Modernize CI: harden workflow, replace JSON validator, add dependabot#1549
Merged
Modernize CI: harden workflow, replace JSON validator, add dependabot#1549
Conversation
cblecker
force-pushed
the
modernize-ci-workflow
branch
2 times, most recently
from
218c526 to
8540e53
Compare
Upgrade checkout to v6 with persist-credentials: false, add read-only permissions, replace unmaintained Docker-based JSON validator with check-jsonschema, fix invalid \\! escape in schema email pattern, and add dependabot config for automated action updates. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Christoph Blecker <admin@toph.ca>
cblecker
force-pushed
the
modernize-ci-workflow
branch
from
8540e53 to
6637729
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
permissions: contents: read(least-privilege), upgradeactions/checkoutto v6 withpersist-credentials: falsedocker://orrosenblatt/validate-json-action:latestcontainer forcheck-jsonschema(from thepython-jsonschemaorg — maintainers of the reference Python JSON Schema implementation)Schema change detail
The email regex pattern in
schema.jsoncontained\!— a backslash-escaped exclamation mark. The!character is not a special regex character and does not need escaping. Per ECMA-262 (the JavaScript regex standard),\!is technically an invalid escape sequence.The old validator (AJV, via the Docker action) was lenient about this and silently treated
\!as!.check-jsonschemacorrectly rejects the invalid escape per the spec. The fix is simply removing the unnecessary backslash:\!→!.There is no behavioral change — both
\!(where tolerated) and!match the literal!character. The set of valid/invalid email strings matched by the pattern is identical before and after this change.Verification
check-jsonschema --schemafile schema.json people.jsonpasses locally against the currentpeople.jsonTest plan
validate.ymlfor correctnessschema.jsonpattern changedependabot.ymlconfig