Function buildCustomSafeOutputScriptsJSON

pkg/workflow/safe_scripts.go:90–121

buildCustomSafeOutputScriptsJSON builds a JSON mapping of custom safe output script names to their .cjs filenames, for use in the GH_AW_SAFE_OUTPUT_SCRIPTS env var of the handler manager step. This allows the handler manager to load and dispatch messages to inline script handlers.

(data *WorkflowData)

// .cjs filenames, for use in the GH_AW_SAFE_OUTPUT_SCRIPTS env var of the handler manager step.
// This allows the handler manager to load and dispatch messages to inline script handlers.
func buildCustomSafeOutputScriptsJSON(data *WorkflowData) string {
	if data.SafeOutputs == nil || len(data.SafeOutputs.Scripts) == 0 {
		return ""
	}

	// Build mapping of normalized script names to their .cjs filenames
	scriptMapping := make(map[string]string, len(data.SafeOutputs.Scripts))
	for scriptName := range data.SafeOutputs.Scripts {
		normalizedName := stringutil.NormalizeSafeOutputIdentifier(scriptName)
		// Reject names that could cause path traversal when the filename is passed to require()
		if !isSafeScriptName(normalizedName) {
			safeScriptsLog.Printf("Warning: skipping script %q — name contains unsafe path characters: %q", scriptName, normalizedName)
			continue
		}
		scriptMapping[normalizedName] = safeOutputScriptFilename(normalizedName)
	}

	// Sort keys for deterministic output
	keys := sliceutil.SortedKeys(scriptMapping)

	ordered := make(map[string]string, len(keys))
	for _, k := range keys {
		ordered[k] = scriptMapping[k]
	}

	jsonBytes, err := json.Marshal(ordered)
	if err != nil {
		safeScriptsLog.Printf("Warning: failed to marshal custom safe output scripts: %v", err)
		return ""
	}
	return string(jsonBytes)
}

// safeOutputScriptFilename returns the .cjs filename for a normalized safe output script name.
func safeOutputScriptFilename(normalizedName string) string {