Repository navigation
fix(actions-example): show failed command output and link the artefact - #172
Merged
Merged
Conversation
A failed update, init, fmt or validate command's output went only to the processing artefact, so the Process candidate step log showed a one-line diagnostic and nothing else. Print the captured log to standard error before the diagnostic, where the workflow's ::add-mask:: redaction applies, unlike the artefact that already held the same log in plaintext. Artefact names identify the branch only by a ref hash, so the process job's summary now links the artefact its upload step published. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017bKKwZGvX1aVgy6vSxyPNe
run_bounded returns 124 before creating the log when the shared deadline has passed, so printing the missing log failed under errexit and turned a branch failure into an automation failure that stops publication. Print the log only when the stage produced one. The step-log assertion now compares bytes, so a log ending in blank lines is not a false failure, and the summary wording no longer reads as if the artefact lacked Terraform's logs. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017bKKwZGvX1aVgy6vSxyPNe
run_processing started the container on first use, usually inside an assertion that redirects its output, so a container that could not start exited the run with no visible reason. Start it in setup_processing_workspace, which runs unredirected. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017bKKwZGvX1aVgy6vSxyPNe
A print that failed or was interrupted before write_result let the EXIT trap record an automation failure, stopping publication. Record the branch failure first and print the log from the result directory. The docs now say step logs outlive the seven-day artefact, so an unredacted multi-line credential stays there longer, and comments made inaccurate by the change are corrected. The deadline test checks that a stage that never started prints only its diagnostic. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017bKKwZGvX1aVgy6vSxyPNe
Consumers copy the processing script, so the branch_command comment is cut to three lines, and the deadline test names its diagnostic once. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017bKKwZGvX1aVgy6vSxyPNe
The readiness check for curl, jq and timeout exited the run with no message when one was missing. Fail with a message naming them. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017bKKwZGvX1aVgy6vSxyPNe
The retention caveat now follows the explanation of why a multi-line value may not be redacted, the branch_command comment says the printed copy is what the masks apply to, and the README links the section that describes masking instead of naming a heading that does not exist. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017bKKwZGvX1aVgy6vSxyPNe
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
When a
Process candidatestep failed, the Actions console showed only a one-line diagnostic such asprocessing status error: terraform init failed for Terraform root ..run_boundedcaptures every command's output tologs/in the processing artefact, and nothing printed it. The artefact's name identifies the branch only by a SHA-256 ref hash, so when several branches failed it was hard to tell which artefact belonged to which job.Keeping Terraform's output off the console bought no confidentiality: the artefact already holds the same logs without redaction, and anyone with read access to the repository can download it. The console at least applies
::add-mask::.What changes
terraform init,fmtorvalidatefails,branch_commandprints the command's captured log to standard error before the diagnostic, so the step log shows the cause with the workflow's masks applied. A stage that starts after the shared deadline never runs and has no log, so nothing is printed and it stays a branch failure rather than an automation failure. Without that check,awkwould fail under errexit.id: upload, and the report step adds- [Processing artefact](<url>)fromsteps.upload.outputs.artifact-url. There is no link when the upload reported no URL.docs/ADVANCED-USAGE.mddescribe where a failed command's output now appears.setup_processing_workspacestarts the processing container, instead of the firstrun_processingcall doing it. That call is usually inside an assertion that redirects its output, so a container that could not start (for exampleexec format errorwithout amd64 emulation) exited the run with no visible reason.Tests
assert_failure_prints_command_logcompares the step log byte for byte with the captured log followed by the diagnostic. It covers the init conflict and the update/format failures.test_processing_records_a_deadline_that_expires_between_stagesusestimeoutanddateshims to expire the deadline afterterraform init, then checks for abranch-validationresult with status 124.test_workflow_reports_the_processing_resultchecks the wiring and the link or its absence.make test-github-actionspasses, as domake docs-check,make shellcheckandmake actionlint.🤖 Generated with Claude Code
https://claude.ai/code/session_017bKKwZGvX1aVgy6vSxyPNe