fix: validate workflow steps after environment substitution

[Shubham-Padkonde]

Pull Request

Description

Workflow steps are currently validated before environment variables are expanded. This lets invalid final names through: a literal fetch step and a ${STEP_NAME} step are accepted even when STEP_NAME=fetch. At runtime their outputs share the same StepContext key. An empty expanded name is also accepted, while valid variable-based command and on_error values are rejected prematurely.

Substitute environment variables before applying structural validation and duplicate-name checks. Deferred ${steps.*} references retain their existing behavior.

Five regression cases fail before the change and pass afterward. The complete suite passes on Windows/Python 3.13: 188 passed, 3 skipped. Ruff 0.5.5 (the project's declared version) and git diff --check pass for the changed files.

The four new test functions now include docstrings explaining the validation invariants. After this documentation update, the complete suite again passed: 188 passed, 3 skipped. The run used Python's pytest module with a workspace temporary directory; Ruff 0.5.5 and git diff --check passed for the changed files.

Related Issues

No separate issue is linked.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• This change requires a documentation update
• Housekeeping

Checklist:

• Changed Python files pass this project's Ruff 0.5.5 checks.
• I have performed a self-review of my own code
• Regression tests include comments or docstrings explaining the behavior under test.
• I have made corresponding changes to the documentation (if applicable)
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes: 188 passed, 3 skipped.
  • poetry run pytest - not run; the equivalent Python module invocation is reported above.
  • poetry run ruff check - not run; Ruff 0.5.5 was invoked directly for the changed Python files.

Prepared with Codex assistance. The personal self-review checkbox remains for the author to complete.

Summary by CodeRabbit

• Bug Fixes
  • Workflow steps now substitute environment variables before validation, so names, commands, and error-handling settings are validated using their resolved values.
  • Missing-variable errors may appear before structural validation errors for the affected step.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: a8327c6a-5d94-4ec3-a9cb-3dd191224cad

📥 Commits

Reviewing files that changed from the base of the PR and between 81564e5 and d0c1a7e.

📒 Files selected for processing (1)

• tests/test_workflow_parser.py

🚧 Files skipped from review as they are similar to previous changes (1)

• tests/test_workflow_parser.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Workflow parsing now substitutes environment variables in each raw step before validating it. Tests cover validation of substituted names and commands, a substituted on_error value, and an empty-braces token in a URI.

Changes

Workflow step substitution and validation

Layer / File(s)	Summary
Substitute raw steps and validate resulting values databusclient/workflow/parser.py, tests/test_workflow_parser.py	parse_workflow substitutes each raw step before validation. Tests cover duplicate and empty substituted names, valid and invalid substituted commands, and a substituted on_error value. The empty-braces URI assertion remains in place.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to d0c1a

The reviewed workflow changes have no identified merge-blocking issue. Normal checks remain appropriate.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to 81564

Workflow variables can now select operations and failure behavior. Allowed-command checks and credential requirements remain, but the trust level of variables supplied to workflows is not established.

Retained concerns

• Medium · security · inferred: When a workflow delegates command or on_error to an environment variable, the variable supplier can now choose an allowed operation or failure policy. This matters if that supplier is less trusted than the workflow author; whether that separation exists in deployment is unresolved.

Security review details

Security Blast Radius

• inferred — The newly delegated operation choice is bounded by the command allowlist and, for deletion, the API key and target URIs available to that workflow run. The evidence does not establish exposure across other users, tenants, or deployments.

Security Findings and Attack Paths

• inferred — If an actor can set a referenced command variable but cannot change the trusted workflow file, the actor can now select an allowed command, potentially including delete when the required targets and credential are present. Attacker control of such variables is not established.

Trust Boundaries and Controls

• observed — Expanded commands and error policies still pass parser allowlists. The engine rejects unregistered commands, and the delete adapter requires an API key and targets; the available evidence does not define who controls workflow environment variables.

Hardening Proposals

• proposed — Where environment variables can be supplied by a less-trusted party, treat command and error-policy substitutions as privileged configuration: restrict their provenance or explicitly authorize the resulting operation before execution.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 2 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: validating workflow steps after environment substitution.
Description check	✅ Passed	The description covers the change, related issues, change type, regression tests, test results, linting, and documentation status. The self-review checkbox remains unchecked, but this is a non-critica…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}