Phase 1 warn-only checker crashes on non-mapping YAML documents #508

Defect

standards/phase1/check.py crashes when a workflow file is syntactically valid YAML but its top-level value is a non-empty non-mapping (for example a sequence). That bypasses the package's warn-only reporting boundary and makes the check step fail even when --enforce is absent.

Exact source and reproduction

• Base/head: a5c22d372fd01cd1aafc9202c8596fbc0dc75adf
• Source blob: standards/phase1/check.py = 4255442efd4298211c582ce1c4abb6fc5136b5b3
• Fixture: .github/workflows/list.yml containing:

- one

Run:

python standards/phase1/check.py <fixture-root> --json

Observed: exit 1 with AttributeError: 'list' object has no attribute 'get' at jobs = y.get("jobs") or {}.

Control: the existing passing Phase 1 fixture returns [] and exits 0 under the same exact source.

Expected behavior basis

docs/phase1-warn-only.md says findings are emitted as warning annotations and the job exits zero unless enforce: true. The module docstring also says the check is warn-only by default, and _load() is explicitly intended to report parse problems rather than crash.

Bounded correction

Validate that each loaded workflow and Dependabot document has the mapping shape required by the checker before calling mapping methods. Emit a deterministic yaml-parse or dedicated document-shape finding in warn-only mode; preserve exit 1 under --enforce when that finding exists.

Add regressions covering at least a non-empty sequence and scalar top level, plus the current mapping control.

Acceptance

• Without --enforce, invalid document shapes produce structured findings and exit 0.
• With --enforce, the same findings exit 1 without a traceback.
• Existing valid pass/fail fixtures retain their current results.
• Run the repository-required tests, validation, and compile commands; report exact results.

Scope and ownership

Allowed implementation scope: standards/phase1/check.py, tests/test_phase1_warn.py, and minimal Phase 1 fixtures/docs if needed. Current open PRs #455, #495, #496, #497, #503, #506, and #507 do not change these paths as of the base above. This issue authorizes a bounded proposal only; it does not authorize rollout, required-check activation, merge, release, or closure of broader GES acceptance gates.