Move condition check into wrapper

src/toil/cwl/cwltoil.py

@@ -2448,17 +2448,22 @@ def __init__(
     def run(self, file_store: AbstractFileStore) -> Any:
         """Create a child job with the correct resource requirements set."""
         cwljob = resolve_dict_w_promises(self.cwljob, file_store)
+
+        # Check confitional to license full evaluation of job inputs.
+        if self.conditional.is_false(cwljob):
+            return self.conditional.skipped_outputs()
+
         fill_in_defaults(
             self.cwltool.tool["inputs"],
             cwljob,
             self.runtime_context.make_fs_access(self.runtime_context.basedir or ""),
         )
+        # Don't forward the conditional. We checked it already.
         realjob = CWLJob(
             tool=self.cwltool,
             cwljob=cwljob,
             runtime_context=self.runtime_context,
             parent_name=self.parent_name,
-            conditional=self.conditional,
         )
         self.addChild(realjob)
         return realjob.rv()

src/toil/test/cwl/cwlTest.py

@@ -453,6 +453,14 @@ def test_glob_dir_bypass_file_store(self) -> None:
             except FileNotFoundError:
                 pass
 
+    def test_required_input_condition_protection(self) -> None:
+        # This doesn't run containerized
+        self._tester(
+            "src/toil/test/cwl/not_run_required_input.cwl",
+            "src/toil/test/cwl/empty.json",
+            {},
+        )
+
     @needs_slurm
     def test_slurm_node_memory(self) -> None:
         pass

src/toil/test/cwl/not_run_required_input.cwl

@@ -0,0 +1,29 @@
+# This workflow fills in a required int from an optional int, but only when the
+# int is really present. But it also uses the value to compute the conditional
+# task's resource requirements, so Toil can't just schedule the task and then
+# check the condition.
+# See <https://github.com/DataBiosphere/toil/issues/4930#issue-2297563321>
+cwlVersion: v1.2
+class: Workflow
+requirements:
+  InlineJavascriptRequirement: {}
+inputs:
+  optional_input: int?
+steps:
+  the_step:
+    in:
+      required_input:
+        source: optional_input
+    when: $(inputs.required_input != null)
+    run:
+      cwlVersion: v1.2
+      class: CommandLineTool
+      inputs:
+        required_input: int
+      requirements:
+        ResourceRequirement:
+          coresMax: $(inputs.required_input)
+      baseCommand: "nproc"
+      outputs: []
+    out: []
+outputs: []