Function buildCustomScriptFilesStep

pkg/workflow/compiler_safe_outputs_job.go:915–947

buildCustomScriptFilesStep generates a run step that writes inline safe-output script files to the setup action destination folder so they can be required by the handler manager. Users write only the handler body; the compiler wraps it with config destructuring, the handler function, and module.expo

(scripts map[string]*SafeScriptConfig)

// the handler function, and module.exports boilerplate.
// Each script is written using a heredoc to avoid shell quoting issues.
func buildCustomScriptFilesStep(scripts map[string]*SafeScriptConfig) ([]string, error) {
	if len(scripts) == 0 {
		return nil, nil
	}

	// Sort script names for deterministic output
	scriptNames := sliceutil.SortedKeys(scripts)

	var steps []string
	steps = append(steps, "      - name: Configure Safe Outputs Custom Scripts\n")
	steps = append(steps, "        run: |\n")

	for _, scriptName := range scriptNames {
		scriptConfig := scripts[scriptName]
		normalizedName := stringutil.NormalizeSafeOutputIdentifier(scriptName)
		filename := safeOutputScriptFilename(normalizedName)
		filePath := SetupActionDestinationShell + "/" + filename
		scriptContent := generateSafeOutputScriptContent(scriptName, scriptConfig)
		delimiter := GenerateHeredocDelimiterFromContent("SAFE_OUTPUT_SCRIPT_"+strings.ToUpper(normalizedName), scriptContent)

		if err := ValidateHeredocContent(scriptContent, delimiter); err != nil {
			return nil, fmt.Errorf("safe-output script %q: %w", scriptName, err)
		}

		steps = append(steps, fmt.Sprintf("          cat > \"%s\" << '%s'\n", filePath, delimiter))
		for line := range strings.SplitSeq(scriptContent, "\n") {
			steps = append(steps, "          "+line+"\n")
		}
		steps = append(steps, "          "+delimiter+"\n")
	}

	return steps, nil
}