| 145 | } |
| 146 | |
| 147 | func getSandboxDisableJustification(workflowData *WorkflowData) (string, error) { |
| 148 | if workflowData == nil || workflowData.Features == nil { |
| 149 | return "", errors.New("dangerously-disable-sandbox-agent feature is missing") |
| 150 | } |
| 151 | |
| 152 | flagName := string(constants.DangerouslyDisableSandboxAgentFeatureFlag) |
| 153 | value, found := getFeatureValueCaseInsensitive(workflowData.Features, flagName) |
| 154 | if !found { |
| 155 | return "", errors.New("dangerously-disable-sandbox-agent feature is missing") |
| 156 | } |
| 157 | |
| 158 | justification, ok := value.(string) |
| 159 | if !ok { |
| 160 | return "", fmt.Errorf("feature must be a string, got %T", value) |
| 161 | } |
| 162 | |
| 163 | trimmed := strings.TrimSpace(justification) |
| 164 | if len(trimmed) < minSandboxDisableJustificationLength { |
| 165 | return "", fmt.Errorf("feature must be at least %d characters", minSandboxDisableJustificationLength) |
| 166 | } |
| 167 | |
| 168 | if githubActionsExpressionPattern.MatchString(trimmed) { |
| 169 | return "", errors.New("feature cannot use GitHub Actions expressions") |
| 170 | } |
| 171 | |
| 172 | return trimmed, nil |
| 173 | } |
| 174 | |
| 175 | func getFeatureValueCaseInsensitive(features map[string]any, flagName string) (any, bool) { |
| 176 | if value, exists := features[flagName]; exists { |