[Schema Consistency] Schema consistency check report - 2026-08-22

[github-actions[bot]]

🔍 Schema Consistency Check - 2026-08-22

🔍 Schema Consistency Check - 2026-08-22

Summary

• Inconsistencies Found: 4
• Categories Analyzed: Schema, Parser, Documentation, Workflows
• Strategy Used: Schema permission and cache-memory targeted diff
• New Strategy: No
• AWF Drift Status: Canonical-source retrieval degraded; any AWF drift observations are non-authoritative only.

Critical Issues

1. permissions schema omits parser-supported scopes

• Schema: pkg/parser/schemas/main_workflow_schema.json defines permissions via $defs.github_actions_permissions, but that schema does not include secret-scanning-alerts.
• Parser/compiler: pkg/workflow/permissions.go defines PermissionSecretScanningAlerts, and pkg/workflow/safe_outputs_app_config.go emits permission-secret-scanning-alerts.
• Impact: A frontmatter file using a parser-supported permission can fail schema validation and be absent from generated schema-based docs.
• Evidence:
  • pkg/workflow/permissions.go:101
  • pkg/workflow/safe_outputs_app_config.go:563
  • no matching schema enum/property entry in $defs.github_actions_permissions

2. permissions docs omit several schema/parser-supported scopes

• Schema/parser: support attestations, models, and copilot-requests under permissions.
• Docs: docs/src/content/docs/reference/permissions.md documents copilot-requests, but the main “Key read permission scopes” list and GitHub App-only section do not mention attestations, models, or secret-scanning-alerts.
• Impact: Users consulting the human doc can miss supported scopes or incorrectly assume they are unavailable.
• Evidence:
  • schema: $defs.github_actions_permissions.properties.attestations/models/copilot-requests
  • parser: pkg/workflow/permissions.go:62, :78, :101
  • docs: docs/src/content/docs/reference/permissions.md

Documentation Gaps

3. cache-memory docs claim default allowed-extensions is empty/all files allowed, but code/schema default to a restricted allowlist

• Docs: docs/src/content/docs/reference/cache-memory.md says default is “empty/all files allowed”.
• Schema: tools.cache-memory.allowed-extensions description says default is [".json", ".jsonl", ".txt", ".md", ".csv"].
• Parser/compiler: pkg/workflow/cache_config.go applies constants.DefaultAllowedMemoryExtensions when none are provided.
• Impact: Users may think arbitrary file types persist by default, but runtime behavior strips/disallows them.
• Evidence:
  • docs/src/content/docs/reference/cache-memory.md:29,43
  • pkg/parser/schemas/main_workflow_schema.json around tools.cache-memory.allowed-extensions
  • pkg/workflow/cache_config.go:292-295

4. cache-memory docs imply retention-days extends cache lifetime, but schema/compiler treat it as artifact retention only

• Docs: page intro and examples suggest cache-memory has “7-day retention” and that retention-days can “extend access beyond cache expiration”.
• Schema: retention-days is described as uploaded artifact retention.
• Compiler behavior: retention-days is parsed as artifact retention metadata; the underlying Actions cache lifetime is still governed by GitHub cache behavior.
• Impact: Users may misconfigure workflows expecting persistent cache restoration beyond normal cache eviction windows.
• Evidence:
  • docs/src/content/docs/reference/cache-memory.md:8,28,95
  • schema descriptions for tools.cache-memory.retention-days
  • parser path: pkg/workflow/cache_config.go parses retention-days but does not alter cache eviction semantics

Workflow Violations / Real-World Checks

• No top-level workflow frontmatter keys were found outside the main schema (field_gaps.in_used_not_schema was empty in /tmp/gh-aw/agent/schema-diff.json).
• Existing workflows do exercise parser-only permission features outside the human docs, e.g. .github/workflows/release.md uses attestations: write.

Parser ↔ Documentation Notes

• network: {} deny-all semantics are consistent between docs and parser (docs/src/content/docs/reference/network.md:21, pkg/workflow/engine.go comments, pkg/workflow/engine_firewall_support.go).
• Top-level AWF config drift was not treated as authoritative because /tmp/gh-aw/agent/awf-config-drift.json reported degraded: true.

Recommendations

1. Add secret-scanning-alerts to $defs.github_actions_permissions in pkg/parser/schemas/main_workflow_schema.json.
2. Audit permissions.md against pkg/workflow/permissions.go and document every currently supported scope, including attestations, models, and secret-scanning-alerts.
3. Fix cache-memory.md to state the true default allowed-extensions allowlist and explain that omitted config is not equivalent to “all files allowed”.
4. Reword cache-memory.md so retention-days is clearly artifact-retention-only and does not extend GitHub Actions cache lifetime.
5. Consider adding a regression check that diffs permissions.go constants against $defs.github_actions_permissions to prevent future schema drift.

Strategy Performance

• Strategy Used: Schema permission and cache-memory targeted diff
• Findings: 4
• Effectiveness: High
• Should Reuse: Yes

Next Steps

• Fix schema definitions for permissions scope coverage
• Update permissions documentation for missing scopes
• Correct cache-memory default/retention documentation
• Add regression validation for schema ↔ parser permission alignment

Generated by ✅ Schema Consistency Checker · gpt54 · 38.3 AIC · ⌖ 11.5 AIC · ⊞ 8.9K · ◷

• expires on Aug 22, 2026, 9:37 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-23T05:37:00.588Z.

Closed by Workflow