feat(tsconfig-gate): follow reusable workflows

[jonathanong]

Summary

• follow local reusable workflow calls when tsconfig-gate-coverage proves CI typecheck coverage
• propagate caller triggers and typed boolean inputs through acyclic call chains without combining partial callers
• reject invalid contracts and bindings, and document the supported static subset
• add a Filaments-shaped fixture covering reusable typecheck jobs

Why

Repositories commonly keep project typechecks in a reusable workflow invoked by one or more path-filtered callers. The rule previously scanned only direct run: steps in those callers, so a valid CI gate was invisible and downstream repositories had to retain duplicate local policy code.

Validation

• cargo test -p no-mistakes tsconfig_gate_coverage (58 passed)
• cargo clippy -p no-mistakes --all-targets --all-features -- -D warnings
• cargo fmt --all -- --check
• cargo llvm-cov --workspace --all-features --lib --bins --tests --fail-under-lines 99 --fail-under-functions 99 --show-missing-lines (5,267 tests; 99.03% functions; 99.12% lines)
• independent implementation review completed with no remaining blockers

Safety

This is a static-analysis expansion only. Unsupported, remote, missing, malformed, or cyclic call paths do not contribute coverage. Dynamic expressions remain fail-open only where their runtime value is inherently unknown.

Refs jonathanong/filaments#9225

Shepherd Journal

• Split reusable-workflow input and step scanning into focused submodules after the repository max-file-lines guard identified both new modules as oversized.

• Rejected Sourcery review PRR_kwDOSaSRXM8AAAABI6_MzA: the persistent active-path set intentionally isolates sibling recursion and call graphs are small; invalid bindings must not earn gate coverage, while workflow-topology diagnostics own configuration reporting.

• Addressed CodeRabbit review PRR_kwDOSaSRXM8AAAABI7ATFA: normalized compact always expressions, simplified recursive scans, hoisted runner classification, documented direct-trigger defaults, consolidated workflow fixtures, and added caller-working-directory coverage. Kept input helpers pub(crate) because the parent re-export is consumed by the sibling reusable scanner, and kept invalid-call diagnostics in workflow-topology because malformed calls must earn no coverage without duplicating rule ownership.

• Addressed Codex review PRR_kwDOSaSRXM8AAAABI7BARw: each direct activation now rejects invalid local call contracts, missing or non-callable callees, cycles, and chains beyond GitHub’s ten-workflow limit; input and secret names resolve case-insensitively with collision checks; required inputs and secrets must be supplied. Remote calls remain opaque, and an independent valid root activation may still establish coverage.

• Addressed Codex review PRR_kwDOSaSRXM8AAAABI7EE1A: caller input bindings were already corrected case-insensitively in the prior push, and reusable-call jobs now accept only GitHub’s documented supported keys before any skip/enforcement analysis, so mixed uses/runs-on/steps shapes cannot earn coverage.

• Addressed the Codecov patch gate: split grouped invalid-caller fixtures so every defensive input/secret/cycle/remote branch executes independently. Focused llvm-cov now reports no uncovered lines in the two previously flagged scanner files.

• Review PRR_kwDOSaSRXM8AAAABI7LYxQ: accepted all three findings. Commit 897c1ca recognizes compact boolean expressions, resolves literal-first input comparisons, and rejects noncanonical local reusable targets before traversal; focused workflow tests plus the 64-test gate suite, clippy, repository check, formatting, diff checks, and focused coverage pass.

• Rejected CodeRabbit review PRR_kwDOSaSRXM8AAAABI7NWJg: reusable-call validation is intentionally activation-wide. GitHub validates static local reusable calls even when their job condition is false, so a missing, cyclic, malformed, or contract-invalid sibling makes that root workflow unusable; a separate valid root still earns coverage. Skipping only the bad job would restore false CI credit.

• Review PRR_kwDOSaSRXM8AAAABI7Omfg: accepted all three findings. Commit 01c322c validates raw workflow_call declaration containers, rejects backslash path-normalization bypasses, and excludes static zero-instance matrices while failing open for include-created or dynamic instances. Focused regressions, 65 gate tests, clippy, repository check, formatting, diff checks, and focused coverage pass.

• Review PRR_kwDOSaSRXM8AAAABI7TP6Q: accepted all four findings. Commit 4421813 rejects unknown workflow_call keys and malformed remote targets, normalizes needs identifiers case-insensitively, and adds a per-root activation memo keyed by path, normalized inputs, and ancestor set. An eight-way repeated-call regression demonstrates bounded traversal. Focused tests/coverage, 67 gate tests, clippy, repository check, formatting, and diff checks pass.

• Review PRR_kwDOSaSRXM8AAAABI7aQ2Q: accepted all four findings. Commit 116ce22 validates nested workflow_call declaration keys/types, rejects missing or malformed jobs and cyclic/unknown needs graphs, and proves zero matrix instances after static exclusions. Validation was split into submodules to preserve source caps; 71 gate tests, focused full-line coverage, clippy, repository check, formatting, and diff checks pass.

• CodeRabbit review PRR_kwDOSaSRXM8AAAABI7gmkg: accepted all four findings. Commit d0893d3 uses one normalized/validated GitHub job-ID path, requires supported input types and output values, and exposes an internal computation count so the depth-9 fan-out test asserts exactly nine activation computations. The former numeric job fixture was corrected to a valid named job. 71 gate tests, focused full-line coverage, clippy, repository check, formatting, and diff checks pass.

• Review fix bb60d74: invalidate an activation for malformed reusable-call binding containers or ambiguous/non-executable steps, and enforce GitHub’s 256-job limit against the final static matrix after exclude and additive include processing. Added activation-level and focused schema regressions; 75 focused tests, Clippy, repository no-mistakes check, formatting, and diff checks pass.

• Review fix 423e5c9: model omitted/falsy and known-truthy nonboolean reusable inputs separately, preserve conservative boolean-comparison behavior, validate all workflow_call declaration identifiers/collisions, and parse GitHub bracket input access with ordinary whitespace. Bracket keys intentionally accept documented single-quoted expression strings; double-quoted expression literals are invalid in GitHub. Split input regressions to retain the 500-line test cap; 78 focused tests, Clippy, repository checks, formatting, and diff checks pass.

• Review fix d3bea2f: enforce the 50-unique reusable-workflow budget across each complete top-level activation, deduplicating canonical local and full remote targets while counting nested and statically skipped calls. Reject malformed strategy containers while retaining expression-valued dynamic matrices. Added 50/51, duplicate, nested local+remote, skipped-overflow, and malformed-strategy regressions; 80 focused tests, Clippy, repository checks, focused coverage, formatting, and diff checks pass.

• Review fix 2ba028c: require exact input identifiers, static valid reusable refs, known complete workflow trigger maps, executable action references, and statically valid strategy/matrix shapes; count object-valued matrix choices toward the 256-job limit. The malformed-strategy finding was already fixed in d3bea2f and is covered alongside literal malformed matrices. Added activation-level regressions; 81 focused tests, Clippy, repository checks, focused coverage, formatting, and diff checks pass.

• Review fix ddf5d2d: require every job to choose exactly one execution surface—reusable workflow uses or a nonempty steps sequence—so an incomplete sibling cannot coexist with credited TypeScript coverage. Added unit and activation regressions; 81 focused tests, Clippy, repository checks, formatting, and diff checks pass.

• Codecov patch coverage at ddf5d2d reported 12 uncovered lines (98.82% vs 99%); added behavioral unit coverage for truthy nonboolean expression semantics and malformed input/secret bindings. Focused llvm-cov now reports zero missed lines in conditions.rs and conditions/inputs.rs; all 84 tsconfig-gate tests and clippy -D warnings pass.

• Applied review PRR_kwDOSaSRXM8AAAABI8Di9g: validate every direct caller trigger declaration before activation, require exact lowercase secrets: inherit, and accept only one nonempty expression wrapper for dynamic inputs/matrices. Added root-wide sibling regressions for all three invalid caller shapes; focused gate tests, clippy -D warnings, and llvm-cov pass.

• CI AST analysis correctly enforced rust-no-inline-tests on the new condition-state unit test. Moved it to workflow/conditions/tests.rs; the focused tests and target/debug/no-mistakes check now pass.

• Applied review PRR_kwDOSaSRXM8AAAABI8MlcQ using GitHub Actions current documented event catalog: removed nine webhook-only event names, added image_version, and added unit coverage for every removed name plus a root-wide repository-trigger regression. All 86 gate tests and no-mistakes check pass.

• Applied the unmatched-expression-delimiter finding with quote-aware brace validation and regressions for extra/open/interior braces, unterminated strings, and valid quoted braces. Rejected the skipped-overflow suggestion: GitHub documents the 50-target cap statically per caller file and nested call tree; retained skipped-call counting and added a zero-instance matrix regression.

• Applied review PRR_kwDOSaSRXM8AAAABI8RgSg: trigger configs now reject malformed containers while preserving strict schedule cron sequences; ordinary jobs reject unknown keys; empty steps are invalid. Added all-or-nothing sibling regressions and a valid mixed push+schedule case. All 87 gate tests, clippy, and no-mistakes check pass.

• Codex review: distinguish dynamic matrix expressions from invalid static axes and cap static enumeration so late exclusions cannot create exponential scans.

• Codex review: replace delimiter-only expression recognition with a bounded grammar parser and reject statically incompatible literal input bindings.

• Codex review: validate complete step/job condition schemas and canonical remote owner/repository names before any sibling can establish coverage.

• Review round 29: fixed all four false-credit paths by restricting expression functions and static literal truthiness, validating workflow/job/trigger schemas, and propagating zero-instance matrices through needs; added actionlint-aligned regressions and split validators to satisfy the 200-line policy.

• Rejected the one-argument format() suggestion: GitHub’s current expressions reference explicitly requires both the format string and at least one replaceValue, so the existing minimum arity of two is correct.

• Rejected the 10-input workflow_dispatch suggestion: current GitHub Actions documentation permits 25 top-level inputs, so the validator and boundary tests enforce 25 rather than an obsolete lower limit.

• Rejected requested/rerequested check_suite activity types: current GitHub Actions documentation lists only completed for check_suite, while rerequested belongs to check_run, so the validator remains completed-only.

• GitHub documentation currently disagrees on reusable-call secret contexts: the field-specific syntax page lists github/needs/secrets, while the current context-availability matrix also lists strategy/matrix/inputs/vars. Chose the broader context matrix to avoid false negatives while continuing to reject every status and special function at this key.

• Split workflow condition accessors into a focused module to retain the repository’s 200-code-line maximum without a lint exception, while preserving static event, matrix, and skipped-step state resolution.

• Added a root static fixture and focused behavioral regressions for workflow event access, skipped-step outcomes, nested matrices, queue concurrency, context validation, expression parsing, and port mappings. The reversed static port range path now rejects invalid ranges without eagerly evaluating an underflowing subtraction.

• Addressed review PRR_kwDOSaSRXM8AAAABJBSoRw with typed direct workflow inputs, only synthetic outcomes for statically skipped steps, bracketed step outcome resolution, literal matrix-axis evaluation, aligned reusable-secret and runner contexts, and the GitHub day-of-week cron range.

• Direct repository events do not bind workflow_call defaults; direct input analysis now models GitHub type-specific empty values (false, 0, empty string), preserving fail-closed tsconfig-gating behavior.

• Rejected the workflow_dispatch ten-input suggestion: GitHub.com documents a 25 top-level input limit (https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax and https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/trigger-a-workflow). The 10-input limit is GHES-specific, and this GitHub.com analyzer has no GHES target semantics.

• Rejected the jobs-only reusable-output and no-env job-default suggestions: GitHub’s current context table (https://docs.github.com/en/enterprise-cloud@latest/actions/reference/workflows-and-actions/contexts) documents github, jobs, vars, and inputs for on.workflow_call.outputs.<output_id>.value, and github, needs, strategy, matrix, env, vars, and inputs for jobs.<job_id>.defaults.run. The validator retains those documented contexts and only rejects unavailable ones such as secrets.

• Rejected the check_suite activity suggestion: GitHub Actions documents only completed for on.check_suite.types (https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows). requested and rerequested are GitHub App webhook activities, not Actions workflow trigger types.

• Rejected the one-argument format suggestion: GitHub’s expression reference documents format(string, replaceValue0, ...), requiring both a format string and at least one replacement (https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#format). The lexer retains the two-argument minimum.

• Addressed PRRT_kwDOSaSRXM6YCnwJ: zero-instance reusable calls now run the full typed input-contract preflight with dynamic matrix placeholders, so required, undeclared, and statically incompatible bindings cannot be hidden by an empty matrix.

• Addressed PRRT_kwDOSaSRXM6YCnwM: container credential expressions now use the documented jobs.<job_id>.container.credentials context set, including secrets and excluding jobs; regression coverage rejects jobs.build.result while retaining secrets.TOKEN.

• Addressed PRRT_kwDOSaSRXM6YC_Jb and PRRT_kwDOSaSRXM6YC_Ji: action-step inputs now use the documented field-specific contexts (including hashFiles) and complete continue-on-error expressions must be boolean or dynamic rather than a known scalar string.

• Addressed PRRT_kwDOSaSRXM6YC_Jm and the follow-up credential correction using GitHub’s current context table: top-level env allows github, secrets, inputs, vars; container credentials also allow env alongside github, needs, strategy, matrix, vars, secrets, inputs.

• Addressed PRRT_kwDOSaSRXM6YC_Ju and PRRT_kwDOSaSRXM6YC_Jw: literal boolean short-circuiting now retains the operand result type for reusable input validation, and watch supports only the documented started activity.

• Addressed PRRT_kwDOSaSRXM6YDMvi, PRRT_kwDOSaSRXM6YDMvr, PRRT_kwDOSaSRXM6YDMvv, and PRRT_kwDOSaSRXM6YDMv0 plus review PRR_kwDOSaSRXM8AAAABJCPI3w: zero-instance calls validate their callee without credit, literal timeout and numeric grammars fail closed, interpolated defaults stay unknown, and unknown runner OS labels require an explicit safe shell.

• Reused the canonical current GitHub dotcom permission scope list; repository-projects was a stale pre-existing test expectation and is now rejected, while artifact-metadata remains read/write/none and vulnerability-alerts/models remain read/none.

• Rejected PRRT_kwDOSaSRXM6YFZAF: GitHub documents check_suite with only the completed activity type; requested and rerequested are not supported workflow activity types for this trigger, so the existing rejection is intentional. See https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#check_suite.

• Codecov project/rust temporarily reported no head coverage while the Rust coverage upload step was still pending in Actions run 31452392960; no code change or push was warranted.

• GitHub’s official context-availability table confirms hashFiles is permitted in jobs.<job_id>.steps.with but not workflow-level env; the round-44 fix preserves that distinction while rejecting unavailable jobs context references.

• Rejected stale dispatch-limit review thread PRRT_kwDOSaSRXM6YGuyt: current GitHub.com documentation allows 25 workflow_dispatch input properties, and the implementation already enforces that limit; the 10-input limit applies to older GitHub Enterprise Server documentation.

• Addressed PRRT_kwDOSaSRXM6YHZRd, PRRT_kwDOSaSRXM6YHZRg, PRRT_kwDOSaSRXM6YHZRk, and PRRT_kwDOSaSRXM6YHZRl: container and service fields now enforce their GitHub field-specific expression contexts; static case() selects the first truthy branch or default; bracketed github['event_name'] resolves through the shared parser; and inclusive trigger filters reject negated-only patterns. The sibling-context sweep extracted a cohesive container validator and covered image, env, ports, volumes, options, and credentials. The 226-test gate suite, strict Clippy, formatting, repository policy, full pre-push hook, and independent Luna review pass.

• Codecov project/rust temporarily reported no coverage information for fd0e8b2 while the Rust tests and coverage job in Actions run 31461280307 was still in progress. This is the known upload-order transient; no code change, push, or run cancellation was warranted.

• Coverage follow-up: added behavioral condition-value tests for known and unknown status results, logical short-circuit operand preservation, unary conversion, unresolved case predicates, and literal fromJSON scalar/collection handling. Local focused coverage removes at least ten previously uncovered patch lines. Validation: 229 tsconfig-gate tests, strict Clippy, cargo fmt, repository policy, diff check, independent Luna review, and the full pre-push hook all passed. Pushed as 72a3c5c.

• Round 47: fixed all five review threads by applying field-specific job/step expression contexts, validating anonymous/named/dynamic container volume mounts, enforcing boolean concurrency cancellation expressions, validating workflow_dispatch input identifiers, and validating matrix expressions across roots/axes/include/exclude with invalid-precedence preserved. Added scanner-boundary regressions, split expression interpolation and matrix-axis helpers to satisfy source-size policy, and independently reviewed the integrated diff with no blockers. Validation: 234 tsconfig-gate tests, cargo fmt, strict cargo clippy, git diff --check, repository no-mistakes policy, and the full pre-push hook all pass.

• Round 48: resolved four review threads and three independent Luna audit passes. Added literal-array contains membership and distinct-array semantics; field-specific runs-on validation; static/context-free container image reduction with consolidated Docker reference grammar; and pull-request source-change action correlation with dot/bracket truthiness. Reconciled concurrent collaborator commits f4fa9ee/1e1d4ac2 without duplicate parsers, corrected their source-change fixture expectations, and added regressions for non-stringable array members, digest algorithms, registry case, and named-volume prefixes. Validation: 252 tsconfig-gate tests, cargo fmt, strict cargo clippy, repository policy, diff checks, and full pre-push all pass.

• Round 49: resolved nine review threads across activation state, expression safety, job-field validation, and dependency traversal. Added workflow/job/step env precedence with absent-secret string semantics; caller-aware reusable defaults; literal matrix/fail-fast typing; bounded expression nesting; literal closing-brace handling; shared Docker action-image validation; per-matrix timeout enforcement; and Kahn-style dependency validation with a 10,000-job regression. Luna found and verified the environment-precedence follow-up; cross-default references remain conservative in canonical contract order and are documented. Validation: 261 gate tests, strict clippy, formatting, repository policy, independent review, and full pre-push pass. A policy-only follow-up commit split condition evaluation and tests below file-size limits.

• CI follow-up: Rust tests and line coverage passed, but the CRAP gate identified the new environment string-coercion helper at 0% direct function coverage. Added focused branch coverage for boolean, number, string, null, sequence, and mapping coercion; 262 gate tests, strict clippy, policy, and full pre-push pass. The earlier Codecov project failure was a consequence of CRAP stopping before upload, not a coverage-project regression.

• Round 50 fixed canonical remote action owner/repository validation, resolved inputs and per-combination matrix values through workflow/job/step environments, and validated resolved container/service images. Luna review caught and drove fixes for outer-scope env resolution, missing-input empty-string coercion, dynamic-matrix documentation, and the job-vs-step env context boundary. Validation passed: 268 tsconfig-gate tests, cargo fmt, strict Clippy, repository policy, diff check, and the full pre-push hook. Commit: 427cc58.

• Round 51 addressed job-default contexts and object-valued matrix axes, and aligned the hosted macOS runner catalog with GitHub's current larger-runner reference. Independent Luna review rejected two bot premises: check_suite requested/rerequested are not supported workflow activity filters (completed only), and macos-13-xlarge is absent from the current larger-runner catalog; xcode-27-xlarge is documented instead. Added direct and scanner-boundary regressions. Validation passed: 270 tsconfig-gate tests, cargo fmt, strict Clippy, repository policy, diff check, and full pre-push. Commit: e01601f.

• CI Round 51 follow-up: Rust tests and line coverage passed, but CRAP rejected static_value_string at 42.0 because it had 0% direct function coverage, which also prevented the Codecov upload. Added direct scalar/non-stringable coercion coverage; 271 gate tests, strict Clippy, formatting, policy, diff check, and full pre-push pass. Commit: 0ba72c1.

• Round 52 resolves and validates static matrix values in container/service ports, rejects statically empty concurrency groups, and excludes source-change events whose ordered branch filters provably match no branch. Luna caught the reinclude-then-exact-reexclude case before commit; overlapping glob cases remain conservative. Tests were split to satisfy file-size policy. Validation passed: 275 gate tests, all-target/all-feature Clippy, formatting, repository policy, diff check, and full pre-push. Commit: 1c79bf6. The added boundary tests also target the 98.75% patch-coverage gap.

• Patch coverage follow-up: Codecov remained at 98.765% with 63 uncovered changed lines. A full isolated llvm-cov run identified exact gaps; focused behavioral tests closed 21 previously uncovered changed lines across condition coercion, literal parsing, image validation, and runner classification. Full isolated coverage passed 5,520 library tests; integrated gate tests, strict Clippy, formatting, policy, diff check, and full pre-push pass. Commit: 9bf3e30.

• Round 54: fixed three fail-open edges. Exact push/tag and pull_request_target filters now carry github.ref state through reusable activations; pull_request merge refs reject impossible base-branch comparisons. Reusable traversal is capped at 1,024 activation computations per direct workflow/event and revokes the whole event's credits on exhaustion. Repository-local action steps now require tracked, parseable action metadata with valid execution contracts, recursive nested-target validation, and cycle rejection. Validation: 5,513 library tests, 284 focused rule tests, strict all-target/all-feature Clippy, repository policy, pre-push hook, and 100% line coverage for the new 167-line local-action catalog.

• Round 55: resolved five runtime-configuration review threads. The scanner now validates resolved max-parallel values, per-matrix runs-on selectors and group/labels mappings, container/service registry credentials, and GitHub-supported container/service options. Matrix runner state now reaches scheduling, platform, and implicit-shell checks; omitted reusable secrets resolve empty while available secrets remain opaque. Split runner selection, container configuration/options, and job-state preparation into focused modules to satisfy source limits. Validation: 5,520 library tests, 291 focused rule tests under llvm-cov, strict all-target/all-feature Clippy, formatting, repository policy, diff check, full pre-push, and two independent Terra reviews pass. New selection code has 100% line/function coverage; options has 100% function and 98.7% line coverage (one structurally unreachable invalid branch after expression prevalidation). Commit: faa7c2a.

• Round 56: fixed five review findings by requiring tracked JavaScript action entrypoints, validating local action targets only in executed step order, reducing literal shell expressions before shell classification, aligning named months with numeric cron positions, and revalidating resolved job/service volumes. Added fixture, scanner-boundary, unit, docs, and 100% new-volume-module coverage. Validation: 296 focused gate tests, 5,525 full library tests, strict all-target/all-feature Clippy, fmt, repository policy, diff check, pre-push hook, and independent Luna/Terra reviews all passed.

• Round 57: modeled static composite-action failures and bounded nested composite traversal at 10 levels; resolved job timeout expressions per reusable/matrix activation; exposed known skipped dependency results to status-aware needs conditions; added fixture, unit, reusable, dot/bracket, and matrix boundary regressions; updated rule docs. Validation: 301 focused tsconfig-gate tests, 5,530 full library tests, cargo fmt, strict all-target/all-feature clippy, repository policy, llvm-cov, git diff check, and push hook. Independent Luna and Terra reviews found no correctness blockers.

• Round 58: validated local Docker actions against GitHub Runner Dockerfile semantics (tracked local Dockerfile-shaped images, external image references, case-insensitive docker://, and exact whitespace behavior); separated runner group identity from runner labels so group-only jobs remain schedulable but OS-unknown, requiring an explicit shell and disallowing container credit without labels. Added unit, fixture, scanner, runtime, and docs coverage. Validation: 301 focused gate tests, 5,530 full library tests before the final focused parity correction, strict clippy, formatting, repository policy, diff checks, push hook, and clean Luna/Terra reviews.

• Round 59: fixed the CSpell-only CI failure by replacing an unrecognized documentation term with plain language; exact npm run lint:spell, formatting, diff checks, and the full push hook passed. The surfaced workflow action-input warning is pre-existing and unrelated to this PR diff.

• Round 60: bounded flat condition evaluation at 256 operands; revalidated resolved environment names and working directories per activation; modeled distinct skipped/failed step status, Bash errexit/pipefail execution, and later-step reachability; kept local Node action validation on runs.main because GitHub SelfAlias actions do not register pre/post hooks. Validated 314 focused tests, 5,543 library tests, strict Clippy, formatting, llvm-cov execution, repository policy, and the full pre-push hook.

• Round 61: propagated static job failures through needs and local reusable workflows using topological runtime job states; kept failure-handler execution/status separate from successful-path coverage; modeled known-not-skipped results without guessing dynamic conditions; preserved bare exit status; and excluded tag refs from branch source-change coverage. Validated 318 focused coverage tests, 5,547 library tests, llvm-cov execution, strict Clippy, formatting, repository policy, independent Luna/Terra reviews, and the full pre-push hook.

• CI follow-up: removed the stale test-only static_bool re-export left after the conditions module split. Local focused tests (318), strict Clippy, formatting, repository policy, diff check, and the full pre-push hook passed before pushing 82c4624.

• Round 62: resolved caller-input root matrices with shared 256-job and zero-instance semantics; rejected known non-stringable environment expressions; resolved static run-script interpolations before command/failure analysis; and validated complete local-action metadata including local lifecycle restrictions, current Node runtimes, and branding catalog. Validated 324 focused tests, 5,553 library tests, LLVM coverage execution, strict Clippy, formatting, repository policy, independent Luna/Terra reviews, and the full pre-push hook.

• Round 63: preserved exact branch exclusions (including mixed exact/glob filters), revalidated workflow and job concurrency per activation with downstream failure propagation, and rejected statically or activation-resolved non-stringable action inputs and concurrency interpolations. Validated 334 focused gate tests, 5,563 library tests, LLVM coverage execution, strict Clippy, formatting, repository policy, independent Luna/Terra review, and the full pre-push hook.

• Round 64: revalidated resolved strategy fail-fast booleans, enforced exact lengths for recognized image digest algorithms, preserved static matrix-object truthiness without string coercion, and stopped shell scanning after unreachable pipefail-and-list continuations (review PRR_kwDOSaSRXM8AAAABJJnkPQ). Validated 337 focused tests, 5,566 library tests, LLVM coverage execution, strict Clippy, formatting, repository policy, two independent reviews, and the full pre-push hook.

• Round 74: validated resolved runs-on and step environment values before credit, preserved static matrix-object identity, and reused the canonical permission-scope catalog. Rejected PRRT_kwDOSaSRXM6Ya4-4 after the current GitHub context table confirmed steps.name permits the full step contexts plus hashFiles; narrowing it would create false negatives. Validation: 402 gate tests, 5,706 library tests, strict Clippy, formatting, repository policy, independent Luna review, and the full pre-push hook passed.

• Round 75: propagated dynamic prerequisite uncertainty and ordinary-job outputs through needs, preserved mixed exact and wildcard branch activations, and aligned local-action scalar defaults and composite contexts with metadata semantics. Integrated concurrent maintainer commit 602fc61 semantically, retaining its fail-fast/unrunnable-job fixes alongside static outputs. Validation: 409 gate tests, 5,713 library tests, strict Clippy, formatting, repository policy, diff checks, independent review, and the full pre-push hook passed.

• Round 76: modeled fork-safe pull-request secrets, step outcome/conclusion, static strategy/ref/job contexts, root-checkout/local-action boundaries, Docker/composite targets, tag-only source exclusions, and pnpm exec separators; semantically integrated maintainer commits 2bdbc15 and bbf81c5 with their regression fixture corpus. Validation: 420 gate tests, 5,724 library tests, strict all-target/all-feature Clippy, formatting, repository policy, diff checks, independent Luna review, and the full pre-push hook passed.

• Round 77: applied ordered wildcard branch negations, retained nested static matrix-object properties, resolved workflow_call outputs from completed job outputs, and evaluated static toJSON scalars/arrays. Validation: 425 gate tests, 5,729 library tests, strict Clippy, formatting, repository policy, diff checks, and the full pre-push hook passed.

• Round 78: stopped after unresolved executable interpolation, honored tolerated missing working directories, modeled non-errexit top-level return fall-through, disabled empty-image services without invalidating jobs, and coerced scalar concurrency groups. Validation: 428 gate tests, 5,732 library tests, strict Clippy, formatting, repository policy, diff checks, and the full pre-push hook passed.

• Codecov temporarily reported no head coverage for c7556cf while the Rust tests and coverage job in run 31559020018 was still in progress; no code change, push, or run cancellation was warranted.

• CI CRAP failure: refactored JobScanner::scan into dependency, decision, and state-publication helpers, reducing the scheduler from CC32 to CC9. Validation: 198 reusable-workflow tests, 5,745 instrumented library tests plus all binary/integration suites, >=99% line/function coverage, 6,292 functions with none above CRAP 30, strict Clippy, formatting, repository policy, diff checks, and the full pre-push hook passed.

• Round 79: addressed eight review findings across pull-request ref typing, join evaluation, action metadata, activity triggers, composite working directories, and unanalyzable custom shells. Split public github.ref_type from internal ref-shape state so PR merge refs report branch without making refs/heads comparisons reachable. Validation: 431 gate tests, 5,735 library tests, strict all-target/all-feature Clippy, formatting, repository policy, diff checks, and the full pre-push hook passed. Commit: 3c28df3.

• Codecov’s temporary “No coverage information found on head” state needs no code change: run 31560814976 is still executing Rust coverage and has not yet reached its upload step.

• CI follow-up after maintainer commit 8a23ec7: split static JSON scalar conversion from sequence traversal, reducing static_json_value from CC12/CRAP85.7 to CC5/CRAP5.0 with 100% focused coverage. Validation: 433 gate tests, 5,737 library tests, focused llvm-cov/CRAP, strict Clippy, formatting, repository policy, diff checks, and the full pre-push hook passed. Commit: 7b5f38e.

• Codecov Rust project status was inspected: it reported no head coverage before the matching Rust tests and coverage action completed, while patch coverage passed. No code change is warranted unless the completed upload remains absent.

• Codecov Rust status was inspected while its producing Rust coverage run remains in progress. The minimized report confirms all modified coverable lines are covered; the temporary “no coverage information found on head” status is an upload-timing condition, not a code defect, so no code change was made.

• Deferred post-reopen Codex review round PRR_kwDOSaSRXM8AAAABJO8hKQ as out of launch scope per human direction to stop the spiraling review loop. Follow-ups noted: tolerated unknown run outcomes (feat(tsconfig-gate): follow reusable workflows #635 (comment)), tolerated invalid action-input outcomes (feat(tsconfig-gate): follow reusable workflows #635 (comment)), missing needs outputs coercion (feat(tsconfig-gate): follow reusable workflows #635 (comment)), and unknown-branch ref_name nonemptiness (feat(tsconfig-gate): follow reusable workflows #635 (comment)). No code change for this launch.

• Stale Codecov failure contexts are superseded: the fresh Rust coverage job and local 99% enforcement passed, and Codecov’s current PR API reports patch hits=7419, misses=75, coverage=99.0, ci_passed=true. No code change is warranted; continue launch readiness using the fresh required-check state.

• The exact Codecov patch gate was 7419/7494 (98.9992%), despite the API rounding to 99.0. Added one focused behavioral regression for the valid hashFiles condition fallback, covering the sole missed line in functions.rs; focused test and all pre-push checks passed. Rebased onto origin/main and pushed head 34d3ce8.

• Deferred final-head Codex review PRR_kwDOSaSRXM8AAAABJU2Wog as out of launch scope per human direction to stop the review loop: preserve unknown PR head-ref nonemptiness (feat(tsconfig-gate): follow reusable workflows #635 (comment)); validate inline cd targets as directories (feat(tsconfig-gate): follow reusable workflows #635 (comment)); revise matrix fail-fast concurrency guarantees (feat(tsconfig-gate): follow reusable workflows #635 (comment)); cancel wildcard filters with later matching negatives (feat(tsconfig-gate): follow reusable workflows #635 (comment)); and reject/evaluate chained comparisons (feat(tsconfig-gate): follow reusable workflows #635 (comment)). No launch-blocking code change was authorized; required CI and Codecov 99.01% are green.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable.rs`:
- Around line 100-144: Update scan_activation around call_target and
callee_projects so each reusable-call job’s skipped or non-enforcing state is
evaluated before resolving its target. When a call is disabled, malformed,
missing, cyclic, or otherwise fails local resolution, skip only that job and
continue scanning sibling jobs instead of returning None for the parent
activation; preserve normal project collection for valid enabled calls. Add a
repository fixture and regression test containing a valid typecheck job
alongside a disabled or invalid reusable-call sibling, verifying the typecheck
coverage is retained.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7aa7d85d-040e-4e73-960c-3d113ef261ac

📥 Commits

Reviewing files that changed from the base of the PR and between 8280940 and 897c1ca.

📒 Files selected for processing (11)

• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests/fixture_policy.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests/workflow.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests/workflow_contracts.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/conditions.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/conditions/contracts.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/conditions/inputs.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable/steps.rs
• fixtures/rules/tsconfig-gate-coverage/reusable-workflow/caller-only/index.ts
• fixtures/rules/tsconfig-gate-coverage/reusable-workflow/caller-only/tsconfig.json

🚧 Files skipped from review as they are similar to previous changes (1)

• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests/workflow.rs

Rejected because GitHub validates every static local reusable call at the workflow level, so call-local failure cannot preserve sibling coverage without false credit.

[coderabbitai]

Actionable comments posted: 4

🧹 Nitpick comments (2)

crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests/workflow_contracts.rs (1)

170-204: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Document the counterintuitive matrix invariants.

Two cases in caller.yml are non-obvious to a later reader:

• include-restores declares target: [] and still runs, because a non-empty include restores one instance.
• dynamic-include declares target: [] and still earns credit, because zero_instance_matrix fails open for a ${{ ... }} include.

Both appear in the expected set at Lines 199-200, which reads as a contradiction next to empty-call and empty-job. Add a short comment that records each invariant.

♻️ Proposed comments

+        // `include-restores` keeps one instance: a non-empty `include` restores an
+        // otherwise empty axis, so the job still runs.
+        // `dynamic-include` fails open: a `${{ }}` include has an unknown runtime
+        // value, so the matrix is not treated as zero-instance.
         workflow(
             ".github/workflows/caller.yml",

As per coding guidelines, "Add short comments to intentionally counterintuitive fixtures or tests to preserve the invariant they protect."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests/workflow_contracts.rs`
around lines 170 - 204, In the workflow fixture list, add short comments
immediately before the include-restores and dynamic-include cases documenting
their intentional matrix behavior: a non-empty include restores an instance
despite target: [], and a dynamic `${{ ... }}` include causes
zero_instance_matrix to fail open. Keep the existing fixtures and expected
scanned set unchanged.

Source: Coding guidelines

crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests/workflow_scaling.rs (1)

3-8: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Duplicated workflow test helper in the two new test modules. Both new test files declare a byte-identical workflow(path, yaml) -> ParsedWorkflowDocument helper. The root cause is that the parent tests module does not expose a shared constructor, so each module re-declares one.

• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests/workflow_scaling.rs#L3-L8: remove the local helper and use the shared one through the existing use super::*;.
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests/workflow_schema.rs#L3-L8: remove the local helper and use the same shared one.

Define the helper once in crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests.rs. workflow_contracts.rs can then drop its copy as well.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests/workflow_scaling.rs`
around lines 3 - 8, Move the shared workflow(path, yaml) ->
ParsedWorkflowDocument constructor into
crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests.rs. Remove
the duplicate helper from workflow_scaling.rs#L3-L8 and
workflow_schema.rs#L3-L8, relying on each module’s existing use super::*; also
remove the duplicate from workflow_contracts.rs, with no direct change required
there beyond deleting its copy.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests/workflow_scaling.rs`:
- Around line 19-49: Update repeated_reusable_activations_share_results and the
scan path to expose and assert the ActivationMemo computation count, ensuring
repeated activations remain memoized instead of only producing the expected
project set. Add a comment documenting that the fixture’s depth-9 chain leaves
one level of margin before scan_activation_uncached aborts at depth 10, so the
test remains focused on memoization rather than the depth limit.

In
`@crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable.rs`:
- Around line 174-181: The skipped-job lookup in the workflow coverage filtering
logic currently only handles string job IDs; update it to normalize YAML scalar
IDs consistently before matching. Introduce or reuse one shared normalization
helper across valid_job_dependencies, statically_skipped_jobs construction, and
the lookup around statically_not_enforcing, preserving lowercase matching for
both string and numeric scalar IDs.

In
`@crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable/validation.rs`:
- Around line 73-79: Validate each normalized job_id in valid_job_dependencies
before inserting it into the dependency graph: require the ID to start with a
letter or underscore and contain only ASCII letters, digits, underscores, or
hyphens. Return false for invalid IDs such as 1build, build job, or $x, and add
a regression test covering rejected job identifiers.

In
`@crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable/validation/contracts.rs`:
- Around line 31-48: Update input_declaration_valid to require the type field
and restrict it to boolean, number, or string, and update
output_declaration_valid to require a string value field; preserve the existing
key and field validation rules. Add regression tests covering a missing input
type, an unsupported input type, and a missing output value.

---

Nitpick comments:
In
`@crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests/workflow_contracts.rs`:
- Around line 170-204: In the workflow fixture list, add short comments
immediately before the include-restores and dynamic-include cases documenting
their intentional matrix behavior: a non-empty include restores an instance
despite target: [], and a dynamic `${{ ... }}` include causes
zero_instance_matrix to fail open. Keep the existing fixtures and expected
scanned set unchanged.

In
`@crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests/workflow_scaling.rs`:
- Around line 3-8: Move the shared workflow(path, yaml) ->
ParsedWorkflowDocument constructor into
crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests.rs. Remove
the duplicate helper from workflow_scaling.rs#L3-L8 and
workflow_schema.rs#L3-L8, relying on each module’s existing use super::*; also
remove the duplicate from workflow_contracts.rs, with no direct change required
there beyond deleting its copy.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3ebfb3b2-4ced-485c-a1c8-10825b23b3c9

📥 Commits

Reviewing files that changed from the base of the PR and between 897c1ca and 116ce22.

📒 Files selected for processing (13)

• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests/workflow_contracts.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests/workflow_scaling.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests/workflow_schema.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/conditions.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable/model.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable/validation.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable/validation/contracts.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable/validation/contracts/tests.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable/validation/matrix.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable/validation/matrix/tests.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable/validation/tests.rs

🚧 Files skipped from review as they are similar to previous changes (1)

• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/conditions.rs

Implemented shared GitHub job-ID normalization and validation, strict reusable contract fields, and an exact memoization computation-count assertion.

[coderabbitai]

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable.rs (1)

52-79: 🚀 Performance & Scalability | 🟠 Major | ⚡ Quick win

Parallelize independent root workflow scans.

The loop scans every root workflow serially. Each iteration owns its ActivationMemo and reads only shared immutable context. Run these scans with Rayon or concurrent maps, then merge BTreeSet results and computation counts deterministically.

As per coding guidelines, “Run independent per-file extraction and checks in parallel with rayon or concurrent maps, then sort output deterministically.”

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable.rs`
around lines 52 - 79, The root workflow scan loop should run independent
workflow analyses in parallel rather than serially. Refactor the iteration over
context.workflows so each task owns its ActivationMemo and returns its
discovered projects plus computation count, then deterministically merge the
results into the BTreeSet and aggregate computations while preserving the
existing filtering and scan_activation behavior.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/conditions.rs`:
- Around line 125-129: Update input_name and its caller’s input-condition
evaluation to accept only an exact valid inputs identifier, rejecting compound
expressions or trailing syntax instead of treating failed lookup as false;
return StaticBool::Unknown for rejected expressions. Add a regression test,
preferably using a repository fixture, for an expression beginning with inputs.
combined with another condition.

In
`@crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable/validation/matrix.rs`:
- Around line 34-45: The matrix_shape_valid function must reject statically
malformed strategy and strategy.matrix values instead of treating them as
absent: return false for non-mapping strategy values or literal non-mapping
matrix values, while preserving fail-open behavior for dynamic-expression cases.
Update the related validation logic and add coverage for malformed strategy and
matrix shapes.

---

Outside diff comments:
In
`@crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable.rs`:
- Around line 52-79: The root workflow scan loop should run independent workflow
analyses in parallel rather than serially. Refactor the iteration over
context.workflows so each task owns its ActivationMemo and returns its
discovered projects plus computation count, then deterministically merge the
results into the BTreeSet and aggregate computations while preserving the
existing filtering and scan_activation behavior.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: beee3f0b-3bad-4a28-95be-ac22cf6bae52

📥 Commits

Reviewing files that changed from the base of the PR and between 116ce22 and 423e5c9.

📒 Files selected for processing (21)

• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests/workflow.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests/workflow_contracts.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests/workflow_inputs.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests/workflow_scaling.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests/workflow_schema.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/conditions.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/conditions/contracts.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/conditions/inputs.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/conditions/inputs/tests.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable/model.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable/validation.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable/validation/contracts.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable/validation/contracts/tests.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable/validation/jobs.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable/validation/jobs/tests.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable/validation/matrix.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable/validation/matrix/tests.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable/validation/tests.rs

🚧 Files skipped from review as they are similar to previous changes (7)

• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable/validation/tests.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests/workflow_scaling.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/reusable/validation/contracts.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests/workflow_contracts.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/workflow/conditions/inputs.rs
• crates/no-mistakes/src/codebase/rules/tsconfig_gate_coverage/tests/workflow.rs

Applied the requested exact expression and full execution-schema validation with focused regressions.