Skip to content

fix: skip workflow files deleted within a PR#83

Draft
ldemidov wants to merge 1 commit into
Contrast-Security-OSS:mainfrom
ldemidov:fix/skip-deleted-workflow-files
Draft

fix: skip workflow files deleted within a PR#83
ldemidov wants to merge 1 commit into
Contrast-Security-OSS:mainfrom
ldemidov:fix/skip-deleted-workflow-files

Conversation

@ldemidov

Copy link
Copy Markdown

Problem

When a PR changes workflow files, Actionbot reads each changed .github/workflows/** file to check its uses: actions against the policy. getFilesInCommit collects files with status added/modified per commit. If a workflow file is added or modified in one commit of a PR and then deleted in a later commit of the same PR, it is still collected (from the earlier commit's added/modified status), but the checkout is the PR head, where the file no longer exists.

Reading the missing file throws and fails the whole run:

READING WORKFLOW FILES
Reading:.github/workflows/e2e.yml
##[error]Unable to parse workflow file '.github/workflows/e2e.yml' - please ensure it's formatted properly.
Error: ENOENT: no such file or directory, open '.github/workflows/e2e.yml'
    at Object.readFileSync (node:fs:441:20)
    at .../actionbot/lib/index.js

A workflow that is only deleted in a PR is already excluded by the added/modified filter in getFilesInCommit; this is specifically the add/modify-then-delete-across-commits case.

Fix

Skip any collected workflow path that isn't present on disk at the checked-out head, and log the skip, instead of reading it. A workflow file that no longer exists at head can't violate the action policy. This also keeps deleted files out of the evaluation output (previously a deleted file was still pushed to workflowFiles with an empty action list and printed a spurious Evaluating '<deleted file>').

Note on lib/index.js

The action runs the bundled lib/index.js, so it's updated too. A clean npm run build currently fails in this repo — ncc 0.38.4 can't resolve the exports field of the pinned @actions/core@3.0.1 / @actions/github@9.1.1 (Package path . is not exported from package @actions/github). So I hand-patched lib/index.js to mirror the src/main.ts change exactly (node --check passes). Happy to regenerate it via a working build if you'd prefer, or to fold in a build fix.

Testing

The repo has no test suite wired up (jest is configured but there are no spec files) and npm run lint/npm run build are currently broken on a clean checkout (see above), so this was verified by inspection and node --check lib/index.js. The change is a guard-and-skip with an early return; behavior for existing (present) workflow files is unchanged.

getFilesInCommit collects files added/modified in each commit of a PR. A
workflow file that is added or modified in one commit and then deleted in a
later commit of the same PR is still collected from the earlier commit, but
the checkout is the PR head where the file no longer exists. Reading it throws
ENOENT and fails the whole run:

    ##[error]Unable to parse workflow file '.github/workflows/foo.yml'
    Error: ENOENT: no such file or directory, open '.github/workflows/foo.yml'

Skip any workflow path not present on disk (deleted at head) and log it,
instead of reading it. A workflow that no longer exists cannot violate the
policy, and this also keeps such phantom files out of the evaluation output.

lib/index.js is hand-patched to mirror src/main.ts exactly: a clean npm run
build currently fails on the pinned @actions/* deps (ncc 0.38.4 cannot resolve
their exports field), so the bundle could not be regenerated normally.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings July 24, 2026 14:20
@ldemidov

Copy link
Copy Markdown
Author

@nbuckwalt please review this PR and fix

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR prevents Actionbot from failing when a workflow file is added/modified in an earlier PR commit but deleted by the PR head commit, by skipping any collected workflow paths that are not present in the checked-out workspace.

Changes:

  • Added an on-disk existence guard before attempting to read each collected workflow file.
  • Avoided pushing non-existent workflow files into the evaluation list (removing “evaluating ” noise).
  • Mirrored the same behavior change in the bundled lib/index.js used by the GitHub Action runtime.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
src/main.ts Skips missing workflow files at PR head before reading/parsing them.
lib/index.js Updates the bundled action entrypoint to match the new skip behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread src/main.ts
Comment on lines +216 to +219
if (!fs.existsSync(wf)) {
console.log("\nSkipping (deleted in this change set): " + wf);
return;
}
Comment thread lib/index.js
Comment on lines +67641 to +67644
if (!fs_1.default.existsSync(wf)) {
console.log("\nSkipping (deleted in this change set): " + wf);
return;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants