Add expression parser for && || and parentheses with tree visitor validation

[Copilot]

Problem

The existing expression validation in validateExpressionSafety only handled simple literal expressions within GitHub Actions ${{ }} blocks. It couldn't parse or validate complex expressions using logical operators like &&, ||, !, and parentheses for grouping. This meant that complex expressions like:

${{ (github.event_name == 'issues') && (github.event.action == 'opened') || !github.event.pull_request.draft }}

Would be treated as a single literal and either fully allowed or rejected, rather than validating each individual component expression.

Solution

This PR adds a comprehensive expression parser that extends the existing expressions.go infrastructure:

New Components

1. ExpressionParser: A recursive descent parser that tokenizes and parses complex expressions with proper operator precedence
2. ParseExpression(): Main entry point that converts string expressions into the existing ConditionNode AST
3. VisitExpressionTree(): Tree visitor that traverses expression ASTs and calls a visitor function for each literal expression
4. Enhanced validation: Updated validateExpressionSafety to use the parser for complex expressions

Supported Syntax

• Literals: github.event_name == 'issues'
• AND operations: condition1 && condition2 (higher precedence)
• OR operations: condition1 || condition2 (lower precedence)
• NOT operations: !condition1
• Parentheses: (condition1 && condition2) || condition3
• Complex nested expressions with proper precedence handling

Implementation Details

The parser follows these design principles:

• Minimal changes: Builds upon existing ConditionNode infrastructure rather than replacing it
• Backward compatibility: Falls back to original validation for unparseable expressions
• Proper precedence: AND (&&) has higher precedence than OR (||)
• Error handling: Comprehensive error reporting for malformed expressions
• Security focused: Each literal expression in complex expressions is individually validated

Example Usage

// Parse a complex expression
tree, err := ParseExpression("(github.workflow && github.repository) || github.run_id")
if err != nil {
    return err
}

// Visit each literal expression for validation
err = VisitExpressionTree(tree, func(expr *ExpressionNode) error {
    return validateSingleExpression(expr.Expression, ...)
})

Validation Enhancement

The expression safety validation now:

1. Attempts to parse complex expressions using the new parser
2. Visits each literal expression in the parsed tree to validate it against the allowlist
3. Falls back to the original validation for unparseable expressions
4. Maintains all existing security guarantees

Testing

Added comprehensive test coverage including:

• Parser functionality with edge cases and error handling
• Tree visitor functionality with error propagation
• Integration tests combining parsing and validation
• Expression safety validation with complex expressions
• All existing tests continue to pass

The implementation successfully handles complex expressions while maintaining the security properties of the original validation system.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• api.contoso.com
  • Triggering command: /tmp/go-build1091059789/b278/cli.test -test.testlogfile=/tmp/go-build1091059789/b278/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
  • Triggering command: /tmp/go-build1482235784/b278/cli.test -test.testlogfile=/tmp/go-build1482235784/b278/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.