Function main

actions/setup/js/dispatch_workflow.cjs:24–321

* Main handler factory for dispatch_workflow * Returns a message handler function that processes individual dispatch_workflow messages * @type {HandlerFactoryFunction}

(config = {})

 * @type {HandlerFactoryFunction}
 */
async function main(config = {}) {
  // Extract configuration
  const allowedWorkflows = config.workflows || [];
  const maxCount = config.max || 1;
  const workflowFiles = config.workflow_files || {}; // Map of workflow name to file extension
  const awContextWorkflows = new Set(config.aw_context_workflows || []); // Workflows that accept aw_context input
  const githubClient = await createAuthenticatedGitHubClient(config);
  const { defaultTargetRepo, allowedRepos } = resolveTargetRepoConfig(config);

  // Resolve the dispatch destination repository from target-repo config, falling back to context.repo
  const contextRepoSlug = `${context.repo.owner}/${context.repo.repo}`;
  const normalizedTargetRepo = (defaultTargetRepo ?? "").toString().trim();

  let resolvedRepoSlug = contextRepoSlug;
  let repo = context.repo;

  if (normalizedTargetRepo) {
    const parsedRepo = parseRepoSlug(normalizedTargetRepo);
    if (!parsedRepo) {
      core.warning(`Invalid 'target-repo' configuration value '${normalizedTargetRepo}'; falling back to workflow context repository ${contextRepoSlug}.`);
    } else {
      resolvedRepoSlug = normalizedTargetRepo;
      repo = parsedRepo;
    }
  }

  const isCrossRepoDispatch = resolvedRepoSlug !== contextRepoSlug;

  // SEC-005: Enforce cross-repository allowlist per Safe Outputs Specification §3.2.6 (SP6).
  // Default-deny: cross-repo dispatch is only permitted when an explicit allowlist is configured
  // and the resolved target repo is present in that list. Uses validateTargetRepo from
  // repo_helpers.cjs for consistent slug validation and glob-pattern matching (e.g. "org/*").
  if (isCrossRepoDispatch) {
    if (allowedRepos.size === 0) {
      throw new Error(
        `E004: Cross-repository dispatch to '${resolvedRepoSlug}' is not permitted. No allowlist is configured. Define 'allowed-repos' in the workflow's 'safe-outputs.dispatch-workflow' section to enable cross-repository dispatch.`
      );
    }
    const repoValidation = validateTargetRepo(resolvedRepoSlug, contextRepoSlug, allowedRepos);
    if (!repoValidation.valid) {
      throw new Error(`E004: ${repoValidation.error}`);
    }
    core.info(`Cross-repo allowlist check passed for ${resolvedRepoSlug}`);
  }

  core.info(`Dispatch workflow configuration: max=${maxCount}`);
  if (allowedWorkflows.length > 0) {
    core.info(`Allowed workflows: ${allowedWorkflows.join(", ")}`);
  }
  if (Object.keys(workflowFiles).length > 0) {
    core.info(`Workflow files: ${JSON.stringify(workflowFiles)}`);
  }
  if (isCrossRepoDispatch) {
    core.info(`Dispatching to target repo: ${resolvedRepoSlug}`);
  }

  // Track how many items we've processed for max limit
  let processedCount = 0;