Workflow security linter: duplicate-key checker false-positives on KYAML flow sequences (red on main since #1133) #1137

Defect

governance / Workflow security linter has been red on main since #1133 (the KYAML pilot), at c550314. Every PR inherits the red. Failing output:

FAIL .github/workflows/provisioning-check-reusable.yml: duplicate key(s): 'name' (line 49), 'uses' (line 50), 'with' (line 51), 'name' (line 61), …

The file has no duplicate keys. Its steps: is a KYAML flow sequence ([ { name: …, uses: … }, { name: …, … } ]), and yq '.jobs[].steps | length' parses 6 distinct step mappings. The duplicate-key checker apparently treats the whole flow sequence as one mapping. Per YAML-POLICY Y-1, gates must read YAML with a parser, so this gate asks a different question than YAML does.

Acceptance criteria

• The duplicate-key checker is scoped per mapping node, including flow-style {…} nodes inside flow sequences. Alternatively, it is replaced by a parser-backed check.
• Known-answer controls: provisioning-check-reusable.yml passes, and a planted genuine duplicate key inside one flow mapping still FAILs.
• governance / Workflow security linter is green on main.

Found while landing #1136, which defers this red here per AGENTS.md §5c item 3.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Hw7qg3u9PAP6b2oKyVTSVC