fix(ci): reject YAML merge keys even with allowed trigger names

Author: codex

scripts/ci/check-github-actions-policy.py

@@ -5,7 +5,7 @@
 
 import yaml
 from yaml.events import AliasEvent, DocumentEndEvent, DocumentStartEvent, NodeEvent
-from yaml.nodes import MappingNode, ScalarNode
+from yaml.nodes import MappingNode, ScalarNode, SequenceNode
 
 ROOT = Path(__file__).resolve().parents[2]
 WORKFLOWS = ROOT / ".github" / "workflows"
@@ -35,6 +35,16 @@ def inspect(path: Path) -> list[str]:
         root = yaml.compose(text, Loader=PolicyLoader)
         if not isinstance(root, MappingNode):
             raise ValueError("workflow document root must be a mapping")
+        pending = [root]
+        while pending:
+            node = pending.pop()
+            if isinstance(node, MappingNode):
+                for key, value in node.value:
+                    if isinstance(key, ScalarNode) and key.tag == "tag:yaml.org,2002:merge":
+                        raise ValueError("YAML merge keys are unsupported")
+                    pending.extend((key, value))
+            elif isinstance(node, SequenceNode):
+                pending.extend(node.value)
         on_nodes = [value for key, value in root.value
                     if isinstance(key, ScalarNode) and key.value == "on"]
         if len(on_nodes) != 1:

scripts/ci/test_github_actions_policy.py

@@ -47,6 +47,8 @@ def test_rejects_duplicate_alias_merge_document_directive_and_tag(self):
             "on: &events {workflow_dispatch: null}\n",
             "on: *events\n",
             "on: {<<: {workflow_dispatch: null}, push: null}\n",
+            "on: {<<: {workflow_dispatch: null}}\n",
+            "<<: {on: {workflow_dispatch: null}}\non: {workflow_call: null}\n",
             "---\non: {workflow_dispatch: null}\n",
             "on: {workflow_dispatch: null}\n...\n",
             "%YAML 1.2\non: {workflow_dispatch: null}\n",