ci: block releases whose action.yml cannot be loaded

[SafeEval]

First: the reported v1 issue is already fixed

The other session's follow-up said v1 still points at 84abbef with the broken action.yml. That was true when it was written, but is stale now. Verified:

v1      -> 202ec098c184db396450308dff91596643c52fdd   (== v1.1.0)
v1.0.0  -> 84abbef298fc3ea70c0978ee0aa30ed28f1ee8f7   (broken, kept as history)

v1 action.yml PARSES OK

v1 was moved by hand earlier, and the release workflow now moves it automatically on every release. @v1 resolves to working code. No action needed there.

The real gap: two holes in the existing guard

The release job had a YAML parse check, but:

1. The immutable tag was pushed before anything validated it. The version job tagged and pushed with no check; only the alias move was guarded. A tag is public and permanent the instant it exists — validating afterwards can't recall it. That's why v1.0.0 will always name a broken action.

2. Parsing isn't loadability. A file can be valid YAML and still be rejected by GitHub. All of these parse fine and are unusable:

name: x
description: y          # no runs: at all

runs:
  using: composite
  steps:
    - run: echo hi      # run: without shell:

The guardrail

.github/validate-action.py checks the structure GitHub actually requires — name/description/runs, runs.using, non-empty composite steps, every step having uses: or run:, run: steps having shell:, and inputs being well-formed mappings with descriptions. It reports every problem, not just the first.

Wired at three points, each strictly before a tag write:

Where	Guards against
CI, every PR	broken action.yml reaching main
version job, before git push origin $next	an immutable broken tag existing at all
release job, before the alias moves	@v1 ever pointing at something unloadable

I verified the ordering programmatically rather than by reading — validation precedes the tag push and the alias move in both jobs.

Tests

12 cases, both directions, run in CI — a guardrail that can't fail isn't one:

• Catches the exact dedented-heredoc shape that shipped as v1.0.0, plus missing runs:, run: without shell:, empty steps, steps with neither uses: nor run:, runs: without using:, inputs missing descriptions, non-mapping documents, and unreadable files
• Accepts a valid minimal action and one using a uses: step

Confirmed against the real artifacts: current action.yml passes, v1.0.0's fails with not valid YAML: mapping values are not allowed here.

actionlint clean; all three YAML files parse.

Note

This is a ci: commit, so merging deliberately cuts no release — the guardrail lands without a version bump. The next fix:/feat: will be the first release to pass through it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VSrrciEDBTuFNMtKocScML