Skip to content

refactor: decompose 387-line validateWorkflowData into 4 focused validators#28145

Merged
pelikhan merged 6 commits intomainfrom
copilot/deep-report-refactor-validate-workflow-data
Apr 23, 2026
Merged

refactor: decompose 387-line validateWorkflowData into 4 focused validators#28145
pelikhan merged 6 commits intomainfrom
copilot/deep-report-refactor-validate-workflow-data

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Apr 23, 2026

validateWorkflowData in compiler.go was a 387-line monolith handling 10+ distinct concerns, making it untestable in isolation and a drag on the compiler quality score.

Changes

New compiler_validators.go — four focused Compiler methods:

  • validateExpressions — expression safety + runtime-import file checks
  • validateFeatureConfig — feature flags + action-mode override
  • validatePermissions — dangerous perms, GitHub App constraints, MCP toolset validation, workflow_run branch security, id-token warning; returns *Permissions for downstream reuse
  • validateToolConfiguration — sandbox, safe-outputs, on.needs/safe-job, network, labels, concurrency, GitHub tool-to-toolset alignment, agentic-workflows permission requirement, dispatch/call-workflow configs

compiler.go:

  • validateWorkflowData reduced to a 25-line orchestrator:
func (c *Compiler) validateWorkflowData(workflowData *WorkflowData, markdownPath string) error {
    if err := c.validateExpressions(workflowData, markdownPath); err != nil {
        return err
    }
    if err := c.validateFeatureConfig(workflowData, markdownPath); err != nil {
        return err
    }
    workflowPermissions, err := c.validatePermissions(workflowData, markdownPath)
    if err != nil {
        return err
    }
    return c.validateToolConfiguration(workflowData, markdownPath, workflowPermissions)
}
  • Bare return err calls in CompileWorkflowData replaced with isFormattedCompilerError / fmt.Errorf defensive wrapping
  • Removed now-unused slices import

New compiler_validators_test.go — independent tests for each validator covering valid inputs, error paths, and edge cases.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh gh repo view --json owner,name --jq .owner.login + "/" + .name 64/pkg/tool/linu-importcfg GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linutest@example.com env _.a GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE tants GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh repo view owner/repo env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.8/x64/pkg/tool/linu-test.short=true GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x^remote\..*\.gh-resolved$ (http block)
    • Triggering command: /usr/bin/gh gh repo view owner/repo env 1278988085 GO111MODULE 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/link env er.test GO111MODULE rtcfg.link GOINSECURE GOMOD GOMODCACHE 9Ym34G_sfJyM6o-I12346 (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name /tmp/go-build344GOINSECURE -trimpath 64/bin/go -p main -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json cpgodebug/mcpgodebug.go 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env ath ../../../.pr**/*.json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --get-regexp ^remote\..*\.gh-resolved$ /usr/bin/git y_only_defaults_git GO111MODULE 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linuTest User /usr/bin/git -json GO111MODULE ache/go/1.25.8/xinstall git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --show-toplevel 64/pkg/tool/linux_amd64/asm /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--show-toplevel git rev-�� mpleWorkflow340065075/001 64/pkg/tool/linuTest User /usr/bin/git 45523104/001 GO111MODULE 64/pkg/tool/linuinstall git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --show-toplevel JO/1cfAwdsspnaqnfeature-branch 2120763/b404/cli.test 345 GO111MODULE ff71b7b81b903ad1--show-toplevel 2120763/b404/cli.test ditD�� ansitiveImports2564686622/001 go /usr/bin/infocmp mpiledOutput6140node GO111MODULE 64/pkg/tool/linuinstall infocmp (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv -test.paniconexit0 -test.v=true /usr/bin/docker -test.timeout=10git -test.run=^Test -test.short=true--show-toplevel docker pull�� test/concurrent-image:v1.0.0 (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv /tmp/compile-instructions-test-4diagnostic noise should not be returned rev-parse om/other/repo.git -json GO111MODULE 64/bin/go git init�� GOMODCACHE go /usr/bin/git -json GO111MODULE x_amd64/asm git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv --show-toplevel go om/myorg/repo.git ath ../../../.prgit GO111MODULE 64/bin/go git init�� GOMODCACHE go /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git _.a GO111MODULE x_amd64/vet git rev-�� --show-toplevel x_amd64/vet /usr/bin/git pqO-TLyY7 tmain.go ache/go/1.25.8/x--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel git-upload-pack /usr/bin/git -stringintconv l ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/link /usr/bin/git 882512/b466/typegit go 882512/b466/impo--show-toplevel git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv 882512/b472/_pkg_.a remote 882512/b472=> late-expressionsgit GO111MODULE 64/bin/go git rev-�� poJ_/sX9FX53sm1OTZ6jdpoJ_ go om/org2/repo.git -json GO111MODULE 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv run l /usr/bin/git --detach -c=4 -nolocalimports git -C /tmp/gh-aw-test-runs/20260423-190227-52004/test-2882175112/.github/workflows config /usr/bin/git remote.origin.urgit son/json.go 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv --objects --stdin /usr/bin/git --exclude-hidden/usr/bin/git --all --quiet git rev-�� --show-toplevel go /opt/hostedtoolcache/node/24.14.1/x64/bin/node yphen3256798736/git yphen3256798736/rev-parse 64/bin/go node (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel rtcfg /usr/bin/git 2775213911 g/fileutil/tar.gcommit ache/go/1.25.8/x-m git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linutest@example.com /usr/bin/git /v2.0.0 GO111MODULE sv git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --get-regexp ^remote\..*\.gh-resolved$ /usr/bin/git 0227-52004/test-git rg/x/text@v0.36.commit ache/go/1.25.8/x-m git rev-�� 0227-52004/test-2611371214 ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git 0227-52004/test-git 6680010/b013/imprev-parse 6680010/b245=> git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv xterm-color go /usr/bin/git 0658-77335/test-git GO111MODULE /opt/hostedtoolc-m git rev-�� --show-toplevel go /usr/bin/git 0658-77335/test-git GO111MODULE /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v9
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE 3391582/b413/impGO111MODULE -c k/gh-aw/gh-aw/pkGOINSECURE k/gh-aw/gh-aw/pkGOMOD 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcGOPROXY (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv YcfH/qyilujPnDkCGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 3391582/b415/impGO111MODULE -c 3391582/b415/embGOINSECURE GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcGOPROXY (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv 19Id/7_6OzP_XFJvGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 3391582/b430/impGO111MODULE /hom�� k/gh-aw/gh-aw/pkGOINSECURE k/gh-aw/gh-aw/pkGOMOD 64/bin/go **/*.json --ignore-path ../../../.pretti--noprofile /opt/hostedtoolcGOPROXY (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE 3391582/b411/impGO111MODULE -c che/go-build/7d/GOINSECURE GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcGO111MODULE (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv GOMODCACHE go /usr/bin/gh -json GO111MODULE ache/go/1.25.8/x--show-toplevel gh run list --json /usr/bin/git --workflow nonexistent-workrev-parse --limit git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --git-dir x_amd64/compile /usr/bin/git bytealg/indexbytgit GO111MODULE 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linushow /usr/bin/git LsRemoteWithRealgit LsRemoteWithRealrev-parse 64/pkg/tool/linu--show-toplevel git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE 3391582/b409/impGO111MODULE -c che/go-build/c9/GOINSECURE GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcGO111MODULE (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv se 882512/b113/vet.cfg /usr/bin/git hyphen2955162285git hyphen2955162285rev-parse 64/bin/go git -C /tmp/gh-aw-test-runs/20260423-190006-34412/test--test.timeout=10m0s remote /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git -json GO111MODULE 86_64/bash /usr/bin/git conf�� --get-regexp ^remote\..*\.gh-resolved$ /usr/bin/git -json GO111MODULE ache/go/1.25.8/x--show-toplevel git (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv r-test318224380/existing.md remote.origin.url 882512/b443/vet.cfg tent.md -trimpath 64/bin/go git -C runs/20260423-190006-34412/test-2775213911 show /tmp/go-build222882512/b441/sliceutil.test s/test.md GO111MODULE 64/bin/go /tmp/go-build222882512/b441/sliceutil.test (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv -bool -buildtags /usr/bin/gh -errorsas -ifaceassert -nilfunc gh work�� list --json /usr/bin/git 81004433/001' 81004433/001' 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv -bool -buildtags /usr/bin/gh -errorsas -ifaceassert -nilfunc gh work�� ons-test3661890227 --json /usr/bin/git --repo owner/repo 64/bin/go git (http block)
  • https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv ea645077d4f41410df35177d ings.cjs git --verify --quiet t forks.js push�� -u st/suppress-warnings.cjs ache/node/24.14.1/x64/bin/node user.name t bin/git st/dist/workers//home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/vitest/suppress-warnings.cjs (http block)
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv dd3017e5..HEAD Second commit in full mode test $name) { hasDiscussionsEnabled } } user.email e commit es/.bin/git git show�� --verify dd3017e5..HEAD ode_modules/.bin/git /tmp/bare-incremgit gin/token-option-C k/node_modules/./home/REDACTED/work/gh-aw/gh-aw/.github/workflows git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv dd3017e5..HEAD Second commit in-w p/bin/git user.email e commit odules/npm/node_--require git show�� --verify dd3017e5..HEAD n-dir/node /tmp/bare-increm/usr/bin/gh gin/token-optionapi ode_modules/.bingraphql git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /opt/hostedtoolcache/node/24.14.1/x64/bin/node -json GO111MODULE 64/bin/go /opt/hostedtoolcache/node/24.14.1/x64/bin/node /tmp�� GOMODCACHE XFDo5AA/4Ab4WdaLconfig /usr/bin/git -json GO111MODULE x_amd64/link git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv --show-toplevel x_amd64/compile /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git g_.a GO111MODULE 64/pkg/tool/linu--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv user.name Test User /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git LsRemoteWithRealgit LsRemoteWithRealrev-parse ache/go/1.25.8/x--show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv 882512/b462/_pkg_.a rev-parse 882512/b462=> go1.25.8 -c=4 -nolocalimports git -C byx2/jNQYSQDdMsvnnTZDbyx2 rev-parse /usr/bin/git 01 GO111MODULE 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv uts.version show /usr/bin/git -goversion go1.25.8 -c=4 git -C /tmp/gh-aw-test-runs/20260423-190227-52004/test-2434612425/.github/workflows config /usr/bin/infocmp remote.origin.urgit GO111MODULE 64/bin/go infocmp (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv xterm-color go ache/node/24.14.1/x64/bin/node -json GO111MODULE 64/bin/go ache/node/24.14.1/x64/bin/node -550�� /tmp/TestHashConsistency_WithImports2105666691/001/main.md go /usr/bin/git -json GO111MODULE (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv ons-test2201572072 config ow-with-reaction.lock.yml remote.origin.urgit -trimpath 64/bin/go git 8825�� --show-toplevel s/test.md /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv y ZbUGNwZMKnO7zDW0_L0m/ZbUGNwZMKnO7zDW0_L0m /usr/bin/git -goversion go1.25.8 -c=4 git rev-�� ons-test545969088 -pack /usr/bin/git l GO111MODULE 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv /tmp/gh-aw-add-gitattributes-test995297184/.github/workflows remote /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE k GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env -json GO111MODULE k GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE n-dir/bash GOINSECURE GOMOD GOMODCACHE go env 1278988085 GO111MODULE 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name 64/src/net/addrselect.go 9488775c211a927bff71b7b81b903ad178c588279d9ab8aac497110cc247fbdd-d GOINSECURE g/x/crypto/interrev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile pret�� 2984803863 vMoO/r1c5PlYHcFDLvhFNvMoO ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet **/*.json ntio/encoding/jsrev-parse ../../../.pretti--show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 86_64/bash GOINSECURE GOMOD GOMODCACHE go env 1278988085 GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name om/segmentio/encoding@v0.5.4/json/codec.go .cfg GOINSECURE 6680010/b011/ GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /opt�� CommaSeparatedCompiledOutput1509924281/001 --check ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet **/*.ts boring/bbig 6680010/b011/sym--show-toplevel ache/go/1.25.8/x64/pkg/tool/linuTest User (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env 1996478702/.github/workflows GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE fips140 GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -c st-2358892481/.github/workflows i2Jk/kxQktkbJrdZm0O72i2Jk 1/x64/bin/node GOSUMDB GOWORK 64/bin/go 1/x64/bin/node (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name GO111MODULE ndor/bin/bash GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE Vgol9MA/jtMHmSR1PwQ4sKWnT8ry env _.a GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE fips140/sha256 GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuTest User -c st-2358892481 t2Bi/LbyKJAzlPTfrrG8ct2Bi flow.lock.yml GOSUMDB fips140/ecdsa 64/bin/go /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/cgo (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE 64/pkg/tool/linu-nolocalimports GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linutest@example.com env plorer.md GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name GO111MODULE 1/x64/bin/node GOINSECURE fips140/sha3 GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linutest@example.com t-ha�� ithub/workflows/agent-performance-analyzer.md Ldjv/q8rDzC5dO2KyVIFwLdjv 6680010/b206=> GOSUMDB hpke 64/bin/go gcc (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env 1996478702/.github/workflows GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE fips140/sha512 GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -c /ref/tags/v9 ZDcH/WlCyhVRj9mWQyquJZDcH 1/x64/bin/node GOSUMDB g/x/text/unicoderev-parse 64/bin/go 1/x64/bin/node (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path 640552434/001' 640552434/001' -importcfg /tmp/go-build222882512/b419/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/fileutil.go /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/tar.go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE go env f/tags/v4 GO111MODULE sv GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/contents/.github/workflows/shared/reporting.md
    • Triggering command: /tmp/go-build222882512/b404/cli.test /tmp/go-build222882512/b404/cli.test -test.testlogfile=/tmp/go-build222882512/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcGO111MODULE -o /tmp/go-build344GOINSECURE -trimpath 64/bin/go -d main -lang=go1.25 go (http block)
    • Triggering command: /tmp/go-build1589841012/b404/cli.test /tmp/go-build1589841012/b404/cli.test -test.testlogfile=/tmp/go-build1589841012/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true -nolocalimports -importcfg /tmp/go-build1966680010/b197/importcfg -pack env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /tmp/go-build3402120763/b404/cli.test /tmp/go-build3402120763/b404/cli.test -test.testlogfile=/tmp/go-build3402120763/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel x_amd64/link /usr/bin/git 0006-34412/test-git GO111MODULE /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel Bh/hKJC44cVKMHVnpBvTgXO/G1KutSxXHjoE8hqd2SJr /usr/bin/git 2775213911 GO111MODULE /opt/hostedtoolc/tmp/gh-aw/aw-feature-branch.patch git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm /usr/bin/git ortcfg Ak5qHtlUh ache/go/1.25.8/x--show-toplevel /usr/bin/git remo�� -v ache/go/1.25.8/x64/pkg/tool/linuremote.origin.url /usr/bin/git 0227-52004/test-ls GO111MODULE ache/go/1.25.8/x/tmp/gh-aw/aw-feature-branch.patch git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git DefaultBranchFrogit DefaultBranchFrorev-parse k/gh-aw/node_mod--show-toplevel git rev-�� --show-toplevel go /usr/bin/git 0658-77335/test-ls GO111MODULE /opt/hostedtoolc/tmp/gh-aw/aw-feature-branch.patch git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE cfg GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json .go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env itmain_branch2160494874/001 itmain_branch2160494874/002/work ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env 0552434/001 0552434/002/work 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env 800603121/001 800603121/002/work x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm 8006�� -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv th .prettierigno-goversion GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env tmatter-with-nested-objects.md GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env 025407823/001 025407823/002/work 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE ck GOINSECURE GOMOD GOMODCACHE go sRem�� -json GO111MODULE cfg GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv e-analyzer.md GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD s/js_js.s go env -json GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env 03/001/test-frontmatter-with-nested-objects.md GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/link env onpins.test GO111MODULE Name,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle GOINSECURE GOMOD GOMODCACHE 6HJsMZuhfvnzzKIvR2/iZ7E8eOLfTlPT-test.v=true (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -V=f�� 6680010/b082/importcfg ELPw/QEPjXdEopvS0kiaYELPw /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -json GO111MODULE 64/bin/go /opt/hostedtoolcrepos/{owner}/{repo}/actions/runs/2/artifacts (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet env -json GO111MODULE /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go -p main -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh workflow list --repo owner/repo --json name,path,state x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE bash GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name go1.25.8 (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name with-tools.md GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env ath ../../../.pr**/*.json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/test/repo
    • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch _.a GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env _.a GO111MODULE x_amd64/vet GOINSECURE er GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/agentic-optimization-kit.md go /usr/bin/git json' --ignore-pgit GO111MODULE 64/bin/go git remo�� GOMODCACHE go /usr/bin/git -json GO111MODULE x_amd64/compile git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch --show-toplevel go /usr/bin/git 01 GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
  • invalid.example.invalid
    • Triggering command: /usr/lib/git-core/git-remote-https /usr/lib/git-core/git-remote-https origin https://invalid.example.invalid/nonexistent-repo.git git conf�� --local --get ode_modules/.bin/git cal/bin/git git /git git add . git tions/setup/node_modules/.bin/git -M main bin/git git (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Copilot AI and others added 2 commits April 23, 2026 19:07
- Create compiler_validators.go with validateExpressions,
  validateFeatureConfig, validatePermissions, and
  validateToolConfiguration (each ~100 lines, independently testable)
- Reduce validateWorkflowData from 387 lines to a 25-line orchestrator
- Add fmt.Errorf/isFormattedCompilerError defensive wrapping for the
  bare return err calls at CompileWorkflowData lines 775 and 789
- Add compiler_validators_test.go with tests for each new validator
- Remove now-unused 'slices' import from compiler.go

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/7c5f96e4-396a-4b5a-b1df-52d8c72b86d7

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Address code review feedback: rename the parameter and local variable
from 'cachedPermissions' to 'workflowPermissions' in validateToolConfiguration,
validateWorkflowData, and the test file to better reflect it is a
freshly parsed permissions object rather than a performance cache.

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/7c5f96e4-396a-4b5a-b1df-52d8c72b86d7

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title [WIP] Refactor validateWorkflowData into focused validators refactor: decompose 387-line validateWorkflowData into 4 focused validators Apr 23, 2026
Copilot AI requested a review from pelikhan April 23, 2026 19:12
@pelikhan pelikhan marked this pull request as ready for review April 23, 2026 20:45
Copilot AI review requested due to automatic review settings April 23, 2026 20:45
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Refactors validateWorkflowData from a large monolithic function into four focused, independently testable validator methods, and adds targeted unit tests for the new validator boundaries.

Changes:

  • Split validation into validateExpressions, validateFeatureConfig, validatePermissions, and validateToolConfiguration.
  • Updated validateWorkflowData to be a small orchestrator that composes the new validators.
  • Added compiler_validators_test.go to cover core success/error paths for each validator.
Show a summary per file
File Description
pkg/workflow/compiler_validators.go Introduces the four new validator methods and moves validation logic out of compiler.go.
pkg/workflow/compiler.go Replaces the monolithic validation block with an orchestrator and adds defensive error wrapping in CompileWorkflowData.
pkg/workflow/compiler_validators_test.go Adds unit tests for the new validator entry points.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 3/3 changed files
  • Comments generated: 3

Comment thread pkg/workflow/compiler_validators.go Outdated

// Emit warning for sandbox.agent: false (disables agent sandbox firewall)
if isAgentSandboxDisabled(workflowData) {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage("⚠️ WARNING: Agent sandbox disabled (sandbox.agent: false). This removes firewall protection. The AI agent will have direct network access without firewall filtering. The MCP gateway remains enabled. Only use this for testing or in controlled environments where you trust the AI agent completely."))
Copy link

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

console.FormatWarningMessage already prepends a ⚠ icon (see pkg/console/console.go:156-159). Passing a message that itself starts with "⚠️ WARNING:" results in duplicated icons/prefixes and also drops the file context. Suggestion: remove the embedded emoji/"WARNING:" prefix and emit this via formatCompilerMessage(markdownPath, "warning", ...) so users get consistent compiler-style warnings with a file path.

Suggested change
fmt.Fprintln(os.Stderr, console.FormatWarningMessage("⚠️ WARNING: Agent sandbox disabled (sandbox.agent: false). This removes firewall protection. The AI agent will have direct network access without firewall filtering. The MCP gateway remains enabled. Only use this for testing or in controlled environments where you trust the AI agent completely."))
fmt.Fprintln(os.Stderr, formatCompilerMessage(markdownPath, "warning",
"Agent sandbox disabled (sandbox.agent: false). This removes firewall protection. "+
"The AI agent will have direct network access without firewall filtering. "+
"The MCP gateway remains enabled. Only use this for testing or in controlled "+
"environments where you trust the AI agent completely."))

Copilot uses AI. Check for mistakes.
Comment thread pkg/workflow/compiler.go Outdated
if isFormattedCompilerError(err) {
return err
}
return fmt.Errorf("workflow validation: %w", err)
Copy link

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In this defensive fallback, returning fmt.Errorf("workflow validation: %w", err) produces an unformatted error that likely won’t include file context / compiler-style rendering, unlike the earlier ParseWorkflowFile fallback in this same file which uses formatCompilerError. Suggestion: wrap unformatted errors with formatCompilerError(markdownPath, "error", "workflow validation: "+err.Error(), err) to preserve the standard diagnostics format while still retaining the error chain.

Suggested change
return fmt.Errorf("workflow validation: %w", err)
return formatCompilerError(markdownPath, "error", "workflow validation: "+err.Error(), err)

Copilot uses AI. Check for mistakes.
Comment thread pkg/workflow/compiler.go Outdated
if isFormattedCompilerError(err) {
return err
}
return fmt.Errorf("YAML generation: %w", err)
Copy link

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as above: the fallback return fmt.Errorf("YAML generation: %w", err) yields an unformatted error without the usual compiler diagnostics context. Suggestion: for non-formatted errors, wrap with formatCompilerError(markdownPath, "error", "YAML generation: "+err.Error(), err) so the user still gets file-scoped, console-formatted output.

Suggested change
return fmt.Errorf("YAML generation: %w", err)
return formatCompilerError(markdownPath, "error", "YAML generation: "+err.Error(), err)

Copilot uses AI. Check for mistakes.
@pelikhan
Copy link
Copy Markdown
Collaborator

@copilot review all comments

…r formatting

- Replace console.FormatWarningMessage("⚠️  WARNING: ...") with
  formatCompilerMessage(markdownPath, "warning", ...) for the sandbox
  disabled warning to avoid duplicate icon/prefix and add file context
- Replace fmt.Errorf fallback in CompileWorkflowData with
  formatCompilerError calls so unformatted errors still get proper
  compiler diagnostics context with file path

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/c3ba6830-0d95-4be1-878f-3ea9dc53b5c2

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copy link
Copy Markdown
Contributor Author

Copilot AI commented Apr 23, 2026

@copilot review all comments

Addressed all three review comments in d0cd18c:

  1. Duplicate icon on sandbox warning — replaced console.FormatWarningMessage("⚠️ WARNING: ...") with formatCompilerMessage(markdownPath, "warning", ...) so the warning gets file context and a single icon.
  2. fmt.Errorf fallback in validateWorkflowData error path — replaced with formatCompilerError(markdownPath, "error", "workflow validation: "+err.Error(), err).
  3. fmt.Errorf fallback in generateAndValidateYAML error path — replaced with formatCompilerError(markdownPath, "error", "YAML generation: "+err.Error(), err).

@github-actions
Copy link
Copy Markdown
Contributor

Hey @Copilot 👋 — great work decomposing the validateWorkflowData monolith! The refactor is clean and well-scoped: the new compiler_validators.go cleanly separates four distinct concerns, the orchestrating function is now a readable delegation layer, and compiler_validators_test.go provides solid test coverage for the extracted validators. This PR looks ready for maintainer review. 🚀

Generated by Contribution Check · ● 1.8M ·

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 23, 2026

Smoke CI completed successfully!

@github-actions

This comment has been minimized.

@github-actions

This comment has been minimized.

@pelikhan pelikhan merged commit a52249d into main Apr 23, 2026
18 checks passed
@pelikhan pelikhan deleted the copilot/deep-report-refactor-validate-workflow-data branch April 23, 2026 21:43
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 23, 2026

Smoke CI completed successfully!

@github-actions
Copy link
Copy Markdown
Contributor

✅ smoke-ci: safeoutputs CLI comment + comment-memory run (24860393069)

Generated by Smoke CI for issue #28145 ·

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[deep-report] Refactor validateWorkflowData (387 lines) into focused validators

3 participants