action_refusal

Why a declared action or a GitHub workflow job is refused: an action_refused error's reason, and the reason lvcs explain and lvcs status print for a refused job. A refused job holds every change channel until it is fixed or listed in lvcs.toml's [workflows] skip.

Value	Meaning
`duplicate`	Two declarations make one action: the same name, the same `ActionId`, two jobs or actions for one channel, or a `[channels]` combination named like an action. They are never merged.
`container`	A job runs in a `container:`, which the sandbox has no image store for.
`services`	A job declares `services:`.
`docker_action`	A step runs a Docker action (`docker://` or `runs.using: docker`).
`reusable_workflow`	A job calls a reusable workflow (`jobs.<id>.uses`).
`event_payload`	An expression reads `github.event`, the event's payload, which no LVCS run has.
`needs_outputs`	An expression reads `needs`, which slice 1 does not run in order (stage D).
`download_artifact`	A step uses `actions/download-artifact` (stage D).
`shell`	A step's `shell` is `pwsh`, `powershell`, `cmd`, or not a command line holding `{0}`.
`dynamic_matrix`	A matrix, or one of its dimensions, is an expression.
`secret_in_change`	A change action declares or reads `secrets` or `github.token`, which only an action gated `after` a channel has: any merged code runs in a change action's sandbox.
`unpinned_uses`	A third-party `uses:` names a ref that is not a commit.
`not_vendored`	A third-party or local `uses:` names an action with no vendored tree (stage D).
`unmapped_setup`	A `setup-` action other than `actions/setup-node`, or a `setup-node` input LVCS can't satisfy (`lts/`, `node-version-file`, `registry-url`).
`oidc`	`permissions: id-token: write`: LVCS has no OIDC issuer.
`bad_channel`	A job's `environment` (the channel of a gated action), a change job's lowercased `<file stem>/<job id>`, or an action's channel name is refused, a `[channels]` combination has no members, or an `after`, a channel trigger, or a `[channels]` member names the generator's channel, which can't gate an action.
`too_many`	A matrix past `ACTION_MATRIX_MAX` cells, or a file past `WORKFLOW_BYTES`.
`unsupported_step`	A step kind GitHub runs that LVCS doesn't: `wait`, `wait-all`, `cancel`, `parallel`, `background: true`, or a built-in's input it can't honor.
`bad_needs`	A job's `needs` names no job of its file, or `needs` forms a cycle.
`unknown_trigger`	A gated action's channel trigger (`on = { channel = ... }`, or a workflow's `workflow_run`), or an `after` or `[channels]` member, names no action's channel and no combination, or names its own.
`trigger_cycle`	Channel triggers, `after` links, and `needs` form a cycle, so a channel would wait on itself; the refusal names the cycle.
`invalid`	The file is not a workflow (YAML that doesn't parse as one), or an expression doesn't parse or reads a context LVCS doesn't have.

Cardinality: 22.