🐛🧑‍💻 - Bugbot rejects documented checkout free self repository Action references that already ran successfully #770

Is there an existing issue for this?

• I have searched the existing issues.

Searches for checkout-free, self repository plus Bugbot, and invalid local action found no matching report. #605 concerns Git authentication; #647 concerns verification hooks. #739 records a different false external Action input claim; this report is about GitHub.com workflow syntax and an already successful checkout-free action.

Which actions are affected?

Pull Request

Which platforms are affected?

Linux

Description

Bugbot marks GitHub's supported checkout-free self-repository Action reference as invalid and recommends replacing it with a workspace-relative reference. The assertion contradicts the current GitHub.com documentation and multiple successful real executions, including the production release that has just completed.

Consumer: vypdev/zstandard PR178, head/master 60ac0b924549e3bfc14d45ab217bdc42519bbe64, target/develop 22eb4de4ce8f5d959b735cb4c7a91c3ca35cf73e. Source tree 36ccfe6582bbd6eb4b619bb9bae02d8789cb67e8.

Finding: comment4404898810, created2026-10-28T19:04:46Z; medium reliability, confidence91%; thread PRRT_kwDONFe3186xRyOn; finding ID check_action_versions.py:32:accepts-invalid-local-action-paths; fingerprint fp-52ed7d79; semantic key sf-7fd89e73. It is attached to LEFT line32 of .github/scripts/check_action_versions.py.

The current checker intentionally exempts ./ and $/.github/actions/ prefixes from its remote Action version-tag rule. Actual local references in the changed workflows include:

uses: $/.github/actions/checkout-release-source

Bugbot claims that the $/ form is neither a local action path nor a valid remote reference, that GitHub cannot resolve the existing references, and that affected jobs cannot start. Its proposed fix removes the $/ exemption and replaces the actual workflow uses with ./.github/actions/....

That claim is false for this GitHub.com repository:

• GitHub workflow syntax: self-repository reference documents $/path/to/action as the same repository at the running commit, without a prior checkout. The reference must not append an explicit ref. The consumer's actual reference follows that shape.
• GitHub's action usage guide recommends this syntax and distinguishes it from ./, which reads the checked-out workspace and needs an earlier checkout.
• This is GitHub.com, not a GitHub Enterprise Server deployment with a different availability boundary.
• Real immutable-tag validator123031685987 successfully ran the checkout-free reference at the exact accepted1.5.3 commit. Its second step is resolved by GitHub to vypdev/zstandard/.github/actions/checkout-release-source@60ac0b924549e3bfc14d45ab217bdc42519bbe64, then successfully validates provenance, preparation, metadata and generated assets.
• Real publisher123033251432 also successfully resolved the same first-step Action. Attempt3 of the release workflow completed successfully, reused all ten already public1.5.3 packages, and completed the actual GitHub Release.
• Package contract40750567025, job123035829964 also passed. This alone is not proof of platform syntax support; the documentation and real workflow executions above independently establish that.

The wrapper is intentionally used before the workspace checkout: it safely retires only owned inherited shallow Git metadata and performs a complete-history checkout from the trusted workflow revision. Replacing it with a workspace-relative path would require that action's source to already exist in the workspace, defeating the first-step bootstrap and risking missing/stale inherited action code. We have not applied the suggestion or performed an experimental publication to prove a regression.

The version-tag check is not claimed to be a complete grammar validator for arbitrary hypothetical paths. A separate hypothetical issue such as an illegal ref suffix would need an actual example and the correct platform contract. All references cited by this finding are valid checkout-free local references without such a suffix. GitHub's internal resolved SHA in job logs is not a literal remote Action pin in the consumer workflow.

Expected: ground workflow syntax claims in the current supported platform/host contract and the actual reference. Do not confidently mark a documented syntax as impossible when the same revision's workflow has already resolved and run it. Preserve valid self-repository references; avoid changing bootstrap behavior based on stale syntax knowledge.

Reproducing the issue

1. Open the exact consumer PR/head above. Review the exemption at current source line32 and the first-step checkout-free references in the release and publish workflows.
2. Run the normal installed PR review. Copilot PR run40750567342 / job123035833745 succeeds and posts the false finding.
3. Compare its claimed platform grammar with the two official GitHub.com references above (checked2026-10-28) and the successful production validator/publisher steps at the exact source SHA.
4. Observe that the recommended replacement is not equivalent for an Action that must run before checkout. No provider mutation or unsupported syntax harness is needed to verify the contradiction.

Suggested upstream coverage: supported self-repository refs on GitHub.com; host/version applicability instead of universal claims; plain workspace-relative refs that do require checkout; actual malformed self refs with explicit suffixes; preserve contributor version-tag policy independently from GitHub's internal action-resolution logs. The review should cite an authoritative current contract or qualify uncertainty rather than invent a universal rule.

copilot Version

vypdev/copilot@v3, resolved by this real PR job to f5e5a4cf9a80248994469cd88ad55eecab5b95ca (3.10.6). Existing settings: agent-model gpt-6-luna, findings-model gpt-6-luna, bugbot-effort smart. No model, permission, approval policy, credential or generated workflow changes were made.

Relevant Log Output

2026-10-28T19:03:05.2060653Z Download action repository 'vypdev/copilot@v3' (SHA:f5e5a4cf9a80248994469cd88ad55eecab5b95ca)
2026-10-28T19:03:09.5520375Z bugbot-effort: smart
2026-10-28T19:03:09.5523509Z agent-model: gpt-6-luna
2026-10-28T19:03:09.5524468Z findings-model: gpt-6-luna

The consumer validator and publisher steps above are successful actual GitHub Actions runs. All nine downloaded release checksum entries match the frozen candidate and published package assets. No task-generated distribution was rebuilt locally.

Additional context and comments

The maintainer requested detailed upstream reports for any erroneous Copilot behavior, leaving engine changes to its maintainers. We preserve Copilot, its installed profile/generated workflows, credentials, approval policy and remote Action version tags. The false-positive thread will be answered with the primary evidence and resolved by normal human review; source stays unchanged.

The same PR currently has Apple runner failures whose native annotations explicitly show host disk exhaustion. Those are independent infrastructure failures and are not attributed to Bugbot or to the self-repository syntax. #740's tag-push issue-resolution fix has already successfully completed the normal release hooks in the same operation; that separate fix is working.