[file-diet] Refactor `safe_outputs_config_generation.go` (1092 lines) into focused modules

[github-actions]

The file pkg/workflow/safe_outputs_config_generation.go has grown to 1092 lines — well above the 800-line healthy threshold — with no dedicated test file. It mixes two distinct concerns that would benefit from separation.

Current State

Metric	Value
File	pkg/workflow/safe_outputs_config_generation.go
Size	1092 lines
Dedicated test file	❌ None (tested indirectly via safe_outputs_test.go, safe_outputs_tools_test.go, dispatch_workflow_test.go, etc.)
Companion helpers file	safe_outputs_config_generation_helpers.go (188 lines — healthy)

Full File Analysis

Function Distribution

Function	Lines	Domain
populateDispatchWorkflowFiles()	~40	Config generation (pre-pass for dispatch)
generateSafeOutputsConfig()	~435	Config generation (runtime validation rules JSON)
generateCustomJobToolDefinition()	~87	Tools JSON generation (MCP tool schema)
generateFilteredToolsJSON()	~251	Tools JSON generation (filtering + assembly)
addRepoParameterIfNeeded()	~156	Tools JSON generation (repo param injection)
generateDispatchWorkflowTool()	~94	Tools JSON generation (dispatch workflow schema)

Two Distinct Domains

Domain 1 – Runtime validation config (generateSafeOutputsConfig, populateDispatchWorkflowFiles): Produces the JSON blob embedded in compiled workflows that the safe-outputs handler reads at runtime to validate tool calls (max counts, allowed labels, target repos, etc.).

Domain 2 – MCP tools JSON (generateFilteredToolsJSON, generateCustomJobToolDefinition, addRepoParameterIfNeeded, generateDispatchWorkflowTool): Produces the JSON array of MCP tool definitions exposed to the AI agent, including dynamic dispatch-workflow tools and custom safe-job tools.

Complexity Hotspots

• generateSafeOutputsConfig (lines 58–492): 435-line monolithic function with ~35 if-branches, one for each safe-output type. Each branch calls a helper but the accumulation makes the function hard to navigate.
• addRepoParameterIfNeeded (lines 840–995): 156-line switch statement that duplicates config.AllowedRepos + config.TargetRepoSlug extraction for every tool type. The nested switch inside a case (lines 909–963) is a complexity hotspot.

Refactoring Strategy

Proposed File Splits

1. safe_outputs_config_generation.go (keep, trimmed)

   • Functions: populateDispatchWorkflowFiles, generateSafeOutputsConfig
   • Responsibility: Build the runtime validation config JSON embedded in compiled workflows
   • Estimated LOC: ~480 lines

2. safe_outputs_tools_generation.go (new)

   • Functions: generateFilteredToolsJSON, generateCustomJobToolDefinition, addRepoParameterIfNeeded, generateDispatchWorkflowTool
   • Responsibility: Build the MCP tool definitions JSON exposed to the AI agent
   • Estimated LOC: ~590 lines

Additional Refactoring Opportunities

• generateSafeOutputsConfig: Extract the per-output-type config building into small private helpers (similar to what already exists in _helpers.go) to reduce the 435-line function body.
• addRepoParameterIfNeeded: Replace the large switch with a helper getRepoConfig(toolName string, safeOutputs *SafeOutputsConfig) (hasAllowedRepos bool, targetRepoSlug string) that uses a map-based dispatch, reducing ~120 lines to ~20.

Test Coverage Plan

No dedicated test file currently exists. Add:

1. safe_outputs_config_generation_test.go

   • TestGenerateSafeOutputsConfig — move/consolidate tests from safe_outputs_test.go
   • TestPopulateDispatchWorkflowFiles — unit tests for the pre-pass function
   • Target coverage: ≥80%

2. safe_outputs_tools_generation_test.go

   • TestGenerateFilteredToolsJSON — move/consolidate from safe_outputs_tools_test.go
   • TestGenerateCustomJobToolDefinition — unit tests for schema building
   • TestAddRepoParameterIfNeeded — parametric tests for each tool type
   • TestGenerateDispatchWorkflowTool — input type mapping tests
   • Target coverage: ≥80%

Implementation Guidelines

1. Preserve Behavior: Ensure all existing functionality works identically
2. Maintain Package-Private API: All functions are unexported — no API breakage risk
3. Incremental Changes: Split first, then refactor internals
4. Run Tests Frequently: Verify make test-unit passes after each step
5. Run Linting: make lint after adding test files (watch for unused helpers)
6. Format Code: make fmt before committing

Acceptance Criteria

• safe_outputs_config_generation.go is ≤500 lines
• safe_outputs_tools_generation.go is created and ≤600 lines
• Dedicated test files added for both modules
• All tests pass (make test-unit)
• Code passes linting (make lint)
• Build succeeds (make build)

Additional Context

• Companion helpers file safe_outputs_config_generation_helpers.go (188 lines) is already healthy and should not be changed
• Callers: mcp_setup_generator.go calls populateDispatchWorkflowFiles; the compiler pipeline calls generateSafeOutputsConfig and generateFilteredToolsJSON via safe_outputs_config.go
• Workflow run: §22183884465

---

Priority: Medium
Effort: Small (mechanical split) + Medium (internal refactoring of generateSafeOutputsConfig)
Expected Impact: Improved navigability, easier testing, clearer module responsibilities

Generated by Daily File Diet

• expires on Feb 21, 2026, 1:37 PM UTC