Add minItems constraints to array fields requiring values

[Copilot]

Several array fields in the workflow schema allowed empty arrays that fail at compile time (e.g., toolsets: [], names: [] for label triggers). The schema now enforces minItems: 1 where semantically required.

Changes

Schema constraints added (pkg/parser/schemas/main_workflow_schema.json):

• on.issues.names array - label filter for labeled/unlabeled events
• on.pull_request.names array - label filter for labeled/unlabeled events
• tools.github.toolsets array - at least one toolset required when specified

Exception: network.allowed has NO minItems constraint - empty arrays are valid for deny-all network access semantics.

Test coverage (pkg/parser/schema_test.go):

• Verify empty arrays rejected for constrained fields
• Verify valid configurations still compile

Example

# ❌ Before: compiles but fails at runtime
tools:
  github:
    toolsets: []

# ✅ After: caught at schema validation
# Error: minItems: got 0, want 1

# ✅ Valid: at least one toolset
tools:
  github:
    toolsets: [issues, repos]

Error messages clearly indicate the constraint: minItems: got 0, want 1

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/user
  • Triggering command: /usr/bin/gh gh api user --jq .login husky git 64/bin/go js/**/*.json 64/pkg/tool/linuenv ache/node/24.12.-json /opt/hostedtoolcGO111MODULE -V=f�� ck '**/*.cjs' '*GOINSECURE git ache/go/1.25.0/xGOMODCACHE /\1/p Test User ps ache/go/1.25.0/xGOPROXY (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login runs/20251225-071606-23682/test-3056621916/.github/workflows GOPROXY /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linu--jq -ato�� ithub/workflows -buildtags (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login ithub/workflows -importcfg /usr/bin/git -s -w -buildmode=exe git -C k/gh-aw/gh-aw/.github/workflows rev-parse /usr/bin/git edcfg git 64/bin/go git (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[plan] Add minItems constraints for array fields requiring values</issue_title>
<issue_description>## Objective

Add minItems: 1 constraints to array fields that require at least one value.

Context

Several array fields must have at least one item to be meaningful (e.g., on.issues.types with label triggers), but the schema doesn't enforce this. Users can specify empty arrays that fail at compile time.

Fields Requiring minItems

1. on.issues.types when using label triggers

   • Must have at least one label
   • Code: pkg/workflow/bundler_validation.go

2. tools.(tool).toolsets when specified

   • Empty toolsets array is meaningless
   • Should either be omitted or have values

3. network.allowed when specified

   • Empty allowed list contradicts intent
   • Should use network.enabled: false instead

4. permissions scopes arrays when specified

   • Empty permission arrays are meaningless

Approach

Add minItems to array definitions:

{
  "types": {
    "type": "array",
    "items": { "type": "string" },
    "minItems": 1,
    "$comment": "At least one issue type required for label triggers"
  }
}

For optional arrays that can be empty, document why in $comment.

Files to Modify

• pkg/parser/schemas/frontmatter.json - Add minItems constraints
• After changes, run make build to rebuild with embedded schema

Acceptance Criteria

• Schema rejects empty arrays for fields requiring values
• Error messages explain minimum item requirements
• Optional arrays that can be empty are documented in $comment
• Existing valid configurations still pass validation

Testing

Create test workflows with empty arrays and verify schema validation catches them.
Related to #7575

AI generated by Plan Command for discussion #7569

Comments on the Issue (you are @copilot in this section)

• Fixes [plan] Add minItems constraints for array fields requiring values #7579

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.