Problem

main is currently red: run 30333189501 failed in 0s with no jobs and no logs.

That is not a test failure. #92 left a duplicate with: key on the react-lint checkout step, so test.yml no longer parses:

      - uses: actions/checkout@v5
        with:
          persist-credentials: false
        with:                          # <- duplicate mapping key
          persist-credentials: false

Root cause

CodeRabbit's review was correct and correctly anchored. At the reviewed commit (2d677c9), line 168 was the new flat-polygon-browser job's bare checkout, which genuinely needed persist-credentials: false; react-lint at line 24 already had it.

The suggestion got applied to both. Its committable block leads with the context line - uses: actions/checkout@v5, and this file has four byte-identical checkout steps — so a text-matching edit has no way to know which one was meant.

Nothing downstream caught it. Once the file stopped parsing, GitHub could no longer evaluate its on: triggers, so no pull_request check re-ran on the force-push; the PR kept showing the green run from before the review.

Changes

1. Remove the duplicate key — restores test.yml to a parseable state.

2. Add .github/workflows/workflow-lint.yml running actionlint over .github/workflows.

   Separate file on purpose, and it should stay that way: a workflow cannot validate itself, so the check that would have caught this is exactly the one that could not run. An independent file still parses when its neighbours are broken, converting a silent 0s run into a real annotation.

3. Give every step in test.yml a distinct name: — removes the ambiguity that caused the misapplied edit, rather than only detecting its consequences. Also makes job diffs readable and the Actions UI legible.

4. Fix fixture generation in production-browser (found by this PR's own CI, see below).

Plus for i in {1..30} → for _, clearing the one pre-existing shellcheck finding so the new gate starts green.

The second bug, and why it stayed hidden

With test.yml parseable again, production-browser ran for real for the first time — and failed:

generate_fixtures.py: error: unrecognized arguments: -- --output-dir test-fixtures-production-browser

pnpm run <script> -- <args> forwards the -- separator to the script verbatim, and argparse treats everything after a bare -- as positional. Verified both halves locally:

$ pnpm echoargs -- --output-dir X
ARGS: ["--version","0.7.2","--","--output-dir","X"]     # separator survives

This was latent in #92, not new here. The job's only previously-green run shows Generate test fixtures -> skipped: it shared a fixture cache key with the test job, hit that cache, and never ran the generation step. Giving it a distinct key — the correct fix for the collision CodeRabbit flagged — forced a cache miss and finally executed the bad invocation.

Same shape as the first bug, one layer down: a correct review comment, a fix that was right on its own terms, and no gate positioned to see what it uncovered.

Verification

actionlint 1.7.12 run locally against the broken merged commit:

.github/workflows/test.yml:27:9: key "with" is duplicated in element of "steps" section.
  previously defined at line:25,col:9 [syntax-check]

…and against this branch's tree: clean, exit 0. On the first CI run here, actionlint, react-lint, biome-lint and test all passed.

Follow-up (not in this PR)

main has no branch protection and no rulesets — I checked. The 05:55 failure was visible two minutes before the merge and nothing gated it. Requiring these checks would be worth doing separately; it needs a repo-settings change rather than a code change.

🤖 Generated with Claude Code