Skip to content

Promotion Nomination App #10

Promotion Nomination App

Promotion Nomination App #10

Re-run triggered September 10, 2026 14:46
Status Failure
Total duration 27s
Artifacts 1

audit-examples.yml

on: pull_request
Fit to window
Zoom out
Zoom in

Annotations

10 errors, 11 warnings, and 1 notice
HardcodedWorkdayAPIRule (ACTION): examples/Promotion_Nomination/presentation/eventDetails.pmd#L11
Inbound endpoint 'getPromotionNominationBP' uses hardcoded *.workday.com URL: '<% 'https://api.workday.com/apps/'+ site.applicationId + '/v1/promotionNominationBOS/' + eventGenericBP.for.id%>'. Use apiGatewayEndpoint instead of hardcoded Workday URLs for regional awareness. Suggested fix: replace "https://api.workday.com/apps/" with "<% apiGatewayEndpoint + '/apps/' %>". See https://github.com/Workday/WorkdayDeveloperProgram/blob/main/docs/EXAMPLE_BEST_PRACTICES.md#hardcodedworkdayapirule
HardcodedWorkdayAPIRule (ACTION): examples/Promotion_Nomination/presentation/eventDetails.pmd#L6
Inbound endpoint 'eventGenericBP' uses hardcoded *.workday.com URL: '<% 'https://api.workday.com/businessProcess/v1/events/' + queryParams.eventId %>'. Use apiGatewayEndpoint instead of hardcoded Workday URLs for regional awareness. Suggested fix: replace "https://api.workday.com/businessProcess/v1/events/" with "<% apiGatewayEndpoint + '/businessProcess/v1/events/' %>". See https://github.com/Workday/WorkdayDeveloperProgram/blob/main/docs/EXAMPLE_BEST_PRACTICES.md#hardcodedworkdayapirule
HubExampleJsonRule (ACTION): examples/Promotion_Nomination/example.json#L0
example.json is missing. "app-info.json" looks like the metadata file; rename it to example.json. Suggested fix: replace "app-info.json" with "example.json". See https://github.com/Workday/WorkdayDeveloperProgram/blob/main/docs/EXAMPLE_BEST_PRACTICES.md#hubexamplejsonrule
HubReadmeSectionsRule (ACTION): examples/Promotion_Nomination/README.md#L0
README.md uses HTML headings instead of markdown. Rewrite it with the four markdown sections from examples/_template/README.md: "## What it is", "## What's inside", "## How to use it", "## Before you deploy". See https://github.com/Workday/WorkdayDeveloperProgram/blob/main/docs/EXAMPLE_BEST_PRACTICES.md#hubreadmesectionsrule
HubFolderKebabCaseRule (ACTION): examples/Promotion_Nomination#L0
Folder name "Promotion_Nomination" is not kebab-case (lowercase letters, digits, and hyphens). Rename it to "promotion-nomination". Suggested fix: replace "Promotion_Nomination" with "promotion-nomination". See https://github.com/Workday/WorkdayDeveloperProgram/blob/main/docs/EXAMPLE_BEST_PRACTICES.md#hubfolderkebabcaserule
audit
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
PMDSectionOrderingRule (ADVICE): examples/Promotion_Nomination/presentation/managerNomination.pmd#L3
PMD sections are not in the correct order. Expected: [1. id, 2. securityDomains, 3. endPoints, 4. outboundData, 5. presentation] Actual: [1. id, 2. endPoints, 3. presentation, 4. outboundData, 5. securityDomains] See https://github.com/Workday/WorkdayDeveloperProgram/blob/main/docs/EXAMPLE_BEST_PRACTICES.md#pmdsectionorderingrule
StringBooleanRule (ADVICE): examples/Promotion_Nomination/presentation/eventDetails.pmd#L132
Field 'enabled' has string value 'false' instead of boolean false. Use boolean false instead of string 'false'. Suggested fix: replace ""enabled": "false"" with ""enabled": false". See https://github.com/Workday/WorkdayDeveloperProgram/blob/main/docs/EXAMPLE_BEST_PRACTICES.md#stringbooleanrule
ScriptStringConcatRule (ADVICE): examples/Promotion_Nomination/presentation/eventDetails.pmd#L11
Inbound endpoint 'getPromotionNominationBP' uses string concatenation with + operator: ''https://api.workday.com/apps/' + site.applicationId + '/v1/promotionNominationBOS/' + eventGenericBP.for.id'. Consider using PMD template strings with backticks and {{ }} syntax instead (e.g., `Hello {{name}}!`). Suggested fix: replace "'https://api.workday.com/apps/' + site.applicationId + '/v1/promotionNominationBOS/' + eventGenericBP.for.id" with "`https://api.workday.com/apps/{{site.applicationId}}/v1/promotionNominationBOS/{{eventGenericBP.for.id}}`". See https://github.com/Workday/WorkdayDeveloperProgram/blob/main/docs/EXAMPLE_BEST_PRACTICES.md#scriptstringconcatrule
EndpointBaseUrlTypeRule (ADVICE): examples/Promotion_Nomination/presentation/eventDetails.pmd#L11
Inbound endpoint 'getPromotionNominationBP' is pointing to a Workday API, but not leveraging a baseUrlType. Extract Workday endpoints to shared AMD data providers to avoid duplication. See https://github.com/Workday/WorkdayDeveloperProgram/blob/main/docs/EXAMPLE_BEST_PRACTICES.md#endpointbaseurltyperule
ScriptStringConcatRule (ADVICE): examples/Promotion_Nomination/presentation/eventDetails.pmd#L6
Inbound endpoint 'eventGenericBP' uses string concatenation with + operator: ''https://api.workday.com/businessProcess/v1/events/' + queryParams.eventId'. Consider using PMD template strings with backticks and {{ }} syntax instead (e.g., `Hello {{name}}!`). Suggested fix: replace "'https://api.workday.com/businessProcess/v1/events/' + queryParams.eventId" with "`https://api.workday.com/businessProcess/v1/events/{{queryParams.eventId}}`". See https://github.com/Workday/WorkdayDeveloperProgram/blob/main/docs/EXAMPLE_BEST_PRACTICES.md#scriptstringconcatrule
EndpointBaseUrlTypeRule (ADVICE): examples/Promotion_Nomination/presentation/eventDetails.pmd#L6
Inbound endpoint 'eventGenericBP' is pointing to a Workday API, but not leveraging a baseUrlType. Extract Workday endpoints to shared AMD data providers to avoid duplication. See https://github.com/Workday/WorkdayDeveloperProgram/blob/main/docs/EXAMPLE_BEST_PRACTICES.md#endpointbaseurltyperule
PMDSectionOrderingRule (ADVICE): examples/Promotion_Nomination/presentation/eventDetails.pmd#L3
PMD sections are not in the correct order. Expected: [1. id, 2. securityDomains, 3. endPoints, 4. presentation] Actual: [1. id, 2. endPoints, 3. presentation, 4. securityDomains] See https://github.com/Workday/WorkdayDeveloperProgram/blob/main/docs/EXAMPLE_BEST_PRACTICES.md#pmdsectionorderingrule
HubGitkeepRule (ADVICE): examples/Promotion_Nomination/presentation/.gitkeep#L0
.gitkeep is no longer needed because "examples/Promotion_Nomination/presentation" has 4 other file(s). Delete it. See https://github.com/Workday/WorkdayDeveloperProgram/blob/main/docs/EXAMPLE_BEST_PRACTICES.md#hubgitkeeprule
HubGitkeepRule (ADVICE): examples/Promotion_Nomination/model/.gitkeep#L0
.gitkeep is no longer needed because "examples/Promotion_Nomination/model" has 5 other file(s). Delete it. See https://github.com/Workday/WorkdayDeveloperProgram/blob/main/docs/EXAMPLE_BEST_PRACTICES.md#hubgitkeeprule
ArcaneAuditorWarning (ADVICE): examples/Promotion_Nomination#L0
Arcane Auditor could not parse part of this folder, so some script rules were skipped: * MORE_THAN See https://github.com/Workday/WorkdayDeveloperProgram/blob/main/docs/EXAMPLE_BEST_PRACTICES.md#arcaneauditorwarning
Example audit
42 more finding(s) are listed in the job summary.

Artifacts

Produced during runtime
Name Size Digest
audit-report Expired
13.7 KB
sha256:0e6dddf1fa8dd61f9ccca2438531a0e9da10baa54a38caf36ac0e14f76b028eb