Require explicit workflow paths

[lox]

Why

Automatically selecting workflows makes launch behavior depend on filtering workflows that the compatibility runtime cannot support. Requiring an explicit selection keeps admission fail-closed and predictable.

What

The plugin entrypoint accepts either one explicit workflow path or a non-empty workflows path array. The public upload command requires explicit workflow operands. Wildcard, glob, and directory expansion has been removed, while direct single-file custom importer use remains supported.

Documentation and tests now describe and enforce the explicit workflow contract. The companion plugin schema and documentation change is buildkite-plugins/github-actions-buildkite-plugin#39.

[buildsworth-bk-app]

I found no implementation issues. This changes which workflow configurations the plugin admits, so it still needs a human sanity-check.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 14905, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

About buildsworth

Model: gpt-5.6-sol with xhigh thinking.

How to request a review: Comment @buildsworth-bk review on the PR, or request buildsworth-bk as a reviewer.

Risk labels (how buildsworth classifies risk) — buildsworth classifies risk itself from the diff. To let it approve, grant L2 approval by mentioning @buildsworth-bk (see L2 approval grant):

• L1 — Low risk (dep bumps, docs/copy, lockfiles, small presentational fixes). buildsworth may approve by default.
• L2 — Standard risk (new UI, additive API fields, refactors). Approved only with an L2 grant; otherwise comment-only.
• L3 — High risk (auth, migrations, payments, secrets, perf-critical paths). Human review always required.

[buildsworth-bk-app]

There is one broken pinned-release example; details inline.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 14911, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

Previous concerns have been addressed.

[buildsworth-bk-app]

The pinned v0.10.1 example is fixed, and I found no new issues. This changes workflow admission behavior, so it still needs a human sanity-check.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 14930, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.