Fix submodule detection, the CleanupArtifacts NameError and the skippable Bandit scan

[Paebbels]

New Features

• None. Three defect fixes found while cross-checking the documentation against the workflows in Documentation rework: cross-check every job template against its workflow #245.

Changes

• No input, output or default was added, renamed or removed, so @r7 consumers need no adjustment.
• CheckCodeQuality.yml's artifact input is now unused. It is kept declared, because removing an input from a stable release branch breaks every consumer that passes it — CompletePipeline does. See the note at the bottom.

Bug Fixes

• PrepareJob.yml: submodules were never detected. The check tested for a file named .gitsubmodules; Git's file is .gitmodules. has_submodules was therefore always 'false', and git_submodule_count, git_submodule_names and git_submodule_paths kept their initial empty values — for every repository, since the workflow was introduced.

  The block already had the correct name in a local variable one line below:

  if [[ -f .gitsubmodules ]]; then
    has_submodules="true"
    git_modules_file=.gitmodules   # <- correct name, one line too late

  The variable is now assigned first and used for the test.

  Verified against a scratch repository with two submodules:

  has_submodules=true
  count=2
  names=libA:libB
  paths=deps/libA:deps/libB
  

  and has_submodules=false once .gitmodules is removed.

  Nothing consumes these four outputs today, which is why nobody hit it. It matters as soon as a pipeline wants to check out submodules conditionally.

• CleanupArtifacts.yml: an unknown artifact ID raised NameError. Both compute steps call printf(...) in their case _: fallback, but the step runs shell: python, where printf is not a function:

  case _:
    printf(f"Name '{name}' not found in JSON dictionary.")

  So an artifact-json-ids entry that is not a key of the JSON dictionary — a typo, or a key removed from Parameters.yml while a consumer still lists it — aborted the step instead of reporting the name. That is precisely the case the branch exists for.

  Reproduced against the previous revision of the step:

  BEFORE the fix -> exit code: 1
      NameError: name 'printf' is not defined. Did you mean: 'print'?
  

  and against this one:

  Name 'typo_key' not found in JSON dictionary.
  Artifact to delete:
    pyX-UnitTestReportSummary-XML-*
    pyX-Packages
  

  The second run also confirms that a #-commented entry is still skipped and that the prefix/postfix forms still resolve.

• CheckCodeQuality.yml: the security scan could be skipped silently. The Bandit step was guarded by if: inputs.artifact != '', although the step writes its report to a fixed path (report/bandit/report.xml) and never used that parameter. An empty artifact name skipped the scan, while the job installed bandit, ran to the end and reported success — a green security check that scanned nothing.

  artifact is declared required: true, but GitHub does not enforce required inputs that arrive as an empty string from an expression, which is how a consumer would realistically pass one.

  The guard is removed. The scan now runs whenever the job runs, i.e. whenever bandit: 'true'.

Documentation

• None here. Documentation rework: cross-check every job template against its workflow #245 documents all three as observed behaviour with .. attention:: notes; those notes are removed in that pull-request's branch, since this one makes them obsolete. The two pull-requests are independent, but both should land — see the note below.

Unit Tests

• _Checking_CleanupArtifacts.yml now passes an unknown_key entry, so the case _: branch is exercised by the verification pipeline rather than only by a typo in production.

• The PrepareJob submodule logic was executed offline against a scratch repository, in both states (.gitmodules present and absent) — output quoted above. The Actions repository itself has no submodules, so its own pipeline cannot cover the positive case.

• Both changed shell scripts pass bash -n, and all four changed workflows parse as YAML.

• The CheckCodeQuality change is covered by this repository's own pipeline: _Checking_JobTemplates.yml instantiates the template, and the Bandit findings in myPackage/myFramework are deliberate, so the step must run and report them.

---

Related Issues and Pull-Requests

• Findings A11, A12 and A13, all recorded while writing Documentation rework: cross-check every job template against its workflow #245.
• Independent of v7.14.2 #244 (v7.14.2) and Documentation rework: cross-check every job template against its workflow #245 (documentation rework); no file overlaps.

Note

CheckCodeQuality.yml's artifact input is now referenced nowhere. It is declared required: true, so it cannot be dropped without breaking consumers that pass it on @r7. Two options for a later major release: remove it, or give it a purpose by uploading the bandit XML report under that name. Left as is here, because either choice is an interface decision rather than a bug fix.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Coverage ∅ diff coverage · +0.00% coverage variation

Metric	Results
Coverage variation	✅ +0.00% coverage variation
Diff coverage	✅ ∅ diff coverage

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (08dd2c2)	45	41	91.11%
Head commit (5808758)	45 (+0)	41 (+0)	91.11% (+0.00%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#246)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.22%. Comparing base (08dd2c2) to head (5808758).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##              dev     #246   +/-   ##
=======================================
  Coverage   82.22%   82.22%           
=======================================
  Files           1        1           
  Lines          45       45           
  Branches        9        9           
=======================================
  Hits           37       37           
  Misses          4        4           
  Partials        4        4           

Flag	Coverage Δ
unittests	82.22% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.