Function buildWorkflowCallNetworkAllowedUpdateScript

pkg/workflow/awf_helpers.go:195–216

()

}

func buildWorkflowCallNetworkAllowedUpdateScript() (string, error) {
	ecosystemDomains := getLoadedEcosystemDomains()
	ecosystemMap := make(map[string][]string, safeAllocationCapacity(len(ecosystemDomains), len(compoundEcosystems)))
	for ecosystem := range ecosystemDomains {
		ecosystemMap[ecosystem] = getEcosystemDomains(ecosystem)
	}
	for ecosystem := range compoundEcosystems {
		ecosystemMap[ecosystem] = getEcosystemDomains(ecosystem)
	}

	ecosystemJSON, err := json.Marshal(ecosystemMap)
	if err != nil {
		return "", fmt.Errorf("marshal network allowed ecosystem map: %w", err)
	}

	// Pass the ecosystem map JSON via an env var and invoke the JavaScript
	// implementation deployed by actions/setup to ${RUNNER_TEMP}/gh-aw/actions/.
	// Using node avoids any Python dependency and eliminates quote-injection risk:
	// shellEscapeArg safely single-quotes and escapes the JSON payload.
	return fmt.Sprintf(`GH_AW_ECOSYSTEM_MAP_JSON=%s node "${RUNNER_TEMP}/gh-aw/actions/update_network_allowed.cjs"`,
		shellEscapeArg(string(ecosystemJSON))), nil
}

// BuildAWFCommand builds a complete AWF command with all arguments.
// This consolidates the AWF command building logic that was duplicated across