Add compile-time validation for dangerous property names in expressions

[Copilot]

Add compile-time validation for dangerous property names in expressions

Extends the runtime protection from #14826 by blocking dangerous JavaScript property names at compile time. Prevents prototype pollution attacks via expressions like ${{ github.constructor }} or ${{ inputs.__proto__ }}.

Changes

• New constant: DangerousPropertyNames in pkg/constants/constants.go lists 13 blocked property names (constructor, proto, prototype, toString, valueOf, etc.)
• New validator: validateExpressionForDangerousProps() in pkg/workflow/expression_validation.go parses dot/bracket notation and checks property names against the blocklist
• Integration: Validation runs early in validateSingleExpression() before other checks
• Tests: 35 test cases covering all dangerous properties and safe expressions

Example

Compilation now fails with a clear error:

$ gh aw compile workflow.md
✗ error: Validation failed for field 'expressions'
Reason: expression 'github.constructor' contains the dangerous property name 'constructor'
Suggestion: Remove the dangerous property 'constructor' from the expression. 
Property names like constructor, __proto__, prototype, and similar JavaScript built-ins 
are blocked to prevent prototype pollution attacks.

Safe expressions continue to work:

${{ github.actor }}              ✓
${{ github.event.issue.number }} ✓
${{ needs.job.outputs.result }}  ✓

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Pull request overview

Adds compile-time validation to block dangerous JavaScript property names in GitHub Actions expressions (e.g., constructor, __proto__) to prevent prototype-pollution style access patterns, aligning compile-time checks with existing runtime protections.

Changes:

• Introduces a DangerousPropertyNames blocklist constant.
• Adds validateExpressionForDangerousProps() and runs it early during single-expression validation.
• Expands expression safety tests to cover blocked properties and end-to-end markdown validation.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
pkg/workflow/expression_validation.go	Adds dangerous-property detection and integrates it into expression validation flow.
pkg/constants/constants.go	Defines the dangerous property name blocklist used by the validator.
pkg/workflow/expression_safety_test.go	Adds unit + integration-style tests for dangerous property validation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[pelikhan]

@copilot revert c10cefe

[Copilot]

@copilot revert c10cefe

Reverted in 117e9e8. The commit was using undefined regex variables (dangerousPropSplitRe, numericIndexRe) that were never added to the var block.