validateWorkflowData orchestrates all validation of workflow configuration by delegating to four focused validators. Each validator is independently testable and covers a distinct concern: - validateExpressions: expression safety and runtime-import file checks - validateFeatureConfig: feature flags
(workflowData *WorkflowData, markdownPath string)
| 85 | // - validatePermissions: permissions parsing, MCP tool constraints, workflow_run security |
| 86 | // - validateToolConfiguration: safe-outputs, GitHub tools, dispatches, and resources |
| 87 | func (c *Compiler) validateWorkflowData(workflowData *WorkflowData, markdownPath string) error { |
| 88 | if err := validateRunnerConfig(workflowData.RunnerConfig); err != nil { |
| 89 | return formatCompilerError(markdownPath, "error", err.Error(), err) |
| 90 | } |
| 91 | |
| 92 | if err := validateArcDindRootless(workflowData); err != nil { |
| 93 | return formatCompilerError(markdownPath, "error", err.Error(), err) |
| 94 | } |
| 95 | |
| 96 | if err := c.validateExpressions(workflowData, markdownPath); err != nil { |
| 97 | return err |
| 98 | } |
| 99 | |
| 100 | if err := c.validateFeatureConfig(workflowData, markdownPath); err != nil { |
| 101 | return err |
| 102 | } |
| 103 | |
| 104 | workflowPermissions, err := c.validatePermissions(workflowData, markdownPath) |
| 105 | if err != nil { |
| 106 | return err |
| 107 | } |
| 108 | |
| 109 | return c.validateToolConfiguration(workflowData, markdownPath, workflowPermissions) |
| 110 | } |
| 111 | |
| 112 | // shouldDowngradeDefaultToolsetPermissionError returns true when strict-mode |
| 113 | // permission errors should be downgraded because the GitHub tool uses only the |