[plan] Implement compiler validation for filter mutual exclusivity

[github-actions]

Objective

Add compiler-level validation to detect and reject workflows that use both branches/branches-ignore or paths/paths-ignore together, matching GitHub Actions requirements.

Context

GitHub Actions rejects workflows that specify both branches and branches-ignore (or both paths and paths-ignore) in the same event filter. Currently gh-aw allows these invalid configurations to compile, leading to runtime failures in GitHub Actions.

This issue implements the runtime validation that complements the schema documentation added in #5804.

Approach

Add validation logic in the compiler to check for mutual exclusivity violations in push and pull_request event filters.

Files to Modify

• Update: pkg/workflow/compiler.go (add validation function)
• Update: pkg/parser/schema.go (or create new validator if preferred)
• Create: pkg/workflow/compiler_filters_test.go (test coverage)

Implementation

1. Add Validation Function

// ValidateEventFilters checks for GitHub Actions filter mutual exclusivity rules
func ValidateEventFilters(frontmatter map[string]any) error {
 on, exists := frontmatter["on"]
 if !exists {
 return nil
 }
 
 onMap, ok := on.(map[string]any)
 if !ok {
 return nil
 }
 
 // Check push event
 if pushVal, exists := onMap["push"]; exists {
 if err := validateFilterExclusivity(pushVal, "push"); err != nil {
 return err
 }
 }
 
 // Check pull_request event
 if prVal, exists := onMap["pull_request"]; exists {
 if err := validateFilterExclusivity(prVal, "pull_request"); err != nil {
 return err
 }
 }
 
 return nil
}

func validateFilterExclusivity(eventVal any, eventName string) error {
 eventMap, ok := eventVal.(map[string]any)
 if !ok {
 return nil
 }
 
 // Check branches/branches-ignore
 if _, hasBranches := eventMap["branches"]; hasBranches {
 if _, hasIgnore := eventMap["branches-ignore"]; hasIgnore {
 return fmt.Errorf("%s event cannot specify both 'branches' and 'branches-ignore' - they are mutually exclusive per GitHub Actions requirements", eventName)
 }
 }
 
 // Check paths/paths-ignore
 if _, hasPaths := eventMap["paths"]; hasPaths {
 if _, hasIgnore := eventMap["paths-ignore"]; hasIgnore {
 return fmt.Errorf("%s event cannot specify both 'paths' and 'paths-ignore' - they are mutually exclusive per GitHub Actions requirements", eventName)
 }
 }
 
 return nil
}

2. Call Validation

Add call in compiler's validation chain (around existing event validation):

// In CompileWorkflow or validateWorkflow function
if err := ValidateEventFilters(frontmatter); err != nil {
 return err
}

3. Add Tests

Create comprehensive test coverage for all cases:

func TestValidateEventFilters(t *testing.T) {
 tests := []struct {
 name string
 frontmatter map[string]any
 wantErr bool
 }{
 {
 name: "valid branches only",
 frontmatter: map[string]any{
 "on": map[string]any{
 "push": map[string]any{
 "branches": []string{"main"},
 },
 },
 },
 wantErr: false,
 },
 {
 name: "invalid both branches and branches-ignore",
 frontmatter: map[string]any{
 "on": map[string]any{
 "push": map[string]any{
 "branches": []string{"main"},
 "branches-ignore": []string{"dev"},
 },
 },
 },
 wantErr: true,
 },
 // Add similar tests for paths/paths-ignore, pull_request event, etc.
 }
 
 for _, tt := range tests {
 t.Run(tt.name, func(t *testing.T) {
 err := ValidateEventFilters(tt.frontmatter)
 if (err != nil) != tt.wantErr {
 t.Errorf("ValidateEventFilters() error = %v, wantErr %v", err, tt.wantErr)
 }
 })
 }
}

Acceptance Criteria

• Validation function added to compiler
• Both branches/branches-ignore and paths/paths-ignore conflicts detected
• Both push and pull_request events validated
• Clear error messages using console.FormatErrorMessage
• Comprehensive test coverage in new test file
• Tests pass: make test-unit
• No regressions: make test

Testing

# Rebuild and test
make build
make test-unit

# Manual validation
echo '---
on:
 push:
 branches: [main]
 branches-ignore: [dev]
---
Test' > /tmp/test-invalid.md

./gh-aw compile /tmp/test-invalid.md # Should fail with clear error

echo '---
on:
 pull_request:
 paths: ["src/**"]
 paths-ignore: ["docs/**"]
---
Test' > /tmp/test-invalid2.md

./gh-aw compile /tmp/test-invalid2.md # Should fail with clear error

echo '---
on:
 push:
 branches: [main]
---
Test' > /tmp/test-valid.md

./gh-aw compile /tmp/test-valid.md # Should succeed

Notes

• Follow the example of existing validation in pkg/parser/schema.go (e.g., IsLabelOnlyEvent)
• Use console.FormatErrorMessage for error output
• Consider adding this to the strict mode validation path as well
  Related to [plan] Fix schema validation gaps from conditional logic analysis #5804

AI generated by Plan Command for discussion #5799