fix: validate workflow steps after environment substitution

[Shubham-Padkonde]

Workflow steps are currently validated before environment variables are expanded. This lets invalid final names through: a literal fetch step and a ${STEP_NAME} step are accepted even when STEP_NAME=fetch. At runtime their outputs share the same StepContext key. An empty expanded name is also accepted, while valid variable-based command and on_error values are rejected prematurely.

Substitute environment variables before applying structural validation and duplicate-name checks. Deferred ${steps.*} references retain their existing behavior.

Five regression cases fail before the change and pass afterward. The complete suite passes on Windows/Python 3.13: 188 passed, 3 skipped. Ruff 0.5.5 (the project's declared version) and git diff --check pass for the changed files.

Prepared with Codex assistance.

Summary by CodeRabbit

• Bug Fixes
  • Workflow steps now substitute environment variables before validation, so names, commands, and error-handling settings are validated using their resolved values.
  • Missing-variable errors may appear before structural validation errors for the affected step.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: c76fd906-4bbb-4987-84b2-fb4c955358fb

📥 Commits

Reviewing files that changed from the base of the PR and between 3701c23 and 81564e5.

📒 Files selected for processing (2)

• databusclient/workflow/parser.py
• tests/test_workflow_parser.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Workflow parsing now substitutes environment variables in each raw step before validating it. Tests cover validation of substituted names and commands, parsing a substituted on_error value, and preserving an empty-braces token in a URI.

Changes

Workflow step substitution and validation

Layer / File(s)	Summary
Substitute raw steps and validate resulting values databusclient/workflow/parser.py, tests/test_workflow_parser.py	parse_workflow substitutes each raw step before validation. Tests cover duplicate and empty substituted names, valid and invalid substituted commands, and a substituted on_error value. The empty-braces URI assertion remains in place.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 81564

The workflow validation change is ready to merge after normal checks.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to 81564

Workflow variables can now select operations and failure behavior. Allowed-command checks and credential requirements remain, but the trust level of variables supplied to workflows is not established.

Retained concerns

• Medium · security · inferred: When a workflow delegates command or on_error to an environment variable, the variable supplier can now choose an allowed operation or failure policy. This matters if that supplier is less trusted than the workflow author; whether that separation exists in deployment is unresolved.

Security review details

Security Blast Radius

• inferred — The newly delegated operation choice is bounded by the command allowlist and, for deletion, the API key and target URIs available to that workflow run. The evidence does not establish exposure across other users, tenants, or deployments.

Security Findings and Attack Paths

• inferred — If an actor can set a referenced command variable but cannot change the trusted workflow file, the actor can now select an allowed command, potentially including delete when the required targets and credential are present. Attacker control of such variables is not established.

Trust Boundaries and Controls

• observed — Expanded commands and error policies still pass parser allowlists. The engine rejects unregistered commands, and the delete adapter requires an API key and targets; the available evidence does not define who controls workflow environment variables.

Hardening Proposals

• proposed — Where environment variables can be supplied by a less-trusted party, treat command and error-policy substitutions as privileged configuration: restrict their provenance or explicitly authorize the resulting operation before execution.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the problem, solution, affected behavior, regression coverage, and test results. It does not follow the repository template because it omits the required section headings, rel…	Reformat the description with the repository template. Add the Description, Related Issues, Type of change, and Checklist sections. Select the applicable change type and confirm the relevant checklist items, including test and lint results.
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: validating workflow steps after environment substitution.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the problem, solution, affected behavior, regression coverage, and test results. It does not follow the repository template because it omits the required section headings, related-issue entry, selected change type, and checklist confirmations.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}