Add validation for safe-outputs.allowed-domains

[Copilot]

Implements validation for domain patterns in safe-outputs.allowed-domains configuration to catch malformed domains at compile time.

Changes

• Validation logic (pkg/workflow/safe_outputs_domains_validation.go)

  • Validates plain domains (github.com) and wildcard patterns (*.github.com)
  • Rejects invalid patterns: multiple wildcards, misplaced wildcards, special characters, malformed syntax
  • Returns actionable error messages with examples
  • Uses comprehensive regex pattern for domain validation

• Compiler integration (pkg/workflow/compiler.go)

  • Added validation call in CompileWorkflowData() after sandbox validation
  • Errors formatted consistently with existing compilation errors

• Test coverage (pkg/workflow/safe_outputs_domains_validation_test.go)

  • 240+ test cases covering valid/invalid patterns and edge cases
  • Integration tests with realistic workflow configurations
  • Comprehensive regex validation tests (60+ cases) covering:
    • Valid patterns: plain domains, wildcards, numbers, hyphens, case variations, length limits
    • Invalid patterns: special characters, dot placement errors, wildcard position rules, hyphen placement rules
    • Edge cases: 63-character labels, single-label domains, IP-like formats, multiple nesting levels

• JavaScript wildcard tests (actions/setup/js/sanitize_content.test.cjs)

  • Added comprehensive tests for wildcard domain pattern matching in JavaScript sanitization
  • Verifies existing wildcard support in sanitize_content_core.cjs works correctly with patterns like *.example.com
  • Tests confirm wildcard, base domain, and mixed configuration scenarios

Example

Valid configuration:

safe-outputs:
  allowed-domains:
    - github.com
    - "*.githubusercontent.com"
    - api.example.com

Error for invalid pattern:

error: safe-outputs.allowed-domains[1]: domain pattern '*.*.github.com' contains multiple wildcards, only one wildcard at the start is allowed (e.g., '*.example.com')

[!WARNING]

Original prompt

Add support for safe-outputs.allowed-domain validation.

safe-outputs:
   allowed-domain:
      - *.github.com

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[pelikhan]

@copilot add support in the javascript secret redaction code to also support the wildcards and filter domains accordingly.

[pelikhan]

@copilot apply

[Copilot]

@copilot add support in the javascript secret redaction code to also support the wildcards and filter domains accordingly.

The JavaScript sanitization code already has wildcard support implemented in sanitize_content_core.cjs (lines 210-214). I've added comprehensive tests in commit 9bb3125 to verify wildcard patterns like *.github.com work correctly with domain filtering and redaction.

The tests confirm:

• Wildcard patterns (*.example.com) match subdomains correctly
• Base domain is allowed when using wildcard patterns
• Mixed wildcard and plain domains work together
• Non-matching domains are properly redacted