Function fetchAndSaveDispatchWorkflowsFromParsedFile

pkg/cli/dispatch.go:271–451

fetchAndSaveDispatchWorkflowsFromParsedFile parses a locally-saved workflow file to obtain the fully merged safe-outputs configuration (including dispatch workflows that originate from imported shared workflows), then fetches any referenced dispatch workflow files that don't already exist locally.

(destFile string, spec *WorkflowSpec, targetDir string, verbose bool, force bool, tracker *FileTracker)

// Parse failures are logged at debug level so they can be investigated when needed.
// Source conflicts are reported as warnings (not errors) because the main file is already written.
func fetchAndSaveDispatchWorkflowsFromParsedFile(destFile string, spec *WorkflowSpec, targetDir string, verbose bool, force bool, tracker *FileTracker) {
	remoteWorkflowLog.Printf("Fetching import-derived dispatch workflows from parsed file: %s, repo=%s", destFile, spec.RepoSlug)
	if spec.RepoSlug == "" {
		return
	}

	parts := strings.SplitN(spec.RepoSlug, "/", 2)
	if len(parts) != 2 {
		return
	}
	owner, repo := parts[0], parts[1]
	ref := spec.Version
	if ref == "" {
		ref = "main"
	}

	// Parse the locally-saved workflow to get the full merged safe-outputs config.
	compiler := workflow.NewCompiler()
	data, err := compiler.ParseWorkflowFile(destFile)
	if err != nil {
		remoteWorkflowLog.Printf("Failed to parse workflow file %s for import-derived dispatch workflows: %v", destFile, err)
		return
	}
	if data == nil || data.SafeOutputs == nil || data.SafeOutputs.DispatchWorkflow == nil {
		return
	}

	workflowNames := data.SafeOutputs.DispatchWorkflow.Workflows
	if len(workflowNames) == 0 {
		return
	}

	// Filter out GitHub Actions expression syntax
	filtered := make([]string, 0, len(workflowNames))
	for _, name := range workflowNames {
		if !strings.Contains(name, "${{") {
			filtered = append(filtered, name)
		}
	}
	if len(filtered) == 0 {
		return
	}

	remoteWorkflowLog.Printf("Processing %d import-derived dispatch workflow(s) (filtered from %d)", len(filtered), len(workflowNames))

	workflowBaseDir := getParentDir(spec.WorkflowPath)

	absTargetDir, absErr := filepath.Abs(targetDir)
	if absErr != nil {
		remoteWorkflowLog.Printf("Failed to resolve absolute path for target directory %s: %v", targetDir, absErr)
		return
	}

	for _, workflowName := range filtered {
		// Early rejection of path traversal patterns (authoritative check is filepath.Rel below).
		if strings.Contains(workflowName, "..") {
			if verbose {
				fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Skipping dispatch workflow with unsafe name: %q", workflowName)))