From 1973a0f56f69371b9cec44c717fe32df7bbb41c4 Mon Sep 17 00:00:00 2001 From: mateo-berri <277851410+mateo-berri@users.noreply.github.com> Date: Tue, 11 Aug 2026 11:34:09 -0700 Subject: [PATCH] fix: exempt object-filter dereferences from the workflow arithmetic ban --- tests/code_coverage_tests/check_workflow_startup_safety.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/tests/code_coverage_tests/check_workflow_startup_safety.py b/tests/code_coverage_tests/check_workflow_startup_safety.py index cf150daef4c..7c2bfb813af 100644 --- a/tests/code_coverage_tests/check_workflow_startup_safety.py +++ b/tests/code_coverage_tests/check_workflow_startup_safety.py @@ -11,7 +11,8 @@ because CI cannot enforce them on itself. ``${{ a + b }}`` is a startup failure, not a value. Only ``+`` and ``*`` are flagged: ``-`` appears in hyphenated input names like ``inputs.timeout-minutes`` and ``/`` inside ref strings, so neither can be told apart from arithmetic by - inspection alone. + inspection alone. A ``.*`` is the object-filter dereference (as in + ``labels.*.name``), not multiplication, so it is exempt. 2. Callers of the reusable unit-test workflow keep the job timeout at or above the test budget plus the setup ceilings plus the runner overhead below. Otherwise the job deadline preempts pytest inside its own advertised budget, @@ -43,6 +44,7 @@ JOB_OVERHEAD_MINUTES: Final = 5 EXPRESSION: Final = re.compile(r"\$\{\{(?P.*?)\}\}", re.DOTALL) QUOTED: Final = re.compile(r"'[^']*'") +OBJECT_FILTER: Final = re.compile(r"\.\*") ARITHMETIC: Final = re.compile(r"[+*]") MATRIX_REF: Final = re.compile(r"^\$\{\{\s*matrix\.(?P[\w-]+)\s*\}\}$") @@ -75,7 +77,7 @@ def parse_workflow(text: str) -> WorkflowFile | str: def arithmetic_expressions(text: str) -> Iterator[str]: for match in EXPRESSION.finditer(text): body: Final = match.group("body") - if ARITHMETIC.search(QUOTED.sub("", body)): + if ARITHMETIC.search(OBJECT_FILTER.sub("", QUOTED.sub("", body))): yield body.strip()