[deep-report] Top-level roles: frontmatter field is silently ignored, falls back to defaults with no warning

[github-actions]

Problem

Top-level roles: is still documented and schema-typed as a valid frontmatter field, but the parser (extractRoles()) only honors on.roles — a top-level roles: field is silently ignored, and the workflow falls back to the default roles [admin, maintainer, write] with no warning or validation error. A workflow author setting top-level roles: (following current docs/schema) would get materially different access control than intended, with no signal that anything is wrong.

Evidence

• pkg/workflow/role_checks.go:134-150 (extractRoles()) only reads on.roles, not top-level roles:.
• pkg/workflow/extract_roles_test.go covers the on.roles path but not a top-level-roles-is-ignored case.
• Related historical issues Move roles from top-level frontmatter to on.roles #16606 / [CI Failure Doctor] Allow top-level roles in schema #16674 already moved the canonical location to on.roles at the implementation level, but the docs/schema/validation surface wasn't fully cleaned up — this is a residual gap, not a re-report of the original migration.
• Source: Schema Consistency discussion #56834, finding 1.

Suggested action

Pick one:

• Add a validation error/warning when top-level roles: is present, pointing the author to on.roles, or
• Remove top-level roles: from the docs/schema entirely if it's fully superseded.

Silent fallback to defaults is the risky middle ground and should be eliminated either way.

Acceptance criteria

• A workflow with top-level roles: either produces a clear validation error/warning, or the field is removed from docs/schema.
• Test added covering the top-level-roles-is-ignored (or now-rejected) case.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See 网络 Configuration for more information.

Generated by 🔬 Deep Report · claude · agent · 258.7 AIC · ⌖ 8.26 AIC · ⊞ 12.4K · ◷

• expires on Aug 30, 2026, 10:49 PM UTC-08:00