Skip to content

perf: hoist regexp.MustCompile calls to package-level vars in validateExpressionForDangerousProps #20079

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 2 commits into from
Mar 8, 2026
Merged

perf: hoist regexp.MustCompile calls to package-level vars in validateExpressionForDangerousProps #20079

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
db18c4d
Initial plan
Copilot Mar 8, 2026
f322ac8
fix: hoist regexp.MustCompile calls to package-level vars in validate…
Copilot Mar 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions pkg/workflow/expression_validation.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,10 @@ var (
stringLiteralRegex = regexp.MustCompile(`^'[^']*'$|^"[^"]*"$|^` + "`[^`]*`$")
// numberLiteralRegex matches integer and decimal number literals (with optional leading minus)
numberLiteralRegex = regexp.MustCompile(`^-?\d+(\.\d+)?$`)
// exprPartSplitRe splits expression strings on dot and bracket characters
exprPartSplitRe = regexp.MustCompile(`[.\[\]]+`)
// exprNumericPartRe matches purely numeric expression parts (array indices)
exprNumericPartRe = regexp.MustCompile(`^\d+$`)
Comment on lines +80 to +83
Copy link

Copilot AI Mar 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The package-level precompiled regexp vars in this file consistently use the ...Regex suffix (e.g., expressionRegex, needsStepsRegex, numberLiteralRegex). These new names use ...Re, which is inconsistent and makes it harder to scan for regexp vars. Consider renaming to exprPartSplitRegex / exprNumericPartRegex (or another ...Regex-suffixed convention used here).

Copilot uses AI. Check for mistakes.
)

// validateExpressionSafety checks that all GitHub Actions expressions in the markdown content
Expand Down Expand Up @@ -209,11 +213,11 @@ func validateExpressionForDangerousProps(expression string) error {
// Split expression into parts handling both dot notation (e.g., "github.event.issue")
// and bracket notation (e.g., "release.assets[0].id")
// Filter out numeric indices (e.g., "0" in "assets[0]")
parts := regexp.MustCompile(`[.\[\]]+`).Split(trimmed, -1)
parts := exprPartSplitRe.Split(trimmed, -1)

for _, part := range parts {
// Skip empty parts and numeric indices
if part == "" || regexp.MustCompile(`^\d+$`).MatchString(part) {
if part == "" || exprNumericPartRe.MatchString(part) {
continue
}

Expand Down
Loading