Add compile-time validation for script runtime mode constraints

[Copilot]

Scripts in the registry must follow platform conventions: GitHub Script mode cannot use execSync (async exec required), Node.js mode cannot use GitHub Actions globals (core.*, exec.*, github.*).

Changes

Validation Functions (pkg/workflow/bundler_validation.go)

• validateNoExecSync() - Detects execSync usage in GitHub Script mode
• validateNoGitHubScriptGlobals() - Detects GitHub Actions globals in Node.js mode
• Both skip validation for non-applicable runtime modes

Script Registry Integration (pkg/workflow/script_registry.go)

• RegisterWithMode() now calls validations before registration
• Violations panic at package init (compile-time) rather than runtime
• Example violation:

// This will panic during package initialization
DefaultScriptRegistry.RegisterWithMode("bad_script", `
  const { execSync } = require("child_process");
  execSync("ls");  // ❌ GitHub Script mode must use exec
`, RuntimeModeGitHubScript)

Documentation (specs/validation-architecture.md)

• Added JavaScript Bundler Validation section
• Documents validation patterns and runtime mode constraints
• Explains enforcement timing (compile-time via panic)

Tests (pkg/workflow/bundler_validation_script_registry_test.go)

• Comprehensive coverage for both validation functions
• Verifies panic behavior on invalid registrations
• Tests runtime mode specificity (GitHub Script vs Node.js)

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/user
  • Triggering command: /usr/bin/gh gh api user --jq .login -unreachable=false /tmp/go-build4206891781/b233/vet.cfg /usr/bin/make e mor_annotation_trev-parse bin/grep make buil�� tags/v5 grep by/6f3da1ae4a366d71a291fe57c3bd2465a8927fd549e521d88fbbe6638e99d91e/log.json e ration_test.go ndor/bin/grep 1/x64/bin/npm (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login /ref/tags/v8 g/timeutil/format_test.go ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile by/6f3da1ae4a366gh -ifaceassert -nilfunc ache/go/1.25.0/x--jq to R�� tags/93cb6efe18208431cddfb8368fd--detach by/6f3da1ae4a366d71a291fe57c3bd2465a8927fd549e521d88fbbe6638e99d91e (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login le/git/ref/tags/v2 %(refname) f67f0bc70d2d2e0330348d97fb1f8ace6c3/log.json --merged e7141080b38e347c/home/REDACTED/.npm/_npx/6914489a61678098/node_modules/.bin/mcp-server�� rgo/bin/grep git add runs/20251209-021454-8744/test-660994759 -v 1/x64/bin/node e (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Add checks at compile time in the script registry:

• GitHub-script should not use "execSync", exec instead
• node scripts should not use github-script globals like core.* or exec.* or github.*

Custom agent used: create-shared-agentic-workflow
Create shared agentic workflow components that wrap MCP servers using GitHub Agentic Workflows (gh-aw) with Docker best practices.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.