diff --git a/pkg/workflow/template_injection_validation.go b/pkg/workflow/template_injection_validation.go index c8eb0b3c61c..9d97904ec29 100644 --- a/pkg/workflow/template_injection_validation.go +++ b/pkg/workflow/template_injection_validation.go @@ -232,6 +232,10 @@ func validateNoGitHubExpressionsInRunScriptsFromParsed(workflow map[string]any) var violations []TemplateInjectionViolation for _, runContent := range runBlocks { + if !mayContainInlineExpression(runContent) { + continue + } + // Align with template-injection validation by excluding non-executable regions: // heredoc bodies and bash # comments. contentWithoutHeredocs := stripShellLineComments(removeHeredocContent(runContent)) diff --git a/pkg/workflow/template_injection_validation_benchmark_test.go b/pkg/workflow/template_injection_validation_benchmark_test.go index 3ecba32637f..997eedc7046 100644 --- a/pkg/workflow/template_injection_validation_benchmark_test.go +++ b/pkg/workflow/template_injection_validation_benchmark_test.go @@ -1,6 +1,10 @@ package workflow -import "testing" +import ( + "testing" + + "github.com/goccy/go-yaml" +) func BenchmarkValidateTemplateInjectionFastPath(b *testing.B) { compiler := NewCompiler() @@ -27,3 +31,31 @@ jobs: } } } + +func BenchmarkValidateNoGitHubExpressionsInRunScriptsFromParsed_NoExpressions(b *testing.B) { + yamlContent := ` +name: no-inline-expression +on: workflow_dispatch +jobs: + test: + runs-on: ubuntu-latest + steps: + - name: No expression run + run: | + echo "hello" + echo "world" +` + + var parsed map[string]any + if err := yaml.Unmarshal([]byte(yamlContent), &parsed); err != nil { + b.Fatal(err) + } + + b.ResetTimer() + b.ReportAllocs() + for b.Loop() { + if err := validateNoGitHubExpressionsInRunScriptsFromParsed(parsed); err != nil { + b.Fatalf("validateNoGitHubExpressionsInRunScriptsFromParsed() error = %v", err) + } + } +}