Method buildHandlerManagerStep

pkg/workflow/compiler_safe_outputs_steps.go:87–301

buildHandlerManagerStep builds a single step that uses the safe output handler manager to dispatch messages to appropriate handlers. This replaces multiple individual steps with a single dispatcher step that processes all safe output types.

(data *WorkflowData)

// to dispatch messages to appropriate handlers. This replaces multiple individual steps
// with a single dispatcher step that processes all safe output types.
func (c *Compiler) buildHandlerManagerStep(data *WorkflowData) ([]string, error) {
	consolidatedSafeOutputsStepsLog.Print("Building handler manager step")

	var steps []string

	// Add per-handler GitHub App token minting steps before the handler manager step.
	// These run before the main handler step so the minted token expressions (e.g.
	// ${{ steps.create-check-run-app-token.outputs.token }}) are resolved at runtime.
	if data.SafeOutputs != nil && data.SafeOutputs.CreateCheckRun != nil && data.SafeOutputs.CreateCheckRun.GitHubApp != nil {
		consolidatedSafeOutputsStepsLog.Print("Adding per-handler GitHub App token minting step for create-check-run")
		permissions := NewPermissionsContentsReadChecksWrite()
		for _, step := range c.buildGitHubAppTokenMintStep(data.SafeOutputs.CreateCheckRun.GitHubApp, permissions, "") {
			steps = append(steps, replaceStepID(step, "safe-outputs-app-token", "create-check-run-app-token"))
		}
	}

	// Step name and metadata
	steps = append(steps, "      - name: Process Safe Outputs\n")
	steps = append(steps, "        id: process_safe_outputs\n")
	steps = append(steps, fmt.Sprintf("        uses: %s\n", getCachedActionPin("actions/github-script", data)))

	// Environment variables
	steps = append(steps, "        env:\n")
	steps = append(steps, "          GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n")
	steps = append(steps, "          GH_AW_COMMENT_ID: ${{ needs.activation.outputs.comment_id }}\n")

	// Add allowed domains configuration for URL sanitization in safe output handlers.
	// Without this, sanitizeContent() in safe_output_handler_manager.cjs only allows
	// default GitHub domains, causing user-configured allowed domains to be redacted.
	var domainsStr string
	if data.SafeOutputs != nil && len(data.SafeOutputs.AllowedDomains) > 0 {
		// allowed-domains: additional domains unioned with engine/network base set; supports ecosystem identifiers
		expanded, err := c.computeExpandedAllowedDomainsForSanitization(data)
		if err != nil {
			return nil, err
		}
		domainsStr = expanded
	} else {
		computed, err := c.computeAllowedDomainsForSanitization(data)
		if err != nil {
			return nil, err
		}
		domainsStr = computed
	}
	if domainsStr != "" {
		steps = append(steps, fmt.Sprintf("          GH_AW_ALLOWED_DOMAINS: %q\n", domainsStr))
	}
	if data.SafeOutputs != nil && data.SafeOutputs.URLs != "" {
		steps = append(steps, fmt.Sprintf("          GH_AW_SAFE_OUTPUTS_URLS: %q\n", data.SafeOutputs.URLs))
	}
	// Pass GitHub server/API URLs so buildAllowedDomains() can add GHES domains dynamically
	steps = append(steps, "          GITHUB_SERVER_URL: ${{ github.server_url }}\n")
	steps = append(steps, "          GITHUB_API_URL: ${{ github.api_url }}\n")

	// Note: The project handler manager has been removed.
	// All project-related operations are now handled by the unified handler.

	// Add GH_AW_SAFE_OUTPUT_JOBS so the handler manager knows which message types are