[Safe Outputs Conformance] USE-003: 2 handlers disable staged-mode effects without a visible staged-preview marker
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 新手友好度
- 70/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- github-actions, javascript
- 领域
- devtools
调研方向
阅读 actions/setup/js/pr_lifecycle.cjs 和 actions/setup/js/work_queue_claim_scope.cjs，然后搜索 logStagedPreviewInfo 或 generateStagedPreview，以找到现有的输出约定。为两个暂存路径添加可见的暂存预览标记，同时保留范围错误行为。运行 bash scripts/check-safe-outputs-conformance.sh；两个文件的 USE-003 均通过后即完成。
由索引模型根据 Issue 内容生成。
描述
Conformance Check Failure
Check ID: USE-003
Severity: LOW (2 occurrences, easy fix)
Category: Usability (Staged Mode Preview Format)
Problem Description
Section on Staged Mode requires handlers that respond to GH_AW_SAFE_OUTPUTS_STAGED to clearly mark their staged behavior, conventionally with a theater-mask (U+1F3AD) emoji in the preview/log output so users scanning run logs can immediately tell an action was suppressed in staged mode. Two handlers check the staged-mode flag but take a silent/exception path instead of emitting a marked preview line:
-
actions/setup/js/pr_lifecycle.cjs(line ~12):if (process.env.GH_AW_SAFE_OUTPUTS_STAGED === "true") return null;— silently short-circuits with no log output at all. -
actions/setup/js/work_queue_claim_scope.cjs(line ~192):if (process.env.GH_AW_SAFE_OUTPUTS_STAGED === "true" || execution?.staged === true) throw scopeError("read-only Claim preview cannot perform resource effects");— throws a scope error whose message does not include the staged-preview emoji/marker.
Affected Components
-
actions/setup/js/pr_lifecycle.cjs -
actions/setup/js/work_queue_claim_scope.cjs
<b>Current vs Expected Behavior</b>
Current Behavior
pr_lifecycle.cjs returns null with no log line, so a user cannot tell from output alone that staged mode suppressed an effect. work_queue_claim_scope.cjs throws a plain-text scopeError without the staged-preview marker, so the error could be mistaken for a genuine failure rather than an expected staged-mode guard.
Expected Behavior
Both paths should emit (or include in their thrown/returned context) a clearly marked staged-mode notice, e.g. logging \ud83c\udfad Staged Mode Preview: skipping PR lifecycle effect (GH_AW_SAFE_OUTPUTS_STAGED) before returning null in pr_lifecycle.cjs, and prefixing the work_queue_claim_scope.cjs scope error message with the same emoji/marker so it is visibly distinguished from a real scope violation.
Remediation Steps
- In
actions/setup/js/pr_lifecycle.cjs(~line 12), add acore.infoor equivalent log line containing the \ud83c\udfad emoji and "Staged Mode Preview" text immediately before the earlyreturn null;. - In
actions/setup/js/work_queue_claim_scope.cjs(~line 192), prefix thescopeErrormessage passed when staged with the \ud83c\udfad emoji/marker (or log a separate staged-preview notice before throwing), while keeping the thrown error type/behavior unchanged for callers. - Confirm the staged-mode output format matches the pattern used elsewhere in the codebase (search for
logStagedPreviewInfo/generateStagedPreviewfor the established convention) so this is consistent across handlers.
Verification
After remediation, verify the fix by running:
bash scripts/check-safe-outputs-conformance.sh
USE-003 should pass for both listed files.
References
- Safe Outputs Specification: docs/src/content/docs/specs/safe-outputs-specification.md
- Conformance Checker: scripts/check-safe-outputs-conformance.sh
- Run: §39729823556
- Date: 2026-10-22
Generated by ✅ Daily Safe Outputs Conformance Checker · claude · agent · 132.9 AIC · ⌖ 0.552 AIC · ⊞ 5.4K · ◷
- expires on Oct 22, 2026, 9:54 PM UTC-08:00
- 主要语言
- Go
- 星标
- 5.4k
- 派生
- 596
- 平均合并
- 3 小时 40 分钟
- 30 天内合并 PR
- 830
环境准备
在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。
- 提供 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
github/gh-aw 的其他 Issue
-
automation models
难度 1/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
automated-analysis code-quality cookie testing
难度 2/5 1-3 小时 新手友好度 74/100
维护者通常 1 天内回复
-
automated conformance safe-outputs
难度 1/5 1 小时以内 新手友好度 78/100
维护者通常 1 天内回复
-
automated conformance safe-outputs
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
wgdonenotdeferred: parenthesized Done() statement escapes non-deferred detection (paren_unwrap_gap)未关闭cookie sergo
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 1 天内回复
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 78/100
ClickHouse/ch-go#1218 ·
维护者通常 13 天内回复
-
难度 2/5 1-3 小时 新手友好度 77/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
-
难度 2/5 1-3 小时 新手友好度 72/100
podman-container-tools/podman#30031 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100