[Safe Outputs Conformance] SEC-006: Processor handlers do not reference E009/E010 error codes from Section 9.5 catalog

[github-actions]

Conformance Check Failure

Check ID: SEC-006
Severity: MEDIUM (x2, grouped)
Category: Security / Error-Handling Conformance

Problem Description

The Safe Outputs specification (Section 9.5, introduced in v1.26.0) defines a standardized error-code catalog E001–E010. The spec normatively requires implementations to use these codes for validation and execution failures. Two codes added in v1.26.0 are defined in the spec but are not referenced anywhere in the processor implementation (actions/setup/js/):

• E009 — CONFIG_HASH_MISMATCH (Configuration hash verification failed → 403 Forbidden): raised when workflow YAML is modified after compilation.
• E010 — RATE_LIMIT_EXCEEDED (GitHub API rate limit exceeded → 429 Too Many Requests): the spec (Section, retry guidance) states "After 3 retries, MUST fail with E010 error".

The processor currently references only E001–E008. Because E009/E010 are absent, config-hash-mismatch and rate-limit failures may surface without the standardized, machine-readable codes that consumers rely on.

Affected Components

• Spec (defines the codes): docs/src/content/docs/specs/safe-outputs-specification.md (Section 9.5, lines ~4424–4425; retry rule ~4635)
• Processor (missing references): actions/setup/js/ — handler/validation files that emit error codes (E001–E008 present; E009/E010 absent)
• Conformance check: scripts/check-safe-outputs-conformance.sh (SEC-006, lines 940–975)

🔍 Current vs Expected Behavior

Current Behavior

grep -rhoE 'E00[1-9]|E010' actions/setup/js/ yields references for E001–E008 only. No handler emits or recognizes E009/CONFIG_HASH_MISMATCH or E010/RATE_LIMIT_EXCEEDED.

Expected Behavior

Per Section 9.5, the processor must recognize and emit the full E001–E010 catalog. Config-hash verification failures should surface as E009, and rate-limit exhaustion (after the mandated 3 retries) should surface as E010, with the standard { code, message } error shape.

Remediation Steps

Suitable for a Copilot coding agent:

1. Locate the config-hash / integrity verification path in the processor and emit E009 (CONFIG_HASH_MISMATCH) with a 403-class outcome when the hash check fails.
2. Locate the GitHub API call/retry logic and, after the mandated 3 retries on a 429, fail with E010 (RATE_LIMIT_EXCEEDED) using the standard error shape.
3. Ensure both codes appear alongside the existing E001–E008 usages so SEC-006's processor grep (E009|CONFIG_HASH_MISMATCH and E010|RATE_LIMIT_EXCEEDED) matches.
4. Add/extend unit tests covering the E009 and E010 emission paths.

Verification

bash scripts/check-safe-outputs-conformance.sh

SEC-006 should report PASS: Error code catalog E001-E010 is complete and referenced in spec and implementation.

References

• Safe Outputs Specification: docs/src/content/docs/specs/safe-outputs-specification.md (Section 9.5)
• Conformance Checker: scripts/check-safe-outputs-conformance.sh
• Run ID: 29807067973
• Date: 2026-07-21

Generated by ✅ Daily Safe Outputs Conformance Checker · 44.2 AIC · ⌖ 12.4 AIC · ⊞ 6.6K · ◷

• expires on Jul 21, 2026, 10:32 PM UTC-08:00