The Tag Linter: How I Catch Untagged n8n Nodes Before They Reach Production

Description and use

A linter script caught that renaming a node in n8n caused its policy tags to become stale, leaving an effectful node unprotected and risking duplicate alerts.

Problem

Renaming a node caused its policy tags to become stale, leaving an effectful node unprotected and risking duplicate alerts.

Outcome

The linter identified 7 violations across 21 workflows, including 3 untagged effectful nodes, 2 stale entries, and 2 missing idempotent declarations, preventing potential duplicate alerts.

Workflow

• Parse workflow JSON
• Classify each node by heuristic (HTTP method, email, slack, etc.)
• Verify every effectful node has a policy entry with kind and idempotent field
• Check that every policy entry matches an existing node by UUID
• Fail if heuristic says effectful but policy says pure
• Warn on renamed nodes and update labels
• Fail if effectful node has retry enabled without idempotent key

Evidence

I renamed a node. That is the whole incident.

Source

The node was an HTTP POST to a Discord webhook, added during a debugging session and left in place because the alerts turned out to be useful.

Source

The linter is a small Node script, lint-node-tags.js, that runs inside the pre-publish gate... Three checks...

Source

I ran it over 21 workflow files — the free templates in the repo plus my production set. Seven violations:

Source