Skip to content

Add maxItems constraints to workflow schema arrays for resource safety #11959

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 4 commits into from
Jan 26, 2026
Merged

Add maxItems constraints to workflow schema arrays for resource safety #11959

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
31dcd5d
Initial plan
Copilot Jan 26, 2026
3b707d5
Initial analysis and planning for maxItems constraints
Copilot Jan 26, 2026
7e45b05
Add maxItems constraints to all array fields in workflow schema
Copilot Jan 26, 2026
5b21855
Complete: Add maxItems constraints to workflow schema - all workflows…
Copilot Jan 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 40 additions & 20 deletions pkg/parser/schemas/main_workflow_schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -181,7 +181,8 @@
"minLength": 1,
"pattern": "^[^/]",
"description": "Command name without leading slash"
}
},
"maxItems": 25
}
],
"description": "Name of the slash command that triggers the workflow (e.g., '/help', '/analyze'). Used for comment-based workflow activation."
Expand All @@ -202,7 +203,8 @@
"type": "string",
"description": "GitHub Actions event name.",
"enum": ["*", "issues", "issue_comment", "pull_request_comment", "pull_request", "pull_request_review_comment", "discussion", "discussion_comment"]
}
},
"maxItems": 25
}
]
}
Expand Down Expand Up @@ -245,7 +247,8 @@
"minLength": 1,
"pattern": "^[^/]",
"description": "Command name without leading slash"
}
},
"maxItems": 25
}
],
"description": "Name of the slash command that triggers the workflow (e.g., '/deploy', '/test'). Used for command-based workflow activation."
Expand All @@ -266,7 +269,8 @@
"type": "string",
"description": "GitHub Actions event name.",
"enum": ["*", "issues", "issue_comment", "pull_request_comment", "pull_request", "pull_request_review_comment", "discussion", "discussion_comment"]
}
},
"maxItems": 25
}
]
}
Expand Down Expand Up @@ -485,7 +489,8 @@
"type": "string",
"description": "Label name"
},
"minItems": 1
"minItems": 1,
"maxItems": 25
}
],
"description": "Array of pull request type names that trigger the workflow. Filters workflow execution to specific PR categories."
Expand Down Expand Up @@ -575,7 +580,8 @@
"type": "string",
"description": "Label name"
},
"minItems": 1
"minItems": 1,
"maxItems": 25
}
],
"description": "Array of issue type names that trigger the workflow. Filters workflow execution to specific issue categories."
Expand Down Expand Up @@ -657,7 +663,8 @@
},
"required": ["cron"],
"additionalProperties": false
}
},
"maxItems": 10
}
]
},
Expand Down Expand Up @@ -2686,7 +2693,8 @@
]
},
"minItems": 1,
"$comment": "At least one toolset is required when toolsets array is specified. Use null or omit the field to use all toolsets."
"$comment": "At least one toolset is required when toolsets array is specified. Use null or omit the field to use all toolsets.",
"maxItems": 20
},
"mounts": {
"type": "array",
Expand Down Expand Up @@ -3006,7 +3014,8 @@
"key": "memory-session"
}
]
]
],
"maxItems": 10
}
],
"examples": [
Expand Down Expand Up @@ -3372,7 +3381,8 @@
"branch-name": "memory/session"
}
]
]
],
"maxItems": 10
}
],
"examples": [
Expand Down Expand Up @@ -4813,7 +4823,8 @@
"items": {
"type": "string"
},
"minItems": 1
"minItems": 1,
"maxItems": 50
},
"max": {
"type": "integer",
Expand Down Expand Up @@ -4854,7 +4865,8 @@
"items": {
"type": "string"
},
"minItems": 1
"minItems": 1,
"maxItems": 50
},
"max": {
"type": "integer",
Expand Down Expand Up @@ -4895,7 +4907,8 @@
"items": {
"type": "string"
},
"minItems": 1
"minItems": 1,
"maxItems": 50
},
"max": {
"type": "integer",
Expand Down Expand Up @@ -4936,7 +4949,8 @@
"items": {
"type": "string"
},
"minItems": 1
"minItems": 1,
"maxItems": 50
},
"max": {
"type": "integer",
Expand Down Expand Up @@ -5068,7 +5082,8 @@
"items": {
"type": "string"
},
"minItems": 1
"minItems": 1,
"maxItems": 50
},
"parent-title-prefix": {
"type": "string",
Expand All @@ -5080,7 +5095,8 @@
"items": {
"type": "string"
},
"minItems": 1
"minItems": 1,
"maxItems": 50
},
"sub-title-prefix": {
"type": "string",
Expand Down Expand Up @@ -5828,7 +5844,8 @@
"type": "string",
"minLength": 1
},
"minItems": 1
"minItems": 1,
"maxItems": 50
},
"max": {
"type": "integer",
Expand All @@ -5852,7 +5869,8 @@
"type": "string",
"minLength": 1
},
"minItems": 1
"minItems": 1,
"maxItems": 50
}
],
"description": "Dispatch workflow_dispatch events to other workflows. Used by orchestrators to delegate work to worker workflows with controlled maximum dispatch count."
Expand Down Expand Up @@ -5898,7 +5916,8 @@
"enum": ["admin", "maintainer", "maintain", "write", "triage"],
"description": "Repository permission level: 'admin' (full access), 'maintainer'/'maintain' (repository management), 'write' (push access), 'triage' (issue management)"
},
"minItems": 1
"minItems": 1,
"maxItems": 50
}
]
},
Expand Down Expand Up @@ -6453,7 +6472,8 @@
},
"minItems": 1,
"uniqueItems": true,
"description": "List of allowed domain names for network access"
"description": "List of allowed domain names for network access",
"maxItems": 100
},
"proxy-args": {
"type": "array",
Expand Down
5 changes: 5 additions & 0 deletions pkg/workflow/data/action_pins.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,11 @@
"version": "v5",
"sha": "93cb6efe18208431cddfb8368fd83d5badbf9bfd"
},
"actions/checkout@v6": {
"repo": "actions/checkout",
"version": "v6",
"sha": "8e8c483db84b4bee98b60c0593521ed34d9990e8"
},
"actions/checkout@v6.0.2": {
"repo": "actions/checkout",
"version": "v6.0.2",
Expand Down
Loading