Add compile-time validation for runtime-import expressions

[Copilot]

Runtime-import files were only validated at runtime, allowing workflows with invalid expressions to pass compilation and fail later during execution.

Changes

Expression validation (pkg/workflow/expression_validation.go):

• extractRuntimeImportPaths() - Extracts file paths from {{#runtime-import filepath}} syntax, filtering out URLs
• validateRuntimeImportFiles() - Reads imported files and validates expressions against the allowed list at compile time

Compiler integration (pkg/workflow/compiler.go):

• Added validation step after main markdown validation, before YAML generation
• Resolves workspace directory from workflow path to locate imported files

Test coverage (pkg/workflow/runtime_import_validation_test.go):

• Path extraction with various formats and edge cases
• Validation with safe/unsafe expressions, optional imports, non-existent files
• Compiler integration tests

Example

With a shared file containing unsafe expressions:

<!-- .github/shared/instructions.md -->
Token: ${{ secrets.GITHUB_TOKEN }}
Runner: ${{ runner.os }}

Compilation now fails early:

✗ test-workflow.md:1:1: error: runtime-import files contain expression errors:

./shared/instructions.md: unauthorized expressions:
  - secrets.GITHUB_TOKEN
  - runner.os

Previously this would compile successfully and fail at runtime.

Note: This PR only supports the {{#runtime-import}} macro syntax. The @./path inline syntax was removed from the main branch and is not supported.

Original prompt

The compiler should do a sanity validation of runtime-imports files at compile time to catch "existing" issues. Validate that expressions are in the allowed list.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[pelikhan]

@copilot merge main and handle the removal of @ syntax

[Copilot]

@copilot merge main and handle the removal of @ syntax

Done! Merged main and removed @ inline syntax support from the validation code and tests. Commit 972f35f.