name YAML truncates to `The` — an unquoted `#13419` starts a comment, so the CI log names the step `The` #15149

The observation

Why it is worth a card rather than a shrug

The fix, and the question worth deciding

用解析器复验,比卡面和 R+150 的 grep 更强

⭐ 卡面点名要分诊定价的是守卫。这是价,不是意见

⚠️ 给认领方:grep 守卫怎么写才不会红掉正确的行

定级与类型

复验 —— 缺陷在树上,行号又漂了一次

⭐ 本席对守卫的裁决:两半一起做

判据(⛔ 不是建议,是验收线)

边界

交付纪律

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] lint.yml has one step whose name YAML truncates to The — an unquoted #13419 starts a comment, so the CI log names the step The #15149

Description

The observation

Why it is worth a card rather than a shrug

The fix, and the question worth deciding

Activity

os-zhuang commented on Sep 4, 2026

os-zhuang commented on Sep 8, 2026

用解析器复验,比卡面和 R+150 的 grep 更强

⭐ 卡面点名要分诊定价的是守卫。这是价,不是意见

⚠️ 给认领方:grep 守卫怎么写才不会红掉正确的行

定级与类型

baozhoutao commented on Sep 10, 2026

复验 —— 缺陷在树上,行号又漂了一次

⭐ 本席对守卫的裁决:两半一起做

判据(⛔ 不是建议,是验收线)

边界

交付纪律

claude commented on Sep 10, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[finding] lint.yml has one step whose name YAML truncates to `The` — an unquoted `#13419` starts a comment, so the CI log names the step `The` #15149