Skip to content

Validate APM version string before YAML injection in compiler#21509

Merged
pelikhan merged 2 commits intomainfrom
copilot/validate-apm-version-string
Mar 18, 2026
Merged

Validate APM version string before YAML injection in compiler#21509
pelikhan merged 2 commits intomainfrom
copilot/validate-apm-version-string

Conversation

Copy link
Contributor

Copilot AI commented Mar 18, 2026

The version: field under dependencies: was injected verbatim into compiled YAML as a double-quoted string — a value like v0.8.0" would silently produce GH_AW_INFO_APM_VERSION: "v0.8.0"", invalid YAML. The existing isValidVersionTag() in semver.go was not applied to this field.

Changes

  • frontmatter_extraction_metadata.go: extractAPMDependenciesFromFrontmatter now returns (*APMDependenciesInfo, error). Invalid version strings are rejected with a descriptive error:
    dependencies.version "v0.8.0"" is not a valid semver tag (expected format: vX.Y.Z)
    
  • compiler_orchestrator_tools.go: Updated caller to propagate the new error up as a compiler error.
  • apm_dependencies_test.go: Updated all call sites for the new signature; added test cases for v0.8.0" (trailing quote), 1.2.3 (missing v prefix), latest (free-form string), and valid partial versions v1 / v1.2.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--show-toplevel git (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE 5W90UaepxRr7 env 7262925/b394/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE b/gh-aw/pkg/file-c GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name (create_pull_request|push_to_pull_request_branch)" --jq /usr/bin/git 640502/b421/_pkgnode GO111MODULE ache/node/24.14.--write git rev-�� ath ../../../.pr**/*.json /opt/hostedtoolc--ignore-path /usr/bin/git bility_SameInputsh -buildtags /usr/bin/git git (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha user.email test@example.com /usr/bin/git k/gh-aw/gh-aw/pkgit k/gh-aw/gh-aw/pkrev-parse 64/bin/go git rev-�� --git-dir /opt/hostedtoolcrev-parse /usr/bin/git /tmp/go-build278git -trimpath 64/bin/go git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha 640502/b421/_pkg_.a GO111MODULE ache/node/24.14.0/x64/bin/node GOINSECURE b/gh-aw/pkg/stylrev-parse GOMODCACHE /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet t-40�� bility_SameInputSameOutput64412996/001/stability-test.md -buildtags /usr/bin/git -errorsas -ifaceassert -nilfunc 640502/b421/importcfg (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git arch�� --remote=REDACTED v1.0.0 /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel util.test /usr/bin/git -json GO111MODULE ache/go/1.25.0/x--show-toplevel git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE ache/go/1.25.0/x--show-toplevel git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha user.name Test User (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha add origin /usr/bin/git -json GO111MODULE 64/bin/go git init�� v1.0.0 node /usr/bin/git prettier --check 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE ache/go/1.25.0/x--show-toplevel git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE ache/go/1.25.0/x--show-toplevel git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE erignore env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha go1.25.0 -c=4 -nolocalimports -importcfg /tmp/go-build606640502/b389/importcfg -pack /tmp/go-build606640502/b389/_testmain.go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha ck 'scripts/**/*GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --get remote.origin.url e/git-remote-https -json GO111MODULE 64/bin/go e/git-remote-https om/o�� om/owner/repo.git node /usr/bin/git ays.md --check 64/bin/go git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --get remote.origin.url /usr/bin/git -json GO111MODULE 64/bin/go git conf�� /github.com/owner/repo.git Test User /usr/bin/git --check **/*.cjs 64/bin/go git (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE UG/ZnOsOJd6tUtmJw5s9Irq/2xk0esg58_5OggvuPEAi env runs/20260318-021232-28374/test-1742224322/.github/workflows GO111MODULE 7f8e9e593280d8ddc9d1b052a48eec86869fae6096f22497-d l GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha 640502/b405/mathutil.test GO111MODULE 640502/b405/importcfg.link GOINSECURE GOMOD GOMODCACHE NVNgnGPLEQds7/eMdwFO3cBOLj36ZOwlHC/wPHmRHH07drGotDxh6_4/9rUbv3kNVNgnGPLEQds7 env runs/20260318-021232-28374/test-778038281/custom/workflows GO111MODULE 640502/b405/_pkg_.a l GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha 640502/b405/_pkg_.a GO111MODULE 640502/b405=> GOINSECURE GOMOD GOMODCACHE go env wlHC/eMdwFO3cBOLj36ZOwlHC GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 git x_amd64/compile 64/bin/go sh /opt/hostedtoolc--show-toplevel x_amd64/compile add . node tions/node_modules/.bin/sh /home/REDACTED/worgit go /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 git /usr/bin/du 0/x64"; export Pgit Test User /usr/bin/git du -k -dirty" -o gh-aw ./cmd/gh-aw git n-dir/node --show-toplevel go /usr/bin/gh git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 git /usr/bin/cut user.email test@example.comconfig /usr/bin/git cut -f1 64/bin/go git x86_64/node --show-toplevel go /usr/bin/gh git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env hub/workflows GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 git /usr/bin/git --show-toplevel sh /usr/bin/git git conf�� user.name Test User tions/setup/node_modules/.bin/sh --show-toplevel go /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 git /usr/bin/git user.email test@example.cominit /usr/bin/git git rev-�� HEAD git bin/sh --show-toplevel go /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 git x_amd64/asm user.name Test User /usr/bin/git x_amd64/asm comm�� -m Initial de_modules/.bin/sh --show-toplevel go /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 node x_amd64/cgo /home/REDACTED/worgit sh /usr/bin/git x_amd64/cgo main�� run --auto ules/.bin/sh --detach go /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path g/logger/exampleGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/xGO111MODULE env 7262925/b398/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE go env SZuW/BmCnwzN13mkGOSUMDB GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 7262925/b405/imp^remote\..*\.gh-resolved$ (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE us/UGKM_FbdUZ8dYmy4ud1P/CtkjN3marev-parse env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha h ../../../.prettierignore 64/pkg/tool/linu--jq /usr/bin/git flow.test (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha h ../../../.prettierignore 64/pkg/tool/linu--log-level /usr/bin/git --show-toplevel GOPROXY ache/node/24.14.actions/setup-cli/install.sh git rev-�� --show-toplevel /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/compile /usr/bin/git k/gh-aw/gh-aw/.ggit -trimpath cfg git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha h ../../../.prettierignore /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/compile /usr/bin/git /tmp/go-build606go -trimpath /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git NBStbLjY4xsiGwGsnode -goversion /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha h ../../../.prettierignore pts.test /usr/bin/git /tmp/gh-aw-add-ggit config /opt/hostedtoolc--tags git rev-�� --show-toplevel /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/link /usr/bin/git /tmp/go-build606git -importcfg /usr/bin/git git (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env 2171831075/.github/workflows GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion user.name Test User /usr/bin/git x_amd64/vet rev-�� --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/docker git (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go r code style"; tgo GOMOD GOMODCACHE ache/go/1.25.0/xGO111MODULE env 7262925/b407/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/xGO111MODULE env 7262925/b409/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo bin/node -aw/git/ref/tags/bin/sh GO111MODULE 0/x64/bin/node git ache�� ath ../../../.prettierignore nly /usr/bin/git ons-test24595521sh -buildtags ache/node/24.14."prettier" --write '../../../**/*.json' '!../../../pkg/workflow/js/**/*.json' ---errorsas git (http block)
  • https://api.github.com/repos/owner/repo/contents/file.md
    • Triggering command: /tmp/go-build606640502/b383/cli.test /tmp/go-build606640502/b383/cli.test -test.testlogfile=/tmp/go-build606640502/b383/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE go m/_n�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /tmp/go-build2206973352/b383/cli.test /tmp/go-build2206973352/b383/cli.test -test.testlogfile=/tmp/go-build2206973352/b383/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true -json GO111MODULE ache/node/24.14."prettier" --write '**/*.cjs' '**/*.ts' '**/*.json' --ignore-path ../../../.pret.prettierignore git rev-�� --show-toplevel git /usr/bin/git bility_SameInputnode GOPROXY /usr/bin/infocmpprettier git (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD ode-gyp-bin/node-json go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name --show-toplevel 640502/b413/repoutil.test /usr/bin/git t0 GO111MODULE ache/node/24.14.--write git rev-�� ath ../../../.pr**/*.json /opt/hostedtoolc--ignore-path er bility_SameInputsh -buildtags ache/node/24.14."prettier" --write '../../../**/*.json' '!../../../pkg/workflow/js/**/*.json' ---errorsas git (http block)

If you need me to access, download, or install something from one of these locations, you can either:


📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title [WIP] [plan] Validate APM version string before YAML injection Validate APM version string before YAML injection in compiler Mar 18, 2026
Copilot AI requested a review from pelikhan March 18, 2026 02:17
@pelikhan pelikhan marked this pull request as ready for review March 18, 2026 02:19
Copilot AI review requested due to automatic review settings March 18, 2026 02:19
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds validation and error propagation for APM dependency version tags extracted from workflow frontmatter, preventing malformed versions from being silently accepted.

Changes:

  • Updated extractAPMDependenciesFromFrontmatter to return (*APMDependenciesInfo, error) and validate dependencies.version using isValidVersionTag.
  • Propagated extraction errors through Compiler.processToolsAndMarkdown.
  • Expanded unit tests to cover invalid/valid version tag scenarios.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File Description
pkg/workflow/frontmatter_extraction_metadata.go Adds version-tag validation and changes extraction API to return an error.
pkg/workflow/compiler_orchestrator_tools.go Handles new error return from APM dependency extraction.
pkg/workflow/apm_dependencies_test.go Updates existing tests for new signature and adds version validation cases.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Comment on lines 348 to +357
// extractAPMDependenciesFromFrontmatter extracts APM (Agent Package Manager) dependency
// configuration from frontmatter. Supports two formats:
// - Array format: ["org/pkg1", "org/pkg2"]
// - Object format: {packages: ["org/pkg1", "org/pkg2"], isolated: true, github-app: {...}, version: "v0.8.0"}
//
// Returns nil if no dependencies field is present or if the field contains no packages.
func extractAPMDependenciesFromFrontmatter(frontmatter map[string]any) *APMDependenciesInfo {
func extractAPMDependenciesFromFrontmatter(frontmatter map[string]any) (*APMDependenciesInfo, error) {
value, exists := frontmatter["dependencies"]
if !exists {
return nil
return nil, nil
if versionAny, ok := v["version"]; ok {
if versionStr, ok := versionAny.(string); ok && versionStr != "" {
if !isValidVersionTag(versionStr) {
return nil, fmt.Errorf("dependencies.version %q is not a valid semver tag (expected format: vX.Y.Z)", versionStr)
Comment on lines 398 to 405
if versionAny, ok := v["version"]; ok {
if versionStr, ok := versionAny.(string); ok && versionStr != "" {
if !isValidVersionTag(versionStr) {
return nil, fmt.Errorf("dependencies.version %q is not a valid semver tag (expected format: vX.Y.Z)", versionStr)
}
version = versionStr
}
}
@pelikhan pelikhan merged commit 1fe569e into main Mar 18, 2026
115 checks passed
@pelikhan pelikhan deleted the copilot/validate-apm-version-string branch March 18, 2026 02:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[plan] Validate APM version string before YAML injection in compiler

3 participants