Add oneOf schema constraints for mutually exclusive field pairs

[Copilot]

Schema validation previously only documented mutual exclusivity via $comment annotations, with actual enforcement deferred to compile time in Go. This meant users only discovered conflicts when compiling workflows, not during editing.

Changes

Event filter constraints

Added oneOf constraints to enforce mutual exclusivity:

• branches vs branches-ignore (push, pull_request, pull_request_target, workflow_run)
• paths vs paths-ignore (push, pull_request, pull_request_target)

Command trigger constraints

Extended existing allOf constraint to include label event:

• slash_command / command now properly conflicts with label event type

Testing

Added pkg/parser/schema_oneof_test.go with 23 test cases covering valid and invalid configurations.

Example

Invalid configuration now fails at parse time with clear error:

on:
  push:
    branches: [main]
    branches-ignore: [dev]  # Error: 'oneOf' failed

Valid configurations continue to work:

on:
  push:
    branches: [main]
    paths: [src/**]  # OK: different constraint pairs

Note: MCP command vs container constraint already exists via not: { allOf: [...] } pattern and requires no changes.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/user
  • Triggering command: /usr/bin/gh gh api user --jq .login (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login .git .git 0/x64/bin/node l ame 64/pkg/tool/linu--show-toplevel /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linu--jq -o 04/upload_assets.js -importcfg /usr/bin/git -s -w -buildmode=exe git (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login it/ref/tags/v5 -tests (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[plan] Add oneOf constraints for mutually exclusive field pairs</issue_title>
<issue_description>## Objective

Add JSON Schema oneOf constraints to prevent mutually exclusive fields from being specified together.

Context

Currently, the schema allows users to specify both branches and branches-ignore, or both paths and paths-ignore, which the compiler correctly rejects. Users only discover this error at compile time instead of during editing.

Field Pairs to Constrain

1. branches vs branches-ignore (in on.push and on.pull_request)
2. paths vs paths-ignore (in on.push and on.pull_request)
3. slash_command vs label events (in on)
4. command vs label events (in on)
5. MCP command vs container (in tools.(tool))

Approach

For each pair, add a oneOf constraint that ensures only one can be present:

{
  "oneOf": [
    {
      "required": ["branches"],
      "not": { "required": ["branches-ignore"] }
    },
    {
      "required": ["branches-ignore"],
      "not": { "required": ["branches"] }
    },
    {
      "not": {
        "anyOf": [
          { "required": ["branches"] },
          { "required": ["branches-ignore"] }
        ]
      }
    }
  ]
}

Files to Modify

• pkg/parser/schemas/frontmatter.json - Main schema file
• After changes, run make build to rebuild with embedded schema

Acceptance Criteria

• Schema rejects YAML with both branches and branches-ignore
• Schema rejects YAML with both paths and paths-ignore
• Schema rejects slash_command with label events
• Schema rejects command with label events
• Schema rejects MCP configs with both command and container
• Existing valid configurations still pass validation
• Error messages clearly indicate mutual exclusivity

Testing

Create test workflows with invalid combinations and verify schema validation catches them before compile.
Related to #7575

AI generated by Plan Command for discussion #7569

Comments on the Issue (you are @copilot in this section)

• Fixes [plan] Add oneOf constraints for mutually exclusive field pairs #7576

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.