validate.py: stop rejecting valid non-32-hex action IDs - #45
Merged
Conversation
The action-id check assumed every id was a 32-character hex string (or a <hex>_<hex> / <hex>~<hex> compound), but the live action catalog carries other shapes that import fine: a 26-character ULID joined to a hex id (custom IOC / API-integration actions), unequal compound halves (event query actions), and longer hex strings (RTR actions). Those valid ids were flagged as invalid locally. Treat action ids as opaque catalog identifiers: one or more lowercase letter/digit segments joined by '_' or '~'. This still rejects the real failure modes the check guards against (UPPER_SNAKE placeholders, punctuation, all-same-character) without blocking real ids. The credential definition_id check (CREDENTIAL_ID_PATTERN) is unchanged; that value is genuinely 32-char hex. Reworks the two tests that encoded the wrong assumption (wrong-length and malformed-compound now describe valid shapes), adds positive tests for the real ULID/longer/unequal forms plus an uppercase-placeholder rejection test, and softens the 'action IDs are 32-char hex' wording across the docs (README, AGENTS.md, CLAUDE.md, authoring/workflows SKILL + references). Confirmed against the live catalog via action_search.py.
prvn
approved these changes
Aug 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The local validator rejected valid action IDs whenever they were not exactly 32-character hex (or a
<hex>_<hex>/<hex>~<hex>compound of two 32-char halves). Probing the live action catalog showed several action types carry other, legitimate shapes that import and release fine:01gvk6e58p1815t6gz84000001_18df367939034f1bb97e336c5cd14de4The old regex flagged all of these as invalid locally, blocking valid workflows before import.
This treats an action ID as an opaque catalog identifier: one or more lowercase letter/digit segments joined by
_or~. The check still rejects the real failure modes it exists for — UPPER_SNAKE placeholders (PLACEHOLDER_*,VIRUSTOTAL_CONFIG_ID), punctuation, and all-same-character fakes — without constraining length or alphabet beyond that. The separate credentialdefinition_idcheck is unchanged; that value is genuinely 32-char hex.Also reworks the two unit tests that encoded the disproven assumption (a wrong-length id and a compound with unequal halves are now valid shapes, with positive tests for the real ULID / longer / unequal forms and an added uppercase-placeholder rejection test), and softens the "action IDs are 32-char hex" wording across the docs (README, AGENTS.md, CLAUDE.md, the authoring and workflows SKILL files and their references).
Verified: full test suite passes (559), pylint unchanged, markdownlint clean, and the real catalog IDs above were confirmed via
action_search.py.