Function fetchAndSaveRemoteDispatchWorkflows

pkg/cli/dispatch.go:80–256

fetchAndSaveRemoteDispatchWorkflows fetches and saves the workflow files referenced in the safe-outputs.dispatch-workflow configuration of a remote workflow. Each listed workflow name (without extension) is resolved as a sibling file (" .md") in the same directory as the source workflow and dow

(ctx context.Context, content string, spec *WorkflowSpec, targetDir string, verbose bool, force bool, tracker *FileTracker, downloaders ...fileDownloadFn)

// An optional downloader function may be provided as the last argument to override the default
// parser.DownloadFileFromGitHub implementation (used in tests to avoid real network calls).
func fetchAndSaveRemoteDispatchWorkflows(ctx context.Context, content string, spec *WorkflowSpec, targetDir string, verbose bool, force bool, tracker *FileTracker, downloaders ...fileDownloadFn) error {
	remoteWorkflowLog.Printf("Fetching remote dispatch workflows: repo=%s, targetDir=%s, force=%v", spec.RepoSlug, targetDir, force)
	downloader := fileDownloadFn(parser.DownloadFileFromGitHub)
	if len(downloaders) > 0 && downloaders[0] != nil {
		downloader = downloaders[0]
	}
	if spec.RepoSlug == "" {
		return nil
	}

	parts := strings.SplitN(spec.RepoSlug, "/", 2)
	if len(parts) != 2 {
		return nil
	}
	owner, repo := parts[0], parts[1]
	ref := spec.Version
	if ref == "" {
		defaultBranch, err := getRepoDefaultBranch(ctx, spec.RepoSlug)
		if err != nil {
			remoteWorkflowLog.Printf("Failed to resolve default branch for %s, falling back to 'main': %v", spec.RepoSlug, err)
			ref = "main"
		} else {
			ref = defaultBranch
		}
		spec.Version = ref
	}

	workflowNames := extractDispatchWorkflowNames(content)
	if len(workflowNames) == 0 {
		return nil
	}

	remoteWorkflowLog.Printf("Found %d dispatch workflow(s) to fetch from %s@%s", len(workflowNames), spec.RepoSlug, ref)

	// workflowBaseDir is the directory of the source workflow in the remote repo
	// (e.g. ".github/workflows"). Dispatch-workflow names are resolved relative to it.
	workflowBaseDir := getParentDir(spec.WorkflowPath)

	// Pre-compute the absolute target directory for path-traversal boundary checks.
	absTargetDir, err := filepath.Abs(targetDir)
	if err != nil {
		remoteWorkflowLog.Printf("Failed to resolve absolute path for target directory %s: %v", targetDir, err)
		return nil
	}

	for _, workflowName := range workflowNames {
		// Build the remote file path for this dispatch workflow
		var remoteFilePath string
		if workflowBaseDir != "" {
			remoteFilePath = path.Join(workflowBaseDir, workflowName+".md")
		} else {
			remoteFilePath = workflowName + ".md"
		}
		remoteFilePath = path.Clean(remoteFilePath)

		// The local path is just the workflow filename in targetDir
		localRelPath := filepath.Clean(workflowName + ".md")
		targetPath := filepath.Join(targetDir, localRelPath)