CORE-6263: fix Repo Checks setup-failure cells and baselined counts, and follow the Core Node and npm pattern

.github/workflows/CHANGELOGS/run_gha_checks.md

@@ -2,6 +2,14 @@
 
 All notable changes to the **run_gha_checks** reusable workflow are documented in this file.
 
+## 1.0.3
+
+### Fixed
+
+- The `baselined` output counts only real inline directives (`# zizmor: ignore[...]` in YAML files
+  under `.github`), and counts each one rather than each line. Names in documentation, changelogs
+  and test fixtures inflated the count.
+
 ## 1.0.2
 
 ### Changed

.github/workflows/CHANGELOGS/run_js_checks.md

@@ -2,6 +2,14 @@
 
 All notable changes to the **run_js_checks** reusable workflow are documented in this file.
 
+## 1.0.2
+
+### Fixed
+
+- The `baselined` output counts only real inline directives (`//` or `/*` `eslint-disable…` and
+  `prettier-ignore` comments in JS and TS files), and counts each one rather than each line. Names
+  in documentation, changelogs and test fixtures inflated the count.
+
 ## 1.0.1
 
 ### Changed

.github/workflows/CHANGELOGS/run_markdown_checks.md

@@ -2,6 +2,14 @@
 
 All notable changes to the **run_markdown_checks** reusable workflow are documented in this file.
 
+## 1.0.2
+
+### Fixed
+
+- The `baselined` output counts only real inline directives (`<!-- markdownlint-disable…` in `*.md`
+  files), and counts each one rather than each line. Names in documentation, changelogs and test
+  fixtures inflated the count.
+
 ## 1.0.1
 
 ### Changed

.github/workflows/CHANGELOGS/run_repo_checks.md

@@ -2,6 +2,15 @@
 
 All notable changes to the **run_repo_checks** reusable workflow are documented in this file.
 
+## 1.0.3
+
+### Fixed
+
+- Calls the 1.0.2 or 1.0.3 per-technology workflows from the same commit, whose baselined counts
+  include only real inline directives, counted once each.
+- The Summary shows ❌ setup failed for a step that was skipped because its job's setup (mise or
+  `npm ci`) failed. It showed ⏭️ skipped, so a failed job's row had no ❌.
+
 ## 1.0.2
 
 ### Changed

.github/workflows/CHANGELOGS/run_shell_checks.md

@@ -2,6 +2,14 @@
 
 All notable changes to the **run_shell_checks** reusable workflow are documented in this file.
 
+## 1.0.3
+
+### Fixed
+
+- The `baselined` output counts only real inline directives (`# shellcheck disable=` outside
+  Markdown files), and counts each one rather than each line. Names in documentation, changelogs and
+  test fixtures inflated the count.
+
 ## 1.0.2
 
 ### Changed

.github/workflows/CHANGELOGS/run_terraform_checks.md

@@ -2,6 +2,14 @@
 
 All notable changes to the **run_terraform_checks** reusable workflow are documented in this file.
 
+## 1.0.3
+
+### Fixed
+
+- The `baselined` output counts only real inline directives (`#checkov:skip=` and `# tflint-ignore`
+  comments, with `#` or `//`, in `*.tf` files), and counts each one rather than each line. Names in
+  documentation, changelogs and test fixtures inflated the count.
+
 ## 1.0.2
 
 ### Changed

.github/workflows/READMES/run_gha_checks.md

@@ -13,7 +13,7 @@ jobs:
     name: GHA
     needs: ci-context
     if: ${{ needs.ci-context.outputs.should-run-ci == 'true' }}
-    uses: OpenSesame/core-github-actions/.github/workflows/run_gha_checks.yml@<released-sha> # workflows/run_gha_checks/1.0.2
+    uses: OpenSesame/core-github-actions/.github/workflows/run_gha_checks.yml@<released-sha> # workflows/run_gha_checks/1.0.3
     permissions:
       contents: read # Required to check out the code to check.
     with:
@@ -49,11 +49,11 @@ each mise task with `mise run`. It doesn't need Node, `package.json` or `npm ci`
 
 ## Outputs
 
-| Output      | Value                                                                    |
-| ----------- | ------------------------------------------------------------------------ |
-| `lint`      | Outcome of the lint step: `success`, `failure`, `cancelled` or `skipped` |
-| `scan`      | Outcome of the scan step: `success`, `failure`, `cancelled` or `skipped` |
-| `baselined` | Number of inline `# zizmor: ignore[...]` comments under `.github`        |
+| Output      | Value                                                                           |
+| ----------- | ------------------------------------------------------------------------------- |
+| `lint`      | Outcome of the lint step: `success`, `failure`, `cancelled` or `skipped`        |
+| `scan`      | Outcome of the scan step: `success`, `failure`, `cancelled` or `skipped`        |
+| `baselined` | Number of inline `# zizmor: ignore[...]` comments in YAML files under `.github` |
 
 ## Contribution
 

.github/workflows/READMES/run_js_checks.md

@@ -10,7 +10,7 @@ jobs:
     name: JS
     needs: ci-context
     if: ${{ needs.ci-context.outputs.should-run-ci == 'true' }}
-    uses: OpenSesame/core-github-actions/.github/workflows/run_js_checks.yml@<released-sha> # workflows/run_js_checks/1.0.1
+    uses: OpenSesame/core-github-actions/.github/workflows/run_js_checks.yml@<released-sha> # workflows/run_js_checks/1.0.2
     permissions:
       contents: read # Required to check out the code to check.
     with:
@@ -57,11 +57,11 @@ devDependencies), then runs each script with `npm run`:
 
 ## Outputs
 
-| Output      | Value                                                                            |
-| ----------- | -------------------------------------------------------------------------------- |
-| `lint`      | Outcome of the lint step: `success`, `failure`, `cancelled` or `skipped`         |
-| `format`    | Outcome of the format-check step: `success`, `failure`, `cancelled` or `skipped` |
-| `baselined` | Number of inline `eslint-disable` and `prettier-ignore` comments                 |
+| Output      | Value                                                                                                                                  |
+| ----------- | -------------------------------------------------------------------------------------------------------------------------------------- |
+| `lint`      | Outcome of the lint step: `success`, `failure`, `cancelled` or `skipped`                                                               |
+| `format`    | Outcome of the format-check step: `success`, `failure`, `cancelled` or `skipped`                                                       |
+| `baselined` | Number of inline `// eslint-disable…`, `/* eslint-disable…`, `// prettier-ignore` and `/* prettier-ignore` comments in JS and TS files |
 
 ## Contribution
 

.github/workflows/READMES/run_markdown_checks.md

@@ -10,7 +10,7 @@ jobs:
     name: Markdown
     needs: ci-context
     if: ${{ needs.ci-context.outputs.should-run-ci == 'true' }}
-    uses: OpenSesame/core-github-actions/.github/workflows/run_markdown_checks.yml@<released-sha> # workflows/run_markdown_checks/1.0.1
+    uses: OpenSesame/core-github-actions/.github/workflows/run_markdown_checks.yml@<released-sha> # workflows/run_markdown_checks/1.0.2
     permissions:
       contents: read # Required to check out the code to check.
     with:
@@ -56,10 +56,10 @@ devDependencies), then runs each script with `npm run`:
 
 ## Outputs
 
-| Output      | Value                                                                    |
-| ----------- | ------------------------------------------------------------------------ |
-| `lint`      | Outcome of the lint step: `success`, `failure`, `cancelled` or `skipped` |
-| `baselined` | Number of inline `markdownlint-disable` comments in `*.md` files         |
+| Output      | Value                                                                                                     |
+| ----------- | --------------------------------------------------------------------------------------------------------- |
+| `lint`      | Outcome of the lint step: `success`, `failure`, `cancelled` or `skipped`                                  |
+| `baselined` | Number of inline `<!-- markdownlint-disable…` directives (`-line`, `-next-line`, `-file`) in `*.md` files |
 
 ## Contribution
 

.github/workflows/READMES/run_repo_checks.md

@@ -15,7 +15,7 @@ jobs:
     name: Repo Checks
     needs: ci-context
     if: ${{ needs.ci-context.outputs.should-run-ci == 'true' }}
-    uses: OpenSesame/core-github-actions/.github/workflows/run_repo_checks.yml@<released-sha> # workflows/run_repo_checks/1.0.2
+    uses: OpenSesame/core-github-actions/.github/workflows/run_repo_checks.yml@<released-sha> # workflows/run_repo_checks/1.0.3
     permissions:
       contents: read # Required to check out the code to lint, format-check, scan and validate.
     with:
@@ -26,22 +26,25 @@ jobs:
 ```
 
 Add `repo-checks` to `ci-result`'s needs. Replace `<released-sha>` with the full commit SHA of the
-tag: `git rev-list -n1 workflows/run_repo_checks/1.0.2`.
+tag: `git rev-list -n1 workflows/run_repo_checks/1.0.3`.
 
 ## Jobs
 
 | Check                               | Runs when                           | Workflow                                          |
 | ----------------------------------- | ----------------------------------- | ------------------------------------------------- |
 | `Repo Checks / Detect`              | Always                              | —                                                 |
 | `Repo Checks / GHA / Checks`        | GitHub Actions files are present    | [`run_gha_checks`](run_gha_checks.md)             |
-| `Repo Checks / Terraform / …`       | Terraform files are present         | [`run_terraform_checks`](run_terraform_checks.md) |
-| `Repo Checks / Markdown / …`        | Markdown files are present          | [`run_markdown_checks`](run_markdown_checks.md)   |
-| `Repo Checks / Shell / …`           | Shell scripts are present           | [`run_shell_checks`](run_shell_checks.md)         |
-| `Repo Checks / JS / …`              | JavaScript or TypeScript is present | [`run_js_checks`](run_js_checks.md)               |
+| `Repo Checks / Terraform / Checks`  | Terraform files are present         | [`run_terraform_checks`](run_terraform_checks.md) |
+| `Repo Checks / Markdown / Checks`   | Markdown files are present          | [`run_markdown_checks`](run_markdown_checks.md)   |
+| `Repo Checks / Shell / Checks`      | Shell scripts are present           | [`run_shell_checks`](run_shell_checks.md)         |
+| `Repo Checks / JS / Checks`         | JavaScript or TypeScript is present | [`run_js_checks`](run_js_checks.md)               |
 | `Repo Checks / Standard / Validate` | Always                              | [`run_repo_validation`](run_repo_validation.md)   |
 | `Repo Checks / Summary`             | Always, unless the run is cancelled | —                                                 |
 
-A technology that isn't present skips its job, because Detect found none of its files. A technology
+A technology that isn't present skips its job, because Detect found none of its files. GitHub then
+reports the skipped check as `Repo Checks / <Technology>`, such as `Repo Checks / Terraform`, with no
+`/ Checks`, so a required status check on the inner name stays pending in repositories without that
+technology. A technology
 that is present but has no task or script for a step fails that step, and mise or npm logs why. Every
 step runs even when an earlier one failed, as long as mise or `npm ci` set up, and the workflow fails
 if any job failed.
@@ -91,9 +94,22 @@ validates without that check.
 
 The Summary job writes a table of each technology's file count, init, validate, lint, format and scan
 results, and baselined count, followed by the Standard result. Init and Validate apply only to
-Terraform. A baselined issue is an inline ignore comment
-(`zizmor: ignore`, `#checkov:skip=`, `tflint-ignore`, `markdownlint-disable`, `shellcheck disable=`,
-`eslint-disable`, `prettier-ignore`) or an entry in a tracked `*.checkov.baseline` file.
+Terraform. A step that was skipped because its job's setup failed, such as mise or `npm ci`, shows
+❌ setup failed. A step skipped after another step failed, such as Validate after Init, shows
+⏭️ skipped.
+
+A baselined issue is an inline ignore directive or an entry in a tracked `*.checkov.baseline` file.
+The counts match comment syntax, not just the directive name, so documentation, changelogs and test
+fixtures that mention a directive don't count, and each directive counts once even when a line has
+several:
+
+| Technology     | Counts                                                                                           |
+| -------------- | ------------------------------------------------------------------------------------------------ |
+| GitHub Actions | `# zizmor: ignore[...]` in YAML files under `.github`                                            |
+| Terraform      | `#checkov:skip=` and `# tflint-ignore` (`#` or `//`) in `*.tf` files, plus baseline entries      |
+| Markdown       | `<!-- markdownlint-disable…` in `*.md` files                                                     |
+| Shell          | `# shellcheck disable=` outside Markdown files, including workflow `run` blocks                  |
+| JS             | `// eslint-disable…`, `/* eslint-disable…` and the same for `prettier-ignore` in JS and TS files |
 
 ## Inputs
 

.github/workflows/READMES/run_shell_checks.md

@@ -12,7 +12,7 @@ jobs:
     name: Shell
     needs: ci-context
     if: ${{ needs.ci-context.outputs.should-run-ci == 'true' }}
-    uses: OpenSesame/core-github-actions/.github/workflows/run_shell_checks.yml@<released-sha> # workflows/run_shell_checks/1.0.2
+    uses: OpenSesame/core-github-actions/.github/workflows/run_shell_checks.yml@<released-sha> # workflows/run_shell_checks/1.0.3
     permissions:
       contents: read # Required to check out the code to check.
     with:
@@ -52,7 +52,7 @@ each mise task with `mise run`. It doesn't need Node, `package.json` or `npm ci`
 | ----------- | -------------------------------------------------------------------------------- |
 | `lint`      | Outcome of the lint step: `success`, `failure`, `cancelled` or `skipped`         |
 | `format`    | Outcome of the format-check step: `success`, `failure`, `cancelled` or `skipped` |
-| `baselined` | Number of inline `# shellcheck disable=` directives                              |
+| `baselined` | Number of inline `# shellcheck disable=` directives outside Markdown files       |
 
 ## Contribution
 

.github/workflows/READMES/run_terraform_checks.md

@@ -13,7 +13,7 @@ jobs:
     name: Terraform
     needs: ci-context
     if: ${{ needs.ci-context.outputs.should-run-ci == 'true' }}
-    uses: OpenSesame/core-github-actions/.github/workflows/run_terraform_checks.yml@<released-sha> # workflows/run_terraform_checks/1.0.2
+    uses: OpenSesame/core-github-actions/.github/workflows/run_terraform_checks.yml@<released-sha> # workflows/run_terraform_checks/1.0.3
     permissions:
       contents: read # Required to check out the code to check.
     with:
@@ -62,14 +62,14 @@ each mise task with `mise run`. It doesn't need Node, `package.json` or `npm ci`
 
 ## Outputs
 
-| Output      | Value                                                                                                                                  |
-| ----------- | -------------------------------------------------------------------------------------------------------------------------------------- |
-| `init`      | Outcome of the initialize step: `success`, `failure`, `cancelled` or `skipped`                                                         |
-| `validate`  | Outcome of the validate step: `success`, `failure`, `cancelled` or `skipped`                                                           |
-| `lint`      | Outcome of the lint step: `success`, `failure`, `cancelled` or `skipped`                                                               |
-| `format`    | Outcome of the format-check step: `success`, `failure`, `cancelled` or `skipped`                                                       |
-| `scan`      | Outcome of the scan step: `success`, `failure`, `cancelled` or `skipped`                                                               |
-| `baselined` | Number of findings in tracked `*.checkov.baseline` files, plus inline `#checkov:skip=` and `# tflint-ignore:` comments in `*.tf` files |
+| Output      | Value                                                                                                                                               |
+| ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `init`      | Outcome of the initialize step: `success`, `failure`, `cancelled` or `skipped`                                                                      |
+| `validate`  | Outcome of the validate step: `success`, `failure`, `cancelled` or `skipped`                                                                        |
+| `lint`      | Outcome of the lint step: `success`, `failure`, `cancelled` or `skipped`                                                                            |
+| `format`    | Outcome of the format-check step: `success`, `failure`, `cancelled` or `skipped`                                                                    |
+| `scan`      | Outcome of the scan step: `success`, `failure`, `cancelled` or `skipped`                                                                            |
+| `baselined` | Number of findings in tracked `*.checkov.baseline` files, plus inline `#checkov:skip=` and `# tflint-ignore` comments (`#` or `//`) in `*.tf` files |
 
 ## Contribution
 

.github/workflows/TESTS/run_gha_checks.unit.test.js

@@ -6,20 +6,27 @@ describe('run_gha_checks baselined count', () => {
   const count = files =>
     runStepInRepository(workflowFile, 'checks', 'Count baselined issues', files);
 
-  test('counts inline zizmor ignores under .github, with or without a space', () => {
+  test('counts each inline zizmor ignore comment in YAML under .github', () => {
     const result = count({
-      '.github/workflows/a.yml': 'run: echo # zizmor: ignore[adhoc-packages] reason\n',
-      '.github/actions/b/action.yml':
-        '# zizmor:ignore[template-injection] one\n# zizmor: ignore[artipacked] two\n',
-      'docs/notes.md': '# zizmor: ignore[outside-github] not counted\n',
+      '.github/workflows/a.yml':
+        'run: echo # zizmor: ignore[adhoc-packages] reason\nrun: | # zizmor: ignore[use-trusted-publishing]\n',
+      '.github/actions/b/action.yaml':
+        '#zizmor:ignore[template-injection] one\n# zizmor: ignore[artipacked] two\n',
     });
 
     expect(result.status).toBe(0);
-    expect(result.outputs.count).toBe('3');
+    expect(result.outputs.count).toBe('4');
   });
 
-  test("doesn't count its own pattern", () => {
-    const result = count({ [`.github/workflows/${workflowFile}`]: readWorkflow(workflowFile) });
+  test("doesn't count zizmor ignores in docs, tests, strings or outside .github", () => {
+    const result = count({
+      '.github/workflows/README.md': '- inline `# zizmor: ignore[<rule>] <reason>`\n',
+      '.github/workflows/CHANGELOGS/a.md': '# zizmor: ignore[adhoc-packages] reason\n',
+      '.github/workflows/TESTS/a.test.js': "const a = '# zizmor: ignore[adhoc-packages]';\n",
+      '.github/workflows/b.yml': 'run: echo "- **Inline ignores** (\\`# zizmor: ignore[...]\\`)"\n',
+      'docs/notes.yml': '# zizmor: ignore[outside-github] not counted\n',
+      [`.github/workflows/${workflowFile}`]: readWorkflow(workflowFile),
+    });
 
     expect(result.status).toBe(0);
     expect(result.outputs.count).toBe('0');