Prune non-schema entries from SharedWorkflowForbiddenFields

[Copilot]

SharedWorkflowForbiddenFields contained entries that cannot match real top-level frontmatter keys (command, roles, timeout_minutes), which made shared-workflow restrictions noisier and misleading relative to main_workflow_schema.json. This change tightens the list to schema-real fields only.

• Schema-aligned forbidden field list

  • Removed dead entries from /pkg/constants/constants.go:
    • command
    • roles
    • timeout_minutes
  • Kept timeout-minutes (the actual top-level schema key).

• Documentation/comment alignment

  • Updated the category comments above SharedWorkflowForbiddenFields to remove references to deleted keys.
  • Updated the constants README example to reflect the current list shape.

• Integration test fixture cleanup

  • Removed stale YAML fixture entries in /pkg/workflow/forbidden_fields_import_test.go for the deleted forbidden keys, keeping fixture coverage aligned with the canonical constant.

var SharedWorkflowForbiddenFields = []string{
    "on",
    "concurrency",
    "container",
    "environment",
    "features",
    "github-token",
    "if",
    "name",
    "run-name",
    "runs-on",
    "sandbox",
    "strict",
    "timeout-minutes",
    "tracker-id",
}

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the shared-workflow import restrictions by allowing a few previously forbidden top-level fields, and aligns docs/tests with the updated forbidden-field list.

Changes:

• Removed command, roles, and timeout_minutes from SharedWorkflowForbiddenFields.
• Updated the forbidden-fields import rejection test cases to stop expecting those fields to be rejected.
• Updated constants documentation to reflect the new forbidden-fields list.

Show a summary per file

File	Description
pkg/workflow/forbidden_fields_import_test.go	Removes rejection test cases for fields that are no longer forbidden.
pkg/constants/constants.go	Updates the canonical forbidden-fields list and its inline documentation.
pkg/constants/README.md	Updates the README example to match the revised forbidden-fields list.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

pkg/workflow/forbidden_fields_import_test.go:1

• The test claims it is using SharedWorkflowForbiddenFields, but the map keys don’t appear to match the constant list: the constant uses environment (not env). This means the test likely isn’t validating rejection for environment at all. Update the test case key/YAML to use environment, or (preferably) derive/validate the test cases against SharedWorkflowForbiddenFields so drift is caught automatically.

//go:build integration

• Files reviewed: 3/3 changed files
• Comments generated: 3