workflow's optional ignore contract. The dry-run caller in ci.yaml

[github-actions]

proves the input is accepted by GitHub's workflow schema; these assertions prove the value is

also forwarded to the shared scanner action when the real job runs.

actions/.github/tests/test-scan-todo-ignore-input.sh

Lines 3 to 5 in 247865f

	# Guards the reusable TODO workflow's optional ignore contract. The dry-run caller in ci.yaml
	# proves the input is accepted by GitHub's workflow schema; these assertions prove the value is
	# also forwarded to the shared scanner action when the real job runs.

#!/usr/bin/env bash

# Guards the reusable TODO workflow's optional ignore contract. The dry-run caller in ci.yaml
# proves the input is accepted by GitHub's workflow schema; these assertions prove the value is
# also forwarded to the shared scanner action when the real job runs.

set -euo pipefail

workflow=".github/workflows/scan-for-todo-comments.yaml"
action="create-issues-from-todos/action.yaml"

fail() {
  echo "FAIL: $*" >&2
  exit 1
}

[[ -f "$workflow" ]] || fail "missing workflow: $workflow"
[[ -f "$action" ]] || fail "missing action: $action"

input_type="$(yq -r '.on.workflow_call.inputs.ignore.type // ""' "$workflow")"
[[ "$input_type" == "string" ]] ||
  fail "ignore must be a string workflow_call input; got: ${input_type:-<missing>}"

input_required="$(yq -r '.on.workflow_call.inputs.ignore.required // false' "$workflow")"
[[ "$input_required" == "false" ]] ||
  fail "ignore must remain optional; got required: $input_required"

input_default="$(yq -r '.on.workflow_call.inputs.ignore.default // ""' "$workflow")"
[[ -z "$input_default" ]] ||
  fail "ignore must default to an empty pattern; got: $input_default"

forwarded="$(yq -r \
  '.jobs.todos.steps[]
   | select(.uses == "./.devantler-tech-actions/create-issues-from-todos")
   | .with.ignore // ""' "$workflow")"
# shellcheck disable=SC2016 # GitHub expression compared literally.
[[ "$forwarded" == '${{ inputs.ignore }}' ]] ||
  fail "ignore must be forwarded unchanged to create-issues-from-todos; got: ${forwarded:-<missing>}"

action_required="$(yq -r '.inputs.ignore.required // false' "$action")"
[[ "$action_required" == "false" ]] ||
  fail "the scanner action's ignore input must remain optional; got required: $action_required"

action_default="$(yq -r '.inputs.ignore.default // ""' "$action")"
[[ -z "$action_default" ]] ||
  fail "the scanner action's ignore input must default to empty; got: $action_default"

action_env="$(yq -r \
  '.runs.steps[]
   | select(.name == "📝 Create issues from TODOs")
   | .env.INPUT_IGNORE // ""' "$action")"
# shellcheck disable=SC2016 # GitHub expression compared literally.
[[ "$action_env" == '${{ inputs.ignore }}' ]] ||
  fail "the scanner action must bind INPUT_IGNORE to inputs.ignore; got: ${action_env:-<missing>}"

action_run="$(yq -r \
  '.runs.steps[]
   | select(.name == "📝 Create issues from TODOs")
   | .run' "$action")"
grep -q -- '--env INPUT_IGNORE' <<<"$action_run" ||
  fail "the scanner container invocation must pass INPUT_IGNORE"

echo "scan-for-todo ignore input contract enforced ✅"

[devantler]

🤖 Generated by the Agentic Engineer

This is a scanner false positive, and the root cause is worth fixing rather than just
closing the issue.

.github/tests/test-scan-todo-ignore-input.sh contains no TODO marker. Checked the exact
blob this issue links (247865fb): the only match is the word TODO inside ordinary prose
describing the tooling — "Guards the reusable TODO workflow's optional ignore contract" —
so the scanner is matching a bare word in a comment rather than a marker such as TODO:.
The title here is a mid-sentence fragment of that comment, which is the tell.

The scan also fired on the test that guards the TODO workflow's own ignore contract, so
this will recur on every run against that file. Closing this issue without changing the
matching rule (or adding an ignore for the path) just re-creates it.

Typed as Bug and left open deliberately: it is the tracking artifact for the matching
defect, not a real TODO to action.

[github-actions]

Closed in b0dc405.