[Safe Outputs Conformance] USE-003: 2 handlers disable staged-mode effects without a visible staged-preview marker
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 70/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- github-actions, javascript
- Domain
- devtools
Research direction
Read actions/setup/js/pr_lifecycle.cjs and actions/setup/js/work_queue_claim_scope.cjs, then search for logStagedPreviewInfo or generateStagedPreview to find the existing output convention. Add a visible staged-preview marker to both staged paths while preserving the scope error behavior. Run bash scripts/check-safe-outputs-conformance.sh; done when USE-003 passes for both files.
Written by the indexing model from the issue text.
Description
Conformance Check Failure
Check ID: USE-003
Severity: LOW (2 occurrences, easy fix)
Category: Usability (Staged Mode Preview Format)
Problem Description
Section on Staged Mode requires handlers that respond to GH_AW_SAFE_OUTPUTS_STAGED to clearly mark their staged behavior, conventionally with a theater-mask (U+1F3AD) emoji in the preview/log output so users scanning run logs can immediately tell an action was suppressed in staged mode. Two handlers check the staged-mode flag but take a silent/exception path instead of emitting a marked preview line:
-
actions/setup/js/pr_lifecycle.cjs(line ~12):if (process.env.GH_AW_SAFE_OUTPUTS_STAGED === "true") return null;— silently short-circuits with no log output at all. -
actions/setup/js/work_queue_claim_scope.cjs(line ~192):if (process.env.GH_AW_SAFE_OUTPUTS_STAGED === "true" || execution?.staged === true) throw scopeError("read-only Claim preview cannot perform resource effects");— throws a scope error whose message does not include the staged-preview emoji/marker.
Affected Components
-
actions/setup/js/pr_lifecycle.cjs -
actions/setup/js/work_queue_claim_scope.cjs
<b>Current vs Expected Behavior</b>
Current Behavior
pr_lifecycle.cjs returns null with no log line, so a user cannot tell from output alone that staged mode suppressed an effect. work_queue_claim_scope.cjs throws a plain-text scopeError without the staged-preview marker, so the error could be mistaken for a genuine failure rather than an expected staged-mode guard.
Expected Behavior
Both paths should emit (or include in their thrown/returned context) a clearly marked staged-mode notice, e.g. logging \ud83c\udfad Staged Mode Preview: skipping PR lifecycle effect (GH_AW_SAFE_OUTPUTS_STAGED) before returning null in pr_lifecycle.cjs, and prefixing the work_queue_claim_scope.cjs scope error message with the same emoji/marker so it is visibly distinguished from a real scope violation.
Remediation Steps
- In
actions/setup/js/pr_lifecycle.cjs(~line 12), add acore.infoor equivalent log line containing the \ud83c\udfad emoji and "Staged Mode Preview" text immediately before the earlyreturn null;. - In
actions/setup/js/work_queue_claim_scope.cjs(~line 192), prefix thescopeErrormessage passed when staged with the \ud83c\udfad emoji/marker (or log a separate staged-preview notice before throwing), while keeping the thrown error type/behavior unchanged for callers. - Confirm the staged-mode output format matches the pattern used elsewhere in the codebase (search for
logStagedPreviewInfo/generateStagedPreviewfor the established convention) so this is consistent across handlers.
Verification
After remediation, verify the fix by running:
bash scripts/check-safe-outputs-conformance.sh
USE-003 should pass for both listed files.
References
- Safe Outputs Specification: docs/src/content/docs/specs/safe-outputs-specification.md
- Conformance Checker: scripts/check-safe-outputs-conformance.sh
- Run: §39729823556
- Date: 2026-10-22
Generated by ✅ Daily Safe Outputs Conformance Checker · claude · agent · 132.9 AIC · ⌖ 0.552 AIC · ⊞ 5.4K · ◷
- expires on Oct 22, 2026, 9:54 PM UTC-08:00
- Dominant language
- Go
- Stars
- 5.4k
- Forks
- 596
- Avg merge
- 3h 41m
- Merged PRs (30d)
- 829
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from github/gh-aw
-
automation models
Difficulty 1/5 1-3 hours Newbie friendliness 74/100
Maintainers usually reply within 1 day
-
agent-research
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
agentic-workflows
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
automated conformance safe-outputs
Difficulty 1/5 Under an hour Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
[Safe Outputs Conformance] SEC-005: Cross-repo target-repo field flagged without allowlist checkOpenautomated conformance safe-outputs security
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
Maintainers usually reply within 1 day
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 91/100
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
praetorianer777/Dynamo#53 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
kind/engineering pulumi/pulumi-terraform Task Workflow Failure
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
pulumi/pulumi-terraform#1261 ·
Maintainers usually reply within 1 day
-
Controllers integration tests fail when port 8080 is in usePossibly taken @noahnut claimed this today. Openarea/cluster-autoscaler kind/bug needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
kubernetes-sigs/cluster-autoscaler#236 · 1 comment ·
Maintainers usually reply within 1 day