CollectLockFileManifests scans all *.lock.yml files in workflowsDir (defaults to ".github/workflows") and extracts their gh-aw-manifest headers. The returned map is keyed by the lock-file path exactly as produced by the compiler so that lookups in the compiler's priorManifests map always match. Th
(workflowsDir string)
| 18 | // This function must be called at MCP server startup, before any agent interaction, |
| 19 | // so that the returned manifests cannot be tampered with by the agent. |
| 20 | func CollectLockFileManifests(workflowsDir string) map[string]*workflow.GHAWManifest { |
| 21 | if workflowsDir == "" { |
| 22 | workflowsDir = constants.GetWorkflowDir() |
| 23 | } |
| 24 | |
| 25 | result := make(map[string]*workflow.GHAWManifest) |
| 26 | |
| 27 | pattern := filepath.Join(workflowsDir, "*.lock.yml") |
| 28 | lockFiles, err := filepath.Glob(pattern) |
| 29 | if err != nil { |
| 30 | mcpLog.Printf("Failed to glob lock files in %s: %v", workflowsDir, err) |
| 31 | return result |
| 32 | } |
| 33 | |
| 34 | for _, lockFile := range lockFiles { |
| 35 | content, err := os.ReadFile(lockFile) |
| 36 | if err != nil { |
| 37 | mcpLog.Printf("Failed to read lock file %s: %v", lockFile, err) |
| 38 | continue |
| 39 | } |
| 40 | |
| 41 | manifest, err := workflow.ExtractGHAWManifestFromLockFile(string(content)) |
| 42 | if err != nil { |
| 43 | mcpLog.Printf("Failed to extract manifest from %s: %v", lockFile, err) |
| 44 | continue |
| 45 | } |
| 46 | |
| 47 | // Store with the same path key the compiler will use (filepath.Clean of the lock file path). |
| 48 | result[filepath.Clean(lockFile)] = manifest |
| 49 | if manifest != nil { |
| 50 | mcpLog.Printf("Cached manifest for %s: %d secret(s), %d action(s)", lockFile, len(manifest.Secrets), len(manifest.Actions)) |
| 51 | } else { |
| 52 | mcpLog.Printf("Cached nil manifest for %s (no gh-aw-manifest header)", lockFile) |
| 53 | } |
| 54 | } |
| 55 | |
| 56 | mcpLog.Printf("Pre-cached %d lock-file manifest(s) at startup", len(result)) |
| 57 | return result |
| 58 | } |
| 59 | |
| 60 | // WritePriorManifestFile serialises the manifest cache to a temporary JSON file and |
| 61 | // returns its path. The caller is responsible for removing the file when done. |
no test coverage detected