[Code Quality] Replace FrontmatterConfig.RunsOn/Imports/Include any fields with typed sum types

[github-actions]

Description

typist analysis (discussion #49984) found several FrontmatterConfig/SafeJobConfig fields typed as any despite comments documenting a small, fixed set of accepted shapes — the same ambiguity the codebase already solves elsewhere via RunsOnValue/TemplatableBool sum types with custom UnmarshalJSON.

Suggested Changes

• FrontmatterConfig.RunsOn any / RunsOnSlim any (pkg/workflow/frontmatter_types.go:356-357) — comment says "Supports string, array, or object"; sibling SafeOutputsConfig.RunsOn already solves this via UnmarshalJSON + renderRunsOnSnippet. Give FrontmatterConfig the same treatment.
• SafeJobConfig.RunsOn any, RawPermissions any (pkg/workflow/safe_jobs.go:21,27) — immediately type-switched into exactly two shapes right after parsing (safe_jobs.go:236-238); reuse the RunsOnSpec/RunsOnValue sum type instead of the inline type switch.
• FrontmatterConfig.Imports any, Include any (pkg/workflow/frontmatter_types.go:369,371) — comments say "Can be string or array"; add a StringOrStringSlice []string type with a 2-branch UnmarshalJSON.

Files Affected

• pkg/workflow/frontmatter_types.go
• pkg/workflow/safe_jobs.go
• pkg/workflow/runs_on_snippet.go

Success Criteria

• The listed fields have concrete sum types with UnmarshalJSON/UnmarshalYAML instead of any
• Redundant inline type assertions/switches at call sites are removed
• Frontmatter parsing tests pass

Source

Extracted from Typist - Go Type Consistency Analysis discussion #49984

Priority

High - removes manual type assertions at every call site and closes off silent-shape-mismatch bugs. Estimated effort: 4-6 hours.

🔍 Task mining by Discussion Task Miner - Code Quality Improvement Agent · auto · 88.4 AIC · ⌖ 4.01 AIC · ⊞ 10.3K · ◷

• expires on Aug 4, 2026, 5:45 AM UTC-08:00

[github-actions]

This issue was automatically closed because it expired on 2026-08-04T13:45:47.853Z.

Closed by Workflow