FP610 · workspace-unverified
A step’s `uses: ./...` points to a place in the runner’s workspace that flowpact cannot read, so the action is not verified.
| Code | Name | Category | Default severity |
|---|---|---|---|
FP610 | workspace-unverified | Graph structure | 🔵 info |
Why it matters
GitHub resolves a step’s ./path against the workspace, not the repository. When the path lies in another repository’s checkout, in a checkout of this repository at another ref, outside the workspace, where an earlier step’s script writes, or where no checkout of this repository puts it, flowpact cannot read the action: its inputs, outputs and the path itself are taken on trust.
How to fix
Nothing to fix if this is intended. To have it checked, reference another repository’s action as owner/repo/path@ref, and this repository’s as $/path (or check this repository out where the path points).
Example
- uses: actions/checkout@v5
with:
repository: acme/shared-actions
path: shared
- uses: ./shared/setupConfigure
Change the severity (or turn the rule off) in .github/flowpact/flowpact.config.yml, by code or by name:
rules:
FP610: off
# or: workspace-unverified: errorExplain it in the terminal:
flowpact explain FP610