Function deriveWriteSinkGuardPolicyFromWorkflow

pkg/workflow/mcp_github_config.go:541–570

deriveWriteSinkGuardPolicyFromWorkflow derives a write-sink guard policy for non-GitHub MCP servers from the workflow's GitHub guard-policy configuration. This uses the same derivation as deriveSafeOutputsGuardPolicyFromGitHub, ensuring that as guard policies are rolled out, only GitHub inputs are f

(workflowData *WorkflowData)

// Returns nil when workflowData is nil, when no GitHub tool is present, or when a GitHub App is
// configured (auto-lockdown is skipped for GitHub App tokens, which are already repo-scoped).
func deriveWriteSinkGuardPolicyFromWorkflow(workflowData *WorkflowData) map[string]any {
	if workflowData == nil || workflowData.Tools == nil {
		return nil
	}
	rawGithubTool, hasGitHub := workflowData.Tools["github"]
	if !hasGitHub {
		return nil
	}

	toolConfig, _ := rawGithubTool.(map[string]any)

	// Try to derive from explicit guard policy first
	policy := deriveSafeOutputsGuardPolicyFromGitHub(toolConfig)
	if policy != nil {
		return policy
	}

	// When no explicit guard policy is configured but automatic lockdown detection would run
	// (GitHub tool present and not disabled, no GitHub App configured), return accept=["*"]
	// because automatic lockdown always sets repos=all at runtime.
	if rawGithubTool != false && len(getGitHubGuardPolicies(toolConfig)) == 0 && !hasGitHubApp(toolConfig) {
		return map[string]any{
			"write-sink": map[string]any{
				"accept": []string{"*"},
			},
		}
	}

	return nil
}

func getGitHubDockerImageVersion(githubTool map[string]any) string {
	githubDockerImageVersion := string(constants.DefaultGitHubMCPServerVersion) // Default Docker image version