Problem

fallow dead-code on a typical CI repo emits 20+ WARN invalid entry pattern lines from tokens extracted out of GitHub Actions workflow run: blocks. Three classes of false positive:

• GitHub Actions expressions: curl "${{ env.URL }}/api/health" whitespace-splits, producing chunks like }}/api/health" (unclosed alternation in glob syntax).
• jq array iterators: jq -r '.[]' file.json produces the token '.[]' (empty character class).
• Perl regex fragments: grep -oP '(?<=Module )\./[^ ]+(?= ...)' produces chunks like )\./[^ (backslash plus unclosed class).

These reach globset::GlobBuilder::new(...).build() which rejects them and emits the warnings. They are not real entry patterns and should never reach globset.

Fix

Two changes in crates/core/src/scripts/:

1. could_be_file_path (new, mod.rs): negative-only guard rejecting tokens whose syntax precludes a Unix path. Three rules:

   • ${{ ... }} GHA expressions, plus standalone }} not balanced by {{ (so Mustache/Handlebars template paths like templates/{{name}}.hbs still pass).
   • Backslash anywhere in the token.
   • Empty [] or unclosed [^... character classes (first [ only; suffices for in-the-wild fragments).

2. looks_like_file_path refactor (mod.rs): now delegates to could_be_file_path for the negative checks before applying its strict positive rules (known extension, .//../ prefix, contains / and not a scoped package or URL). Behaviour unchanged for callers; the split exposes a lenient filter for use cases where bare-name paths (deploy.log, Makefile) must pass through.

3. extract_ci_signals filter (ci.rs): cmd.config_args (the value after --config/-c) bypasses parse_script's existing looks_like_file_path gate, so jq array iterators or regex fragments passed via flags can leak into entry_files. Re-filter through could_be_file_path here. cmd.file_args are already pre-filtered by parse_script and are not re-checked.

Tests

10 unit tests in mod.rs (existing GHA test renamed for consistency, 5 new for jq/regex/Mustache/bare-name/lenient-positive cases) and 2 integration tests in ci.rs using verbatim in-the-wild YAML fragments. Next.js dynamic route segments (app/[id]/page.tsx, pages/[...slug].ts) are explicitly tested as positive cases to guard against false negatives in the bracket-class rule.

Risk

• The bracket-class rule only checks the first [ in a token. Documented in the code comment. A token with a valid leading class followed by a malformed trailing class would slip through; no such fragment has been observed in the wild.
• The }} rule allows balanced Mustache/Handlebars templates. If an upstream user has paths containing literal }} without a matching {{, they would be filtered. Such paths are not valid Unix path syntax in any case.

Verified on

cargo test --workspace, cargo clippy --workspace --all-targets -- -D warnings, cargo fmt --all -- --check all clean. Real-world: this fork-pinned binary is currently running in a Turborepo monorepo CI (example output) where it dropped stderr noise from 30+ warnings to 0 across the dead-code, audit, and health commands.