[plan] Fix O(n²) string building in expression_parser.go

[github-actions]

Objective

Replace O(n²) string concatenation with strings.Builder in BreakLongExpression and BreakAtParentheses in pkg/workflow/expression_parser.go.

Context

From Sergo audit discussion #22033. Both functions accumulate characters with current += string(char) inside a byte-by-byte loop, causing O(n²) allocations. These functions are only called for long expressions (gated behind a length check), so the quadratic cost lands exactly where it hurts most.

Locations

• pkg/workflow/expression_parser.go:386 — inside BreakLongExpression
• pkg/workflow/expression_parser.go:421 — inside BreakAtParentheses

Approach

Replace the current string accumulator with strings.Builder in both functions:

Before:

current := ""
// ...
current += string(char)

After:

var current strings.Builder
// ...
current.WriteByte(char)
// collect result with: current.String()

Ensure strings is imported (it likely already is).

Acceptance Criteria

• Both BreakLongExpression and BreakAtParentheses use strings.Builder instead of +=
• Existing expression parser tests pass with identical output
• make fmt && make test-unit passes

Generated by Plan Command for issue #discussion #22033 · ◷

• expires on Mar 23, 2026, 4:03 AM UTC