Skip to content

fix: compile with actionlint/zizmor/poutine no longer marks valid workflows as invalid when Docker is unavailable#25251

Merged
pelikhan merged 3 commits intomainfrom
copilot/fix-actionlint-failure-handling
Apr 8, 2026
Merged

fix: compile with actionlint/zizmor/poutine no longer marks valid workflows as invalid when Docker is unavailable#25251
pelikhan merged 3 commits intomainfrom
copilot/fix-actionlint-failure-handling

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Apr 8, 2026

When Docker is unavailable and actionlint: true (or zizmor/poutine) is passed to the MCP compile tool, all workflows were returned as valid: false without compilation even being attempted — masking whether workflows were actually broken.

Changes

  • New DockerUnavailableError type (docker_images.go) — distinguishes persistent Docker daemon unavailability from transient errors (images still downloading). CheckAndPrepareDockerImages returns *DockerUnavailableError for the daemon-down case.

  • Graceful degradation in MCP compile handler (mcp_tools_readonly.go) — on DockerUnavailableError, the handler now strips the Docker-requiring flags and runs compilation normally, then injects a docker_unavailable warning into every result. The valid field reflects actual compile success/failure, not Docker availability.

  • Image-downloading case unchanged — transient retry errors (images still pulling) continue to return early with valid: false and the retry message as before.

  • New injectDockerUnavailableWarning helper — parses the compile JSON output and appends the warning to each result without mutating valid.

Before (Docker unavailable, actionlint: true):

[{"workflow": "my-workflow.md", "valid": false, "errors": [{"type": "config_error", "message": "docker is not available..."}]}]

After:

[{"workflow": "my-workflow.md", "valid": true, "errors": [], "warnings": [{"type": "docker_unavailable", "message": "docker is not available..."}], "compiled_file": "...lock.yml"}]

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw pkg/mod/golang.orev-parse x_amd64/vet git rev-�� --show-toplevel x_amd64/vet /usr/bin/git runs/20260408-06git -trimpath /usr/bin/git git (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name 866233355/001' 866233355/001' -importcfg /tmp/go-build3456513118/b411/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/fileutil.go /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/tar.go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git .a V3gqgd2UJ /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel go /usr/bin/git 29/001/test-emptgit GO111MODULE ache/go/1.25.8/x--show-toplevel git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha --show-toplevel go /usr/bin/git json' --ignore-pgit t layTitle git remo�� GOMODCACHE go /opt/hostedtoolcache/node/24.14.1/x64/bin/node -json GO111MODULE x_amd64/compile node (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha 60452/b047/_pkg_.a GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x^remote\..*\.gh-resolved$ -c 60452/b132/_pkg_.a GOPROXY ache/go/1.25.8/x64/bin/go GOSUMDB GOWORK 60452/b047/symab--show-toplevel sh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git tcfg GO111MODULE .cfg git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git 60452/b186/_pkg_git TE68/Ns65yq8CR2Zrev-parse ache/go/1.25.8/x--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel git /usr/bin/git /tmp/gh-aw-test-git remote /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /usr/bin/git -bool -buildtags /usr/bin/git git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha GOMODCACHE 64/pkg/tool/linux_amd64/asm /opt/hostedtoolcache/node/24.14.1/x64/bin/node LsRemoteWithRealgit LsRemoteWithRealrev-parse 64/pkg/tool/linu--show-toplevel /opt/hostedtoolcache/node/24.14.1/x64/bin/node /tmp�� No expressions here 64/pkg/tool/linux_amd64/compile /usr/bin/git 1902871643/.githgit GO111MODULE 64/pkg/tool/linu--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel x_amd64/compile /usr/bin/git -json t.go 64/pkg/tool/linu--show-toplevel /usr/bin/git remo�� -v 64/pkg/tool/linu.github/workflows/test.md /usr/bin/git y_with_explicit_git GO111MODULE ache/go/1.25.8/x--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha tags/v4 ache/go/1.25.8/x64/pkg/tool/linux_amd64/link /usr/bin/git ithub/workflows/git remote 6513118/b449/imp--show-toplevel git rev-�� --show-toplevel oCYZcF1Sl9Wcc/Bwtown9S7Z1cYupqT-3c/745bFA3tfgNJXPBQewev/0s9zQ7KoTest User /usr/bin/git s/test.md -trimpath 6513118/b449/_pk--show-toplevel git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha go1.25.8 -c=4 -nolocalimports -importcfg /tmp/go-build93260452/b214/importcfg -pack /home/REDACTED/go/pkg/mod/github.com/segmentio/encoding@v0.5.4/json/codec.go env -json GO111MODULE ode_modules/.bin-lang=go1.25 GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go ode_�� -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json go 64/bin/go GOINSECURE GOMOD GOMODCACHE go env th .prettierigno-goversion GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/archie.md 64/pkg/tool/linu-importcfg /usr/bin/infocmp -json GO111MODULE 64/pkg/tool/linu--show-toplevel infocmp -1 xterm-color 64/pkg/tool/linu-extld=gcc /usr/bin/git .a rotocol/go-sdk@vrev-parse 64/pkg/tool/linu--show-toplevel git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel 64/pkg/tool/linu-dwarf=false /usr/bin/infocmp .a GO111MODULE 64/pkg/tool/linu--show-toplevel infocmp -1 xterm-color 64/pkg/tool/linurev-parse /usr/bin/git .a 4.0/deviceauth.grev-parse 64/pkg/tool/linu--show-toplevel git (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha -bool l /usr/bin/git -errorsas -ifaceassert -nilfunc git rev-�� --show-toplevel -tests 64/pkg/tool/linux_amd64/vet -json GO111MODULE 64/bin/go 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha --show-toplevel 64/pkg/tool/linu-trimpath /usr/bin/infocmp mLsRemoteWithReagit mLsRemoteWithRearev-parse 64/pkg/tool/linu--show-toplevel infocmp -1 xterm-color 64/pkg/tool/linuTest User /usr/bin/git 831864852/.githugit til.go 64/pkg/tool/linu--show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha git-upload-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitmaster_branch1956694378/001' git-upload-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitmaster_branch1956694378/001' ache/node/24.14.1/x64/bin/node data/action_pinsgit GO111MODULE 64/bin/go git t-58�� sistency_InlinedImports2090186389/001/inlined-b.md rev-parse /usr/bin/git -json GO111MODULE ode_modules/.bin--show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha --symref l 1/x64/bin/node -json GO111MODULE 64/bin/go 1/x64/bin/node (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name 0/internal/language/compact/compact.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD is 64/pkg/tool/linux_amd64/compile k/gh�� 447493700 sNGC5r73k ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD erignore ache/go/1.25.8/x64/pkg/tool/linu-test.v=true (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 glpNKSOQr 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env .a tVIFB3NxN ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name @v1.1.3/cpu/arm/arm.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env .a go x_amd64/link GOINSECURE 64 GOMODCACHE x_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 oding@v0.5.4/ascii/equal_fold.go x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link env .a B-Au8vNkW /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE on GOMODCACHE hB/xToFZ4qTTaksZv6Js21q/K__OW8Y5origin (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name rotocol/go-sdk@v1.4.1/internal/mcpgodebug/mcpgodebug.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env .a GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 oding@v0.5.4/json/codec.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile k/gh�� .a LZuHOSZyr 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD erignore 64/pkg/tool/linux_amd64/link (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD is 64/pkg/tool/linux_amd64/compile 64/s�� 447493700 KjIdi_zAe ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE age/compact erignore ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 0/feature/plural-c=4 64/pkg/tool/linu-nolocalimports GOINSECURE tants GOMODCACHE 64/pkg/tool/linutest@example.com ache�� 1627731524/.github/workflows GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuremote (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name _3ywvdE5S 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuTest User k/gh�� .a GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm GOINSECURE go-sdk/internal/rev-parse erignore ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 0/message/catalog.go 64/pkg/tool/linux_amd64/compile GOINSECURE _wasm.o 64/src/internal/--git-dir ylQP4Z8/vCNYLdc7D8RXanEmFBss ache�� 1627731524/.github/workflows bBouUBHdz ache/go/1.25.8/x64/pkg/tool/linu-lang=go1.25 GOINSECURE chema/v6/kind GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-dwarf=false (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name rotocol/go-sdk@v1.4.1/internal/util/net.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD is 64/pkg/tool/linutest@example.com k/gh�� .a 3GMM57Ps3 ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE pguts erignore ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE byte_wasm.o 64/src/internal/--show-toplevel 64/pkg/tool/linux_amd64/compile ache�� .a diXaaNED5 ache/go/1.25.8/x64/pkg/tool/linu-buildmode=exe GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu/tmp/file-tracker-test1414334555/test2.lock.yml (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name ohNRO1y8b 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile k/gh�� 447493700 LamLkoYmy k GOINSECURE GOMOD erignore ache/go/1.25.8/x64/pkg/tool/linu-buildtags (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 ri/jsonschema/v6@v6.0.2/kind/kind.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile ache�� .a Bzwz7Kv-X 64/pkg/tool/linux_amd64/vet GOINSECURE chema/v6 GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE tomic_wasm.s (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE 64/pkg/tool/linumyorg env edOutput3879212408/001 pMTTxllzq 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/link (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git flow.lock.yml GOPROXY ser.test git rev-�� --show-toplevel ser.test /usr/bin/git rt.go rt_test.go eutil.test git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha til.go o 64/pkg/tool/linux_amd64/compile GOINSECURE a20poly1305 GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a R30X4Bcts ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE til GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu/tmp/go-build3456513118/b114/vet.cfg (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha e_wasm.s GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha th .prettierigno-goversion GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha th .prettierigno-s GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha .a dtNyzpRaw /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env tcfg pKmvAbdZx ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-buildtags (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE ther.o 64/src/crypto/in--show-toplevel 64/pkg/tool/linux_amd64/compile m/_n�� g_.a BytXhgNOP 64/pkg/tool/linux_amd64/link GOINSECURE tdrain GOMODCACHE 64/pkg/tool/linux_amd64/link (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json onrpc.go 64/bin/go GOINSECURE GOMOD GOMODCACHE wasm.s (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/owner/repo/contents/file.md
    • Triggering command: /tmp/go-build3456513118/b397/cli.test /tmp/go-build3456513118/b397/cli.test -test.testlogfile=/tmp/go-build3456513118/b397/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true -nolocalimports -importcfg /tmp/go-build93260452/b188/importcfg -pack env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE es/.bin/node GOINSECURE GOMOD GOMODCACHE go (http block)

If you need me to access, download, or install something from one of these locations, you can either:

… instead of marking valid workflows as invalid

When actionlint/zizmor/poutine is requested but Docker is unavailable,
the MCP compile tool previously returned valid:false for all workflows
without even attempting compilation. This was misleading because the
workflow itself compiled correctly.

Changes:
- Add DockerUnavailableError type in docker_images.go to distinguish
  persistent Docker unavailability from transient image-downloading errors
- CheckAndPrepareDockerImages now returns *DockerUnavailableError when
  Docker daemon is not running (vs errors.New for downloading)
- MCP compile tool handler detects DockerUnavailableError and falls back
  to running compile without the Docker tools, then injects a
  docker_unavailable warning into each result
- Add injectDockerUnavailableWarning helper to parse compile JSON output
  and append the warning without changing valid/invalid status
- Add unit tests for DockerUnavailableError type and injectDockerUnavailableWarning

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/efda6809-e1ec-497c-855d-ac6ff4161347

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix actionlint failure marking valid workflows as invalid fix: compile with actionlint/zizmor/poutine no longer marks valid workflows as invalid when Docker is unavailable Apr 8, 2026
Copilot AI requested a review from pelikhan April 8, 2026 06:24
@pelikhan pelikhan marked this pull request as ready for review April 8, 2026 11:47
Copilot AI review requested due to automatic review settings April 8, 2026 11:47
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes the MCP compile tool behavior when Docker is unavailable so that Docker-dependent static analysis (actionlint/zizmor/poutine) degrades gracefully, and workflow valid reflects actual compilation success rather than Docker availability.

Changes:

  • Introduces a typed DockerUnavailableError to distinguish “daemon not accessible” from transient image-pull situations.
  • Updates the MCP compile handler to retry compilation without Docker-based tools when Docker is unavailable and injects a docker_unavailable warning into results.
  • Adds tests covering the typed error behavior and warning injection semantics.
Show a summary per file
File Description
pkg/cli/mcp_tools_readonly.go Detects Docker-unavailable vs transient pull errors, compiles without Docker tools on the former, and injects warnings into JSON results.
pkg/cli/docker_images.go Adds DockerUnavailableError and returns it when the Docker daemon cannot be reached.
pkg/cli/docker_images_test.go Adds tests for the typed Docker-unavailable error and for warning injection behavior.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 3/3 changed files
  • Comments generated: 2

Comment on lines +134 to +136
// should still proceed without the static-analysis tools. After a successful
// compile the warning is appended to every workflow result so the caller
// knows linting was skipped — without marking valid workflows as invalid.
Copy link

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment above dockerUnavailableWarning says the warning is appended “after a successful compile”, but the code injects the warning whenever there is JSON output (including when compilation produced per-workflow validation errors). Please update the comment to match the actual behavior (warning is injected after the compile attempt, preserving each workflow’s valid/invalid status).

Suggested change
// should still proceed without the static-analysis tools. After a successful
// compile the warning is appended to every workflow result so the caller
// knows linting was skipped — without marking valid workflows as invalid.
// should still proceed without the static-analysis tools. After the compile
// attempt, the warning is appended to workflow results in the JSON output so
// the caller knows linting was skipped, while preserving each workflow's
// valid/invalid status.

Copilot uses AI. Check for mistakes.
Comment on lines +589 to +593
func TestInjectDockerUnavailableWarning_AddsWarningToValidResults(t *testing.T) {
// Simulate compile output where both workflows compiled successfully.
inputJSON := `[{"workflow":"a.md","valid":true,"errors":[],"warnings":[]},{"workflow":"b.md","valid":true,"errors":[],"warnings":[]}]`
warningMsg := "docker is not available (cannot connect to Docker daemon). actionlint requires Docker."

Copy link

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The injectDockerUnavailableWarning tests are added here in docker_images_test.go, but the helper being tested lives in mcp_tools_readonly.go. For consistency with the existing file-per-feature test layout (e.g., actionlint.go/actionlint_test.go, flags.go/flags_test.go), consider moving these tests into a new mcp_tools_readonly_test.go (or similar) to keep related tests discoverable.

Copilot uses AI. Check for mistakes.
@pelikhan
Copy link
Copy Markdown
Collaborator

pelikhan commented Apr 8, 2026

@copilot review comments

…s to mcp_tools_readonly_test.go

- Fix misleading comment on dockerUnavailableWarning: "after a successful compile"
  → "after the compile attempt, preserving each workflow's valid/invalid status"
- Move injectDockerUnavailableWarning tests from docker_images_test.go to new
  mcp_tools_readonly_test.go to match the file-per-feature test layout convention

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/adcf9dad-a2cd-496a-9de7-dfab6dc8c2a7

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copy link
Copy Markdown
Contributor Author

Copilot AI commented Apr 8, 2026

@copilot review comments

Addressed both review suggestions in commit 46bf487:

  1. Fixed the comment on dockerUnavailableWarning to say "after the compile attempt, preserving each workflow's valid/invalid status" instead of "after a successful compile"
  2. Moved injectDockerUnavailableWarning tests from docker_images_test.go to a new mcp_tools_readonly_test.go to match the file-per-feature test layout

@pelikhan pelikhan merged commit 75ead59 into main Apr 8, 2026
@pelikhan pelikhan deleted the copilot/fix-actionlint-failure-handling branch April 8, 2026 12:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[cli-tools-test] compile: actionlint failure marks valid workflows as invalid when Docker is unavailable

3 participants