refactor(workflow): consolidate duplicate runtime action repo maps - #41809
Merged
pelikhan merged 4 commits intoJun 27, 2026
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
…oToRuntime Remove the redundant `runtimeActionRepos map[string]bool` and its `init()` loop from `safe_update_enforcement.go`. `isTrustedActionRepo` now derives membership directly from `actionRepoToRuntime` (the existing map built in runtime_definitions.go), eliminating a second startup walk of `knownRuntimes` and providing a single source of truth for runtime action repos. Closes #41738 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Consolidate duplicate runtime maps runtimeActionRepos and actionRepoToRuntime
refactor(workflow): consolidate duplicate runtime action repo maps
Jun 26, 2026
pelikhan
marked this pull request as ready for review
June 26, 2026 23:03
Contributor
There was a problem hiding this comment.
Pull request overview
This PR refactors trusted-action enforcement to remove a redundant runtime action repo set by reusing the already-initialized actionRepoToRuntime map, reducing duplicated initialization work and eliminating two sources of truth.
Changes:
- Removed
runtimeActionReposand itsinit()population loop fromsafe_update_enforcement.go. - Updated
isTrustedActionRepoto treat “trusted runtime-manager actions” as the key-set ofactionRepoToRuntime.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/safe_update_enforcement.go | Drops the duplicate runtime action repo set and checks trust via actionRepoToRuntime. |
| .github/workflows/detection-analysis-report.lock.yml | Updates the generated workflow lock metadata (body_hash). |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/2 changed files
- Comments generated: 2
- Review effort level: Low
Comment on lines
+145
to
+146
| _, ok := actionRepoToRuntime[repo] | ||
| return ok |
| @@ -1,4 +1,4 @@ | |||
| # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"179078ab5cd745919117a67bbc9f30c8448c98b0e4187f2caff2175422ea4d7a","body_hash":"ae74f30eefbf62ea6b77ee6ffe193e3c614966e23aa890d1366e5b3defa0b9d4","strict":true,"agent_id":"claude","engine_versions":{"claude":"2.1.191"}} | |||
| # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"179078ab5cd745919117a67bbc9f30c8448c98b0e4187f2caff2175422ea4d7a","body_hash":"f76f3bc31cbb52b73129dd9c59de35a3d3e319bf3387b10794003672c3dbf0ec","strict":true,"agent_id":"claude","engine_versions":{"claude":"2.1.191"}} | |||
Collaborator
|
@copilot please run the
|
pelikhan
deleted the
copilot/deep-report-consolidate-duplicate-runtime-maps
branch
June 27, 2026 00:12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
safe_update_enforcement.gomaintained aruntimeActionRepos map[string]boolthat was simply the key-set ofactionRepoToRuntime(already built inruntime_definitions.go), causing a redundant walk ofknownRuntimesat startup and two sources of truth for the same data.Changes
pkg/workflow/safe_update_enforcement.go: RemoveruntimeActionReposvariable and itsinit()loop; updateisTrustedActionRepoto derive membership directly fromactionRepoToRuntime:No behavior change —
actionRepoToRuntimealready covers all non-emptyActionRepovalues fromknownRuntimes.pr-sous-chef run 28270977547 requested a branch refresh.