The headroom check derives its job list by matching workflow jobs on
the prepare-env / prepare-cluster make targets, and its coverage
cross-check demands that every workflow file naming packages/core/testing
yield at least one such job. Moving the sandbox bring-up into
.github/actions/e2e-prepare left the target inside the action and only
runs-on in the workflow, so the sweep matched neither the e2e nor the
upgrade-e2e job and the cross-check turned red — exactly the case the
file's header named as its floor and declined to cover.
Both legs now follow a local `uses: ./…` into the action file it names,
and into a local action that action uses in turn, so a job is matched
wherever the make target actually sits and a workflow is read together
with the actions it names. A `uses:` naming a reusable workflow is
deliberately not followed: .github/workflows is already swept file by
file, and the calling job carries no runs-on for this check to size.
The sweep now emits JOB / REF / ERROR records so both legs read one
derivation instead of two that can disagree. A local reference the
strict path pattern cannot read, one that resolves to no readable
action.yaml, and an action that reaches itself are all refusals rather
than silent drops — a marker this cannot open is a lane it cannot see.
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Myasnikov Daniil
2cb2c3ae6c