From 8550a14583622c4ba8fae974d448e4c1b01b1054 Mon Sep 17 00:00:00 2001
From: Raj-StepSecurity <rajkumar@stepsecurity.io>
Date: Thu, 10 Sep 2026 17:05:43 +0530
Subject: [PATCH] fix: sync-status reports success for runs that did not
 succeed

---
 .github/workflows/test.yaml | 42 +++++++++++++++++++++++++++++++++++++
 dist/index.js               | 12 ++++++++++-
 src/main.ts                 | 18 ++++++++++++++--
 3 files changed, 69 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index f55329f..82d1407 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -25,3 +25,45 @@ jobs:
         inputs: '{"message": "mushrooms in the morning"}'
         wait-for-completion: true
         wait-timeout-seconds: 26
+
+    # sync-status: true with a workflow that succeeds — action should pass
+    - name: sync-status succeeds when workflow succeeds
+      uses: ./
+      with:
+        workflow: echo-1.yaml
+        inputs: '{"message": "sync-status success test"}'
+        wait-for-completion: true
+        sync-status: true
+
+    # sync-status: true with a workflow that exits 1 — action should fail
+    - name: sync-status fails when workflow fails
+      id: sync_fail
+      uses: ./
+      continue-on-error: true
+      with:
+        workflow: echo-3.yaml
+        wait-for-completion: true
+        sync-status: true
+    - name: Verify sync-status step failed
+      if: steps.sync_fail.outcome != 'failure'
+      run: |
+        echo "Expected sync-status step to fail but it did not"
+        exit 1
+
+    # sync-status: true with a timeout shorter than the workflow runtime — action should fail
+    # echo-2 sleeps for 11 seconds; a 5-second timeout means the run is still in_progress
+    - name: sync-status fails when wait times out before completion
+      id: sync_timeout
+      uses: ./
+      continue-on-error: true
+      with:
+        workflow: echo-2.yaml
+        inputs: '{"message": "timeout test"}'
+        wait-for-completion: true
+        wait-timeout-seconds: 5
+        sync-status: true
+    - name: Verify timeout step failed
+      if: steps.sync_timeout.outcome != 'failure'
+      run: |
+        echo "Expected timeout step to fail but it did not"
+        exit 1
diff --git a/dist/index.js b/dist/index.js
index 7f07ab0..05eb659 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -40787,6 +40787,7 @@ var version = "1.3.2";
 
 // src/main.ts
 var API_VERSION = "2026-03-10";
+var FAILED_CONCLUSIONS = /* @__PURE__ */ new Set(["failure", "cancelled", "timed_out", "startup_failure", "stale"]);
 async function run() {
   info(`\u{1F3C3} Workflow Dispatch Action v${version}`);
   try {
@@ -40878,11 +40879,20 @@ Note: The workflow is still running but we have stopped waiting. You can check t
           headers: { "x-github-api-version": API_VERSION }
         }
       );
+      const runStatusNow = finalRunData.status;
       const conclusion = finalRunData.conclusion;
-      if (conclusion === "failure") {
+      if (runStatusNow !== "completed") {
+        setFailed(
+          `Workflow run did not complete (status: ${runStatusNow}). Check the run details here: ${dispatchResp.data.html_url}`
+        );
+      } else if (conclusion === "failure") {
         setFailed(`Workflow run failed. Check the run details here: ${dispatchResp.data.html_url}`);
       } else if (conclusion === "cancelled") {
         setFailed(`Workflow run was cancelled. Check the run details here: ${dispatchResp.data.html_url}`);
+      } else if (FAILED_CONCLUSIONS.has(String(conclusion))) {
+        setFailed(
+          `Workflow run concluded '${conclusion}'. Check the run details here: ${dispatchResp.data.html_url}`
+        );
       } else {
         info(`\u{1F389} Workflow conclusion: ${conclusion}`);
       }
diff --git a/src/main.ts b/src/main.ts
index afe4f50..d41f8a4 100644
--- a/src/main.ts
+++ b/src/main.ts
@@ -14,6 +14,10 @@ import * as PackageJSON from '../package.json'
 
 const API_VERSION = '2026-03-10' // Latest API version as of March 2026, update as needed
 
+// Conclusions that unambiguously mean the run did not succeed.
+// `neutral`, `skipped`, and `action_required` are left passing, as before.
+const FAILED_CONCLUSIONS = new Set(['failure', 'cancelled', 'timed_out', 'startup_failure', 'stale'])
+
 type Workflow = {
   id: number
   name: string
@@ -154,13 +158,23 @@ async function run(): Promise<void> {
           headers: { 'x-github-api-version': API_VERSION },
         },
       )
+      const runStatusNow = finalRunData.status
       const conclusion = finalRunData.conclusion
 
-      // Set this action to failed if the triggered workflow run failed or was cancelled
-      if (conclusion === 'failure') {
+      // An incomplete run has no conclusion yet, so passing here would report
+      // success for work still in flight (e.g. after the wait above timed out).
+      if (runStatusNow !== 'completed') {
+        core.setFailed(
+          `Workflow run did not complete (status: ${runStatusNow}). Check the run details here: ${dispatchResp.data.html_url}`,
+        )
+      } else if (conclusion === 'failure') {
         core.setFailed(`Workflow run failed. Check the run details here: ${dispatchResp.data.html_url}`)
       } else if (conclusion === 'cancelled') {
         core.setFailed(`Workflow run was cancelled. Check the run details here: ${dispatchResp.data.html_url}`)
+      } else if (FAILED_CONCLUSIONS.has(String(conclusion))) {
+        core.setFailed(
+          `Workflow run concluded '${conclusion}'. Check the run details here: ${dispatchResp.data.html_url}`,
+        )
       } else {
         core.info(`🎉 Workflow conclusion: ${conclusion}`)
       }