Problem: step-syntax defects, quoting mistakes, or permission-flag errors in release.yml surface only at first tag execution (publish time), when the release pipeline is already running. The npm CI job gates the JS/Deno suites and check-matrix but neither validates workflow YAML syntax nor lints GitHub Actions expressions.
Suggested fix (advisory, defer): add actionlint (or a YAML-parse + expression smoke validation) to the npm CI job for both ci.yml and release.yml, or extend check-matrix to validate that every job/step parses.
Source: branch comment-checker-npm @ 23dedfd (PR link backfilled after ship).
Metadata: Severity: P2 / Confidence: 50 / Reviewer(s): maintainability / Finding ID: workflow-yaml-validation-absent
Problem: step-syntax defects, quoting mistakes, or permission-flag errors in release.yml surface only at first tag execution (publish time), when the release pipeline is already running. The npm CI job gates the JS/Deno suites and check-matrix but neither validates workflow YAML syntax nor lints GitHub Actions expressions.
Suggested fix (advisory, defer): add actionlint (or a YAML-parse + expression smoke validation) to the npm CI job for both ci.yml and release.yml, or extend check-matrix to validate that every job/step parses.
Source: branch
comment-checker-npm@ 23dedfd (PR link backfilled after ship).Metadata: Severity: P2 / Confidence: 50 / Reviewer(s): maintainability / Finding ID: workflow-yaml-validation-absent