Reduce EnforceSafeUpdate parameter count with options struct

[Copilot]

golint-custom flagged two function-signature findings: extractNestedYAMLValue exceeding the 60-line limit, and EnforceSafeUpdate exceeding the 8-parameter limit.

extractNestedYAMLValue (pkg/parser/schema_suggestions.go)

Already resolved by a prior change — buildNestedYAMLScalarMatchers and extractNestedYAMLScalar helpers have already been extracted, leaving the function at 55 lines. No further action needed here.

EnforceSafeUpdate (pkg/workflow/safe_update_enforcement.go)

Grouped the four pull_request/pull_request_target boolean flags into a new PullRequestEventTransition struct, bringing the function from 9 parameters down to 6:

type PullRequestEventTransition struct {
	OldHasPullRequest           bool
	OldHasPullRequestTarget     bool
	CurrentHasPullRequest       bool
	CurrentHasPullRequestTarget bool
}

func EnforceSafeUpdate(manifest *GHAWManifest, secretNames []string, actionRefs []string,
	currentRedirect string, prTransition PullRequestEventTransition,
	currentMemoryValidationScripts []GHAWManifestMemoryValidationScript) error

• Updated the sole production call site in compiler.go to construct the struct.
• Updated direct test call sites in safe_update_enforcement_test.go and compiler_threat_detection_formal_test.go.
• No behavioral changes — escalation detection logic (hasPullRequestTargetEscalation) is unchanged, just reads from the new struct fields.

• Fixes [lint-monster] parser helper function-length cleanup #52405

---

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 8.93 AIC · ⌖ 7.92 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

🧪 Test quality analysis by Test Quality Sentinel

[github-actions]

✅ Ponytail Reviewer completed successfully!

Ponytail review: PR #52614 groups 4 related bool params into a PullRequestEventTransition struct to satisfy the 8-parameter lint limit. Single call site, no speculative abstraction, no added dependencies. Lean already. Ship.

Generated by Ponytail Reviewer for #52614

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

[github-actions]

✅ PR Code Quality Reviewer completed the code quality review.

Completed PR review for #52614; no actionable changed-line issues found, so no review comments or review submission were emitted.

🔎 Code quality review by PR Code Quality Reviewer

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR #52614 does not have the 'implementation' label and has only 38 new lines of code in business logic directories (threshold is 100).

🏗️ ADR gate enforced by Design Decision Gate 🏗️

[Copilot]

Pull request overview

Refactors safe-update enforcement to satisfy parameter-count linting without changing behavior.

Changes:

• Adds PullRequestEventTransition to group event-state flags.
• Updates production and test call sites to use the struct.
• Preserves pull-request-target escalation detection.

Show a summary per file

File	Description
pkg/workflow/safe_update_enforcement.go	Introduces the transition struct and updates enforcement.
pkg/workflow/compiler.go	Constructs the transition at the production call site.
pkg/workflow/safe_update_enforcement_test.go	Updates direct unit-test calls.
pkg/workflow/compiler_threat_detection_formal_test.go	Updates formal security-test calls.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

Clean refactor. Replacing four positional bool parameters with a named PullRequestEventTransition struct improves readability and eliminates the risk of argument-order bugs. All call sites and tests are updated consistently, and the zero value of the struct correctly maps to false, false, false, false. No issues found.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 15.4 AIC · ⌖ 9.86 AIC · ⊞ 5.4K

[github-actions]

Skills-Based Review 🧠

Applied /codebase-design — approving. The refactor is clean and well-scoped.

📋 Key Themes & Highlights

Positive Highlights

• ✅ PullRequestEventTransition is well-named, uses the project's domain language, and is clearly documented with a godoc comment explaining the privilege-escalation intent
• ✅ All call sites (production + tests) updated consistently — no drift between the new struct and the old positional booleans
• ✅ Zero behavioural change: hasPullRequestTargetEscalation logic unchanged, struct fields map 1:1
• ✅ Formal tests correctly use the zero-value PullRequestEventTransition{} for non-escalation scenarios, preserving their original specification intent

Minor Observation (non-blocking)

EnforceSafeUpdate is now at 6 parameters. If future work adds more groups, the remaining positional args (secretNames, actionRefs, currentRedirect, currentMemoryValidationScripts) could benefit from a wider options struct — but that is out of scope here.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 19.3 AIC · ⌖ 9.44 AIC · ⊞ 7K
_{Comment /matt to run again}

[github-actions]

🧪 Test Quality Sentinel Report

✅ Test Quality Score: 93/100 — Excellent

Analyzed 13 modified test(s): 13 design, 0 implementation, 0 violation(s).

📊 Metrics (13 tests)

Metric	Value
Analyzed	13 (Go: 13, JS: 0)
✅ Design	13 (100%)
⚠️ Implementation	0 (0%)
Edge/error coverage	10 (77%)
Duplicate clusters	0
Inflation	No
🚨 Violations	0

Test	File	Classification	Issues
TestFormal_CTR016_NilManifestSkipsEnforcement	compiler_threat_detection_formal_test.go	design_test / high_value	None
TestFormal_CTR016_EmptyManifestRejectsNewSecret	compiler_threat_detection_formal_test.go	design_test / high_value	None
TestFormal_CTR016_GitHubTokenExempt_BareForm	compiler_threat_detection_formal_test.go	design_test / high_value	None
TestFormal_CTR016_GitHubTokenExempt_PrefixedForm	compiler_threat_detection_formal_test.go	design_test / high_value	None
TestFormal_CTR016_GhAwInternalSecretExempt	compiler_threat_detection_formal_test.go	design_test / high_value	None
TestFormal_CTR016_SecretPrefixNormalization	compiler_threat_detection_formal_test.go	design_test / high_value	None
TestFormal_CTR016_NewActionDriftRejected	compiler_threat_detection_formal_test.go	design_test / high_value	None
TestFormal_CTR016_RemovedActionDriftRejected	compiler_threat_detection_formal_test.go	design_test / high_value	None
TestFormal_CTR016_KnownActionPinUpdateAllowed	compiler_threat_detection_formal_test.go	design_test / high_value	None
TestFormal_CTR016_RedirectWhitespaceNormalization	compiler_threat_detection_formal_test.go	design_test / high_value	None
TestFormal_CTR016_RedirectChangeRejected	compiler_threat_detection_formal_test.go	design_test / high_value	None
TestEnforceSafeUpdate (table-driven)	safe_update_enforcement_test.go	design_test / high_value	None
TestMemoryValidationScriptChangesRequireSafeUpdateReview	safe_update_enforcement_test.go	design_test / high_value	None

Notes

All 13 test changes are pure mechanical call-site refactors — replacing 4 positional boolean parameters (oldHasPR, oldHasPRTarget, currentHasPR, currentHasPRTarget) with the new PullRequestEventTransition{} struct. No behavioral logic was added, removed, or altered in any test. The underlying tests continue to enforce security contracts (secret approval, action drift, redirect changes, PR event escalation) with clear require.Error / require.ErrorContains / require.NoError assertions.

No new test functions were introduced. The test-to-production line ratio is ≈1:1 (19 added test lines, 19 added production lines) — no inflation.

Verdict

✅ Passed. 0% implementation tests (threshold: 30%). No violations. Call-site refactor preserves full behavioral coverage.

🧪 Test quality analysis by Test Quality Sentinel · sonnet46 · 36.3 AIC · ⌖ 8.36 AIC · ⊞ 7.6K · ◷
_{Comment /review to run again}

[github-actions]

✅ Test Quality Sentinel: 93/100. 0% implementation tests (threshold: 30%).

[github-actions]

Triage: refactor / risk: low

Score: 34/100 (impact+urgency+quality) · Priority: low · Action: batch_review · Batch: lint-cleanup-cluster

Reduces EnforceSafeUpdate parameter count via options struct (golint-custom finding). CI green.

_{Automated PR triage — see full report issue for details.}

Generated by 🔧 PR Triage Agent · auto · 48.2 AIC · ⌖ 2.57 AIC · ⊞ 7.8K · ◷

[github-actions]

PR Triage\n\n- Category: refactor\n- Risk: low\n- Priority: medium\n- Score: 58/100 (impact 25 + urgency 15 + quality 18)\n- Recommended action: auto_merge\n

Generated by 🔧 PR Triage Agent · auto · 62.8 AIC · ⌖ 2.76 AIC · ⊞ 7.8K · ◷

[github-actions]

PR Triage

• Category: refactor
• Risk: low
• Priority: medium (score: 43/100)
• Score breakdown: impact 15/50, urgency 10/30, quality 18/20
• Recommended action: auto_merge

Automated triage by PR Triage Agent.

Generated by 🔧 PR Triage Agent · auto · 64.3 AIC · ⌖ 2.94 AIC · ⊞ 7.8K · ◷

[github-actions]

PR Triage

Category: refactor  |  Risk: low  |  Score: 41/100

Score breakdown

• Impact: 15/50
• Urgency: 8/30
• Quality: 18/20

Recommended action: auto_merge

Small refactor, 3 approvals, CI green — safe to auto-merge.

Generated by 🔧 PR Triage Agent · auto · 68.2 AIC · ⌖ 10.7 AIC · ⊞ 7.8K · ◷

[gh-aw-bot]

@copilot Quick triage for maintainer-ready follow-up:
Please refresh the branch if needed, address the remaining maintainer-facing follow-up, and run the pr-finisher skill before handing this PR back to maintainers.

Outstanding review items (newest first):

No unresolved review threads were available from the current compact context; please verify the latest reviewer expectations and prepare this PR for maintainer handoff.

Failed checks from the compact candidate set:

None listed.

Branch update was requested automatically for this run when GitHub allows it.
Run context: https://github.com/github/gh-aw/actions/runs/31868311850

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 8.93 AIC · ⌖ 7.92 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot Quick triage for maintainer-ready follow-up:
Please refresh the branch if needed, address the remaining maintainer-facing follow-up, and run the pr-finisher skill before handing this PR back ...

Handled in 61d76fd3ae. Branch already contains current origin/main, no unresolved review threads were returned, and no code changes were needed. Local validation passed (make fmt, make lint, make test-unit, make test, make recompile, and make agent-report-progress). Secret scan found no secrets in the changed files.

[github-actions]

PR Triage

Category: refactor | Risk: low | Score: 68/100

• Impact: 15/50 (lint-only signature refactor, no behavior change)
• Urgency: 18/30 (unblocks golint-custom CI gate)
• Quality: 20/20 (small diff, all reviews APPROVED)

Recommended action: auto_merge
Pure parameter-count lint fix with full approval. Safe to merge once CI is confirmed green. Batched with #52817 (lint-cleanup-cluster).

Generated by 🔧 PR Triage Agent · auto · 46.6 AIC · ⌖ 2.63 AIC · ⊞ 8.1K · ◷

[gh-aw-bot]

@copilot Quick triage for maintainer-ready follow-up:

Please refresh the branch if needed, address the remaining maintainer-facing follow-up, and run the pr-finisher skill before handing this PR back to maintainers.

Outstanding review items (newest first):

• confirm this lint-only refactor is still maintainer-ready on the current head and no follow-up remains
• refresh the branch if needed, then run pr-finisher before handoff

Failed checks from the compact candidate set:

• None listed.

Branch update was requested automatically for this run when GitHub allows it.
Run context: https://github.com/github/gh-aw/actions/runs/31870657040

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 14.7 AIC · ⌖ 7.13 AIC · ⊞ 6.3K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot Quick triage for maintainer-ready follow-up:

Please refresh the branch if needed, address the remaining maintainer-facing follow-up, and run the pr-finisher skill before handing this PR ba...

Confirmed on current head 61d76fd3ae: branch contains current origin/main, no unresolved review threads were returned, and no follow-up changes are needed. Local validation passed (make fmt, make lint, make test-unit, make test, make recompile, and make agent-report-progress). Secret scan found no secrets in the changed files.