CSV Structural Preflight

Check one UTF-8 CSV for structural problems in GitHub Actions. The composite Action runs on the GitHub runner, makes no network request, requires no API key, and has no runtime dependency beyond Node.js 20 or later.

It detects invalid encoding, ambiguous quoted fields, empty or duplicate headers, rows with the wrong number of columns, and duplicate rows. It writes a normalized CSV when parsing succeeds and always writes a content-free issue report. Findings fail the step instead of silently repairing ambiguous rows.

Usage

name: CSV preflight

on:
  pull_request:
    paths:
      - "data/import.csv"

permissions:
  contents: read

jobs:
  csv-preflight:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Check CSV structure
        uses: softpeanut/csv-structural-preflight@v1
        with:
          path: data/import.csv
          normalized_path: ${{ runner.temp }}/import.normalized.csv
          report_path: ${{ runner.temp }}/import.issues.csv
      - name: Preserve evidence
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: csv-preflight
          if-no-files-found: warn
          path: |
            ${{ runner.temp }}/import.normalized.csv
            ${{ runner.temp }}/import.issues.csv

For stronger supply-chain pinning, replace v1 with a reviewed full commit SHA.

Inputs

Input	Required	Description
path	yes	One regular UTF-8 CSV file, relative or absolute; maximum 10 MiB.
normalized_path	no	New normalized CSV destination; defaults to the runner temp directory.
report_path	no	New issue-report destination; defaults to the runner temp directory.

The three paths must be distinct. Existing output files are never overwritten.

Privacy boundary

The Action does not print input cells or absolute file paths. Its issue report contains finding types and row or column numbers, not copied source values. The normalized output still contains the CSV data by design, so uploading that artifact is a separate decision owned by the workflow author. The Action itself makes no network request, but the runner, checkout step, and any later artifact step remain part of the caller's trust boundary.

This is a structural check, not an importer schema, privacy audit, security review, or guarantee that Shopify, an ERP, or another target accepts the file.

Fixed-scope setup

A completed 100,000-sat option configures this Action for one public repository or sanitized minimal reproduction. It requires no private access, credentials, real CSV content, name, email, address, or payment proof. Read the exact setup terms before ordering through the pseudonymous Shopstr listing.

License and support

The Action is MIT licensed. Use GitHub Issues only for reproducible bugs, with synthetic data and without private links, credentials, customer information, real CSV rows, or payment details.