Skip to main content
← Back to list
01Issue
BugOpenSwamp CLIPublic
AssigneesNone

Relationships

#2316 verify-build: codegen-verify guard reads .attributes.stdout on a file-type log, so every run fails with InvalidExpressionError

Opened by hammz · 9/21/2026

Problem

verification/workflow-verify-build.yaml guards its two codegen-verify steps on whether the change touched codegen/:

# lines 312 and 337
guard: "${{ data.latest('build-detect-' + run.id, 'log').attributes.stdout.contains('CHANGED_CODEGEN: true') }}"

That expression cannot evaluate. The log data a command/shell step writes is a file (type: file, contentType: text/plain) whose content is the captured output — it has no attributes map, and therefore no attributes.stdout. Evaluating the guard raises:

InvalidExpressionError: Invalid expression: No such key: stdout

>    1 | data.latest('build-detect-' + run.id, 'log').attributes.stdout.contains('CHANGED_CODEGEN: true')
                                                                 ^

The workflow then reports status: failed with failedStep: codegen-check, even though the step's guard should simply have evaluated false and skipped.

Impact

verify-build fails on every run, regardless of the change under verification. On a PR that touches no codegen at all, every real check passes and the run still comes back red:

setup                checkout                 succeeded   3.6s
detect-changes       changed-dirs             succeeded   0.5s
extension-checks     check-extensions         succeeded  51.2s
model-checks         check-models             succeeded   0.6s
codegen-verify       codegen-check            failed         —   <-- guard
codegen-verify       idempotency              skipped        —
upgrade-verify       check-upgrades           succeeded   0.6s
upgrade-verify       upgrade-path-test        succeeded   0.5s
cleanup              remove-worktree          succeeded   0.8s

Because verification-conventions.md says to proceed only when all non-skipped steps succeeded, and issue-lifecycle's link_pr is gated on verification_passed, this blocks the documented pre-PR flow outright. It also silently means the codegen idempotency gate has never actually run from this workflow.

Reproduction

cd swamp-extensions
SWAMP_WORKFLOWS_DIR=verification swamp workflow run verify-build \
  --repo-dir <swamp-repo> \
  --input commit=$(git rev-parse HEAD) \
  --input branch=$(git branch --show-current)

Observed on run d818b76b-7a75-472c-b964-bbd083bcd8f0.

Proposed fix

Read the step's log as file content rather than as an attribute — whatever the supported accessor is for a type: file data entry (content/text), e.g.

guard: "${{ data.latest('build-detect-' + run.id, 'log').content.contains('CHANGED_CODEGEN: true') }}"

If no content accessor exists in workflow expressions, the detect-changes step should write a structured resource (e.g. { changedCodegen: true }) that the guard can read via .attributes, instead of grepping stdout.

Worth checking the same pattern elsewhere: verification/workflow-verify-reviews.yaml uses guards on the same detect step and may have the same defect.

Environment

  • swamp: 20260918.211634.0-sha.bcaa9695
  • Repo: swamp-extensions, verification/workflow-verify-build.yaml
  • Discovered while verifying #2300; unrelated to that change.
02Bog Flow
◉OPEN○TRIAGED○IN PROGRESS○SHIPPED

Open

9/21/2026, 3:33:45 PM

No activity in this phase yet.

03Sludge Pulse

Sign in to post a ripple.