[plan] Split `strict_mode_validation.go` into focused concern-specific files

[github-actions]

Objective

Split pkg/workflow/strict_mode_validation.go (546 lines — 1.8× the 300-line hard limit) into multiple focused files, each handling a distinct concern.

Context

From discussion #21398 (Repository Quality Improvement Report - Validator File Size Compliance). This file combines four distinct validation concerns: permissions enforcement, network policy, MCP network requirements, tools checking, deprecated fields, and environment secrets validation.

Approach

Step 1: Create pkg/workflow/strict_mode_network_validation.go containing:

• validateStrictNetwork
• validateStrictMCPNetwork
• validateStrictTools

Step 2: Create pkg/workflow/strict_mode_env_validation.go containing:

• validateEnvSecrets
• getEngineBaseEnvVarKeys
• validateEnvSecretsSection

Step 3: Create pkg/workflow/strict_mode_permissions_validation.go containing:

• validateStrictPermissions
• validateStrictDeprecatedFields
• validateStrictFirewall

Step 4: Reduce strict_mode_validation.go to contain only the orchestrating function validateStrictMode plus any shared package-level variables/types not suited to the other files.

Step 5: Fix imports in each new file as needed.

Step 6: Run make fmt && make lint && make test-unit — all must pass.

⚠️ Do NOT change any function logic. This is a pure code organization refactor.

Files to Modify

• Reduce: pkg/workflow/strict_mode_validation.go (keep only orchestrator)
• Create: pkg/workflow/strict_mode_network_validation.go
• Create: pkg/workflow/strict_mode_env_validation.go
• Create: pkg/workflow/strict_mode_permissions_validation.go

Acceptance Criteria

• strict_mode_permissions_validation.go contains permissions, deprecated fields, and firewall checks
• strict_mode_network_validation.go contains network, MCP network, and tools checks
• strict_mode_env_validation.go contains environment secrets validation
• strict_mode_validation.go is reduced to the orchestrator only
• All resulting files are under 300 lines
• make test-unit passes
• make fmt && make lint pass

Generated by Plan Command for issue #discussion #21398 · ◷

• expires on Mar 19, 2026, 11:46 PM UTC