[evoskill] Refine developer skill with cross-trigger nullability guards for generated if: expressions

[Copilot]

A recent regression class showed that generated GitHub Actions conditions can fail at expression-evaluation time when nested github.event.* fields are referenced on incompatible triggers (for example, PR-only fields on push/schedule). This update strengthens the developer skill so future workflow-generation changes consistently guard cross-trigger nullability.

• Security Best Practices → new guidance section

  • Added “Cross-Trigger Nullability in Generated Conditional Expressions” to .github/skills/developer/SKILL.md (additive only; existing content unchanged).
  • Scoped guidance to Go code that emits workflow if: expressions (not runtime shell logic).

• Unsafe vs safe generation pattern

  • Documents the failure mode (startup_failure before jobs run) when parent event objects are absent.
  • Adds a safe composition pattern requiring:
    • github.event_name trigger gating
    • explicit parent-object null checks
    • ordered short-circuit evaluation before nested access

• Operational checklist for reviewers/authors

  • Adds a verification checklist to confirm generated conditions are valid across all declared triggers and that mixed-trigger workflows short-circuit safely.

// SECURE: trigger + parent nullability guards before nested access
condition := fmt.Sprintf(
  "github.event_name == 'pull_request' && github.event.pull_request != null && github.event.pull_request.stack != null && github.event.pull_request.stack.position >= %d && github.event.pull_request.stack.position <= %d",
  minPos,
  maxPos,
)

• Fixes [evoskill] EvoSkill: refine developer skill with cross-trigger nullability guidance #49466

[github-actions]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Hey @pelikhan 👋 — thanks for driving this important security refinement through the EvoSkill Evolver! The cross-trigger nullability guidance is well-scoped and precisely addresses the P0 regression from issue #49445/#49446.

Here's what looks great:

• ✅ Documentation is focused and additive (new subsection in security guidance)
• ✅ Well-linked to training evidence and validation cases
• ✅ Includes actionable unsafe/safe code contrast and verification checklist

A couple of things to finalize before merge:

• Complete the WIP verification step — your checklist shows "Run final verification (including required unit-test/report flow)" is pending. Complete this to confirm the guidance is production-ready.
• Consider adding test coverage — if tests in pkg/workflow/*filter*.go were updated to validate cross-trigger guards (as the verification checklist mentions), including them in this PR would strengthen the change and provide a concrete safeguard.

Once final verification is done and the checklist is fully green, this should be ready for merge.

Generated by ✅ Contribution Check · auto · 46.2 AIC · ⊞ 8.7K · ◷

[Copilot]

Pull request overview

Adds guidance for safely generating cross-trigger GitHub Actions conditions.

Changes:

• Documents trigger and parent-object null guards.
• Adds safe/unsafe examples and a verification checklist.
• Missing guidance against unsupported arithmetic operators.

Show a summary per file

File	Description
.github/skills/developer/SKILL.md	Adds cross-trigger condition-generation guidance.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.84.2