Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 14 additions & 10 deletions pkg/workflow/compiler.go
Original file line number Diff line number Diff line change
Expand Up @@ -79,19 +79,23 @@ func (c *Compiler) CompileWorkflow(markdownPath string) error {
// including expressions, features, permissions, and configurations.
func (c *Compiler) validateWorkflowData(workflowData *WorkflowData, markdownPath string) error {
// Validate expression safety - check that all GitHub Actions expressions are in the allowed list
log.Printf("Validating expression safety")
if err := validateExpressionSafety(workflowData.MarkdownContent); err != nil {
return formatCompilerError(markdownPath, "error", err.Error(), err)
if strings.Contains(workflowData.MarkdownContent, "${{") {
log.Printf("Validating expression safety")
if err := validateExpressionSafety(workflowData.MarkdownContent); err != nil {
return formatCompilerError(markdownPath, "error", err.Error(), err)
}
}

// Validate expressions in runtime-import files at compile time
log.Printf("Validating runtime-import files")
// Go up from .github/workflows/file.md to repo root
workflowDir := filepath.Dir(markdownPath) // .github/workflows
githubDir := filepath.Dir(workflowDir) // .github
workspaceDir := filepath.Dir(githubDir) // repo root
if err := validateRuntimeImportFiles(workflowData.MarkdownContent, workspaceDir); err != nil {
return formatCompilerError(markdownPath, "error", err.Error(), err)
if strings.Contains(workflowData.MarkdownContent, "{{#runtime-import") {
Comment on lines 81 to +90
Copy link

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These debug log messages say validation is happening even when the fast-path checks skip the underlying work (no ${{ / no {{#runtime-import in the markdown). Moving the log.Printf calls inside the corresponding strings.Contains(...) blocks would keep debug output accurate and avoid implying checks ran when they didn’t.

See below for a potential fix:

	if strings.Contains(workflowData.MarkdownContent, "${{") {
		log.Printf("Validating expression safety")
		if err := validateExpressionSafety(workflowData.MarkdownContent); err != nil {
			return formatCompilerError(markdownPath, "error", err.Error(), err)
		}
	}

	// Validate expressions in runtime-import files at compile time
	if strings.Contains(workflowData.MarkdownContent, "{{#runtime-import") {
		log.Printf("Validating runtime-import files")

Copilot uses AI. Check for mistakes.
log.Printf("Validating runtime-import files")
// Go up from .github/workflows/file.md to repo root
workflowDir := filepath.Dir(markdownPath) // .github/workflows
githubDir := filepath.Dir(workflowDir) // .github
workspaceDir := filepath.Dir(githubDir) // repo root
if err := validateRuntimeImportFiles(workflowData.MarkdownContent, workspaceDir); err != nil {
return formatCompilerError(markdownPath, "error", err.Error(), err)
}
}

// Validate feature flags
Expand Down
13 changes: 11 additions & 2 deletions pkg/workflow/compiler_performance_benchmark_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -295,13 +295,22 @@ Test validation performance.
compiler.SetStrictMode(true)
compiler.SetQuiet(true)

workflowData, err := compiler.ParseWorkflowFile(testFile)
if err != nil {
b.Fatal(err)
}

// Warm up: run once before timing to prime one-time caches (schema compilation, etc.)
_ = compiler.CompileWorkflow(testFile)
if err := compiler.validateWorkflowData(workflowData, testFile); err != nil {
b.Fatal(err)
}

b.ResetTimer()
b.ReportAllocs()
for b.Loop() {
_ = compiler.CompileWorkflow(testFile)
if err := compiler.validateWorkflowData(workflowData, testFile); err != nil {
b.Fatalf("validateWorkflowData failed: %v", err)
}
}
Comment on lines 303 to 314
Copy link

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The benchmark ignores the error returned by validateWorkflowData in both the warm-up and the timed loop. If validation ever fails (e.g., due to stricter defaults or environment-dependent checks), the benchmark will still report numbers but they won’t represent successful validation. Consider checking the error and calling b.Fatal/b.Fatalf to keep the benchmark meaningful.

See below for a potential fix:

	if err := compiler.validateWorkflowData(workflowData, testFile); err != nil {
		b.Fatal(err)
	}

	b.ResetTimer()
	b.ReportAllocs()
	for b.Loop() {
		if err := compiler.validateWorkflowData(workflowData, testFile); err != nil {
			b.Fatalf("validateWorkflowData failed: %v", err)
		}

Copilot uses AI. Check for mistakes.
}

Expand Down
Loading