Problem
pkg/parser/include_processor.go:180-205 defines a validFields allowlist whose code comment claims:
// This list matches the allowed fields in shared workflows (main_workflow_schema minus forbidden fields)
This is incorrect. Two fields are accepted by the parser but absent from the schema:
| Field |
In include_processor.go validFields |
In main_workflow_schema.json |
applyTo |
✅ line 199 |
❌ |
inputs |
✅ line 200 |
❌ |
inputs is referenced by real compiler code (pkg/workflow/expression_extraction.go, trigger_parser.go, safe_scripts.go, dispatch_workflow_validation.go, label_trigger_parser.go), so it's a supported feature — but main workflows using it at the top level are rejected by the schema's additionalProperties: false.
Evidence
Schema Consistency audit #33486 — finding #2.
Suggested fix (choose one)
- Add
applyTo and inputs to pkg/parser/schemas/main_workflow_schema.json with appropriate types/descriptions.
- Define a dedicated shared-workflow schema and update the misleading comment in
include_processor.go.
Option 1 is the smallest blast radius and matches the existing comment's intent.
Estimated effort
Small (< 2h).
Filed by DeepReport Intelligence Briefing — 2026-05-20.
Generated by 🔬 DeepReport - Intelligence Gathering Agent · ● 11.6M · ◷
Problem
pkg/parser/include_processor.go:180-205defines avalidFieldsallowlist whose code comment claims:This is incorrect. Two fields are accepted by the parser but absent from the schema:
include_processor.govalidFieldsmain_workflow_schema.jsonapplyToinputsinputsis referenced by real compiler code (pkg/workflow/expression_extraction.go,trigger_parser.go,safe_scripts.go,dispatch_workflow_validation.go,label_trigger_parser.go), so it's a supported feature — but main workflows using it at the top level are rejected by the schema'sadditionalProperties: false.Evidence
Schema Consistency audit #33486 — finding #2.
Suggested fix (choose one)
applyToandinputstopkg/parser/schemas/main_workflow_schema.jsonwith appropriate types/descriptions.include_processor.go.Option 1 is the smallest blast radius and matches the existing comment's intent.
Estimated effort
Small (< 2h).
Filed by DeepReport Intelligence Briefing — 2026-05-20.