[m] feat(task): enforce task-batch payload schema validation at runtime boundaries by jaeko44 · Pull Request #435 · virtengine/bosun

jaeko44 · 2026-03-25T17:04:39Z

Task-ID: cc3da1b7-6df6-4a5d-9f9c-8175b3dfd07b\n\nAutomated PR for task cc3da1b7-6df6-4a5d-9f9c-8175b3dfd07b

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-03-25T17:04:50Z

Bosun CI signal: Bosun-created PR currently has failing checks.

Automation scope: Bosun-created
Workflow: CI
Conclusion: failure
Run: https://github.com/virtengine/bosun/actions/runs/23598723095
Head SHA: 7b48118
Failed jobs: Build + Tests

Copilot

Pull request overview

This PR aims to add runtime schema validation for “task-batch” payloads at workflow/CLI boundaries so malformed batch items fail fast with deterministic errors and log-friendly summaries.

Changes:

Added validateTaskBatchPayload() and summarizeTaskBatchPayloadForLog() helpers to normalize/validate task-batch items.
Updated task-batch workflow templates to validate the generated batch payload before emitting JSON to downstream nodes.
Added tests intended to cover validator behavior and CLI rejection of invalid payload files.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 8 comments.

File	Description
workflow-templates/task-batch.mjs	Introduces task-batch payload validation helpers and attempts to enforce validation inside workflow `node -e` payload generation.
task/task-cli.mjs	Attempts to validate/import task-batch payloads at the CLI boundary and adds a `cliCreateBatch()` helper.
tests/workflow-templates.test.mjs	Adds tests for the new payload validator (but currently has parsing/import issues).
tests/task-cli.test.mjs	Adds a spawn-based CLI test for invalid task-batch payload files (but currently targets an unrouted subcommand and is not isolated).

Comments suppressed due to low confidence (1)

tests/workflow-templates.test.mjs:26

The import statement at the top of this test file is invalid (} from \ followed by a new import { ... }), which will make the test suite fail to parse. Restore the correct module specifier for the ../workflow/workflow-templates.mjs import so the file compiles.

  relayoutInstalledTemplateWorkflows,
  installTemplate,
  installTemplateSet,
} from \
import {
  WorkflowEngine,
  getNodeType,
  registerNodeType,
} from "../workflow/workflow-engine.mjs";

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-25T17:11:09Z

workflow-templates/task-batch.mjs

+            const { validateTaskBatchPayload, summarizeTaskBatchPayloadForLog } = await import(pathToFileURL(path.join(repoRoot, "workflow-templates", "task-batch.mjs")).href);
+            try {
+              console.log(JSON.stringify(validateTaskBatchPayload(payload)));
+            } catch (error) {


The List Todo Tasks node -e snippet in TASK_BATCH_PR_TEMPLATE appears syntactically broken: the batch.map(...) call isn't closed correctly, payload is referenced but never defined, and await import(...) is used in a non-async .then(tasks => { ... }) callback. This will prevent the workflow from producing JSON output for parseJson: true and likely fail at runtime; restructure to build payload, validate it, then console.log(JSON.stringify(validated)) in a valid async flow.

Copilot · 2026-03-25T17:11:09Z

task/task-cli.mjs

 import { readFileSync, existsSync, statSync } from "node:fs";
 import { randomUUID } from "node:crypto";
-import { getTaskLifetimeTotals } from "../infra/runtime-accumulator.mjs";
+import { getTaskLifetimeTotals } from \


This import is syntactically incomplete (import { getTaskLifetimeTotals } from \), so task-cli.mjs will not parse. Restore the full module specifier for getTaskLifetimeTotals.

Suggested change

import { getTaskLifetimeTotals } from \

import { getTaskLifetimeTotals } from "./task-stats.mjs";

Copilot · 2026-03-25T17:11:10Z

tests/task-cli.test.mjs

+describe("task-cli task batch payload validation", () => {
+  it("rejects malformed task-batch payload files with deterministic errors", () => {
+    const payloadPath = resolve(tempDirs[tempDirs.length - 1] ?? mkdtempSync(resolve(tmpdir(), "bosun-task-cli-")), "task-batch-invalid.json");
+    writeFileSync(payloadPath, JSON.stringify([{ taskId: "", repository: "virtengine/bosun", workspace: "virtengine-gh" }]), "utf8");

+    const result = spawnSync(
+      process.execPath,
+      ["task/task-cli.mjs", "create-batch", "--payload-file", payloadPath],
+      {
+        cwd: process.cwd(),
+        env: { ...process.env },
+        encoding: "utf8",
+      },
+    );
+
+    expect(result.status).not.toBe(0);
+    expect(result.stderr).toContain(
+      "Invalid task-batch payload: item[0].taskId must be a non-empty string",
+    );
+    expect(result.stderr).toContain('summary={"type":"array","count":1,"taskIds":[]}');
+  });


This test spawns task/task-cli.mjs create-batch ... but the CLI router currently has no create-batch subcommand, so the expected validation error message won't be produced. Also, the spawned process inherits the real environment without setting BOSUN_STORE_PATH, which risks reading/writing a real user store; set BOSUN_STORE_PATH to a temp path (and ensure any temp dir created here is tracked in tempDirs for cleanup).

Copilot · 2026-03-25T17:11:10Z

task/task-cli.mjs

+  try {
+    tasks = validateTaskBatchPayload(tasks).map((item) => ({
+      id: item.taskId,
+      title: item.taskTitle,
+      status: item.status,
+      branch: item.branch,
+      scope: item.scope,
+      repository: item.repository,
+      workspace: item.workspace,
+    }));
+  } catch (error) {
+    if (typeof source === "string") {
+      const summary = summarizeTaskBatchPayloadForLog(tasks);
+      throw new Error(`${error.message}; summary=${JSON.stringify(summary)}`);
+    }
+    throw error;


This change makes taskImport() enforce the task-batch payload schema (taskId, taskTitle, etc.) and remaps it into tasks. That is a breaking change for the existing bosun task import command, whose help text and historical behavior accept regular task objects (e.g. { title, description, ... }) without IDs. Consider scoping task-batch validation to a separate create-batch/import-batch path, or supporting both schemas (detect which shape is provided) to preserve backwards compatibility.

Suggested change

try {

tasks = validateTaskBatchPayload(tasks).map((item) => ({

id: item.taskId,

title: item.taskTitle,

status: item.status,

branch: item.branch,

scope: item.scope,

repository: item.repository,

workspace: item.workspace,

}));

} catch (error) {

if (typeof source === "string") {

const summary = summarizeTaskBatchPayloadForLog(tasks);

throw new Error(`${error.message}; summary=${JSON.stringify(summary)}`);

}

throw error;

// Support both legacy plain task objects and new task-batch payloads.

// Detect batch-like payloads (with taskId/taskTitle fields) and only then

// apply batch validation + remapping to preserve backwards compatibility.

const looksLikeBatchPayload =

Array.isArray(tasks) &&

tasks.length > 0 &&

tasks.every(

(item) =>

item &&

typeof item === "object" &&

("taskId" in item || "taskTitle" in item),

);

if (looksLikeBatchPayload) {

try {

tasks = validateTaskBatchPayload(tasks).map((item) => ({

id: item.taskId,

title: item.taskTitle,

status: item.status,

branch: item.branch,

scope: item.scope,

repository: item.repository,

workspace: item.workspace,

}));

} catch (error) {

if (typeof source === "string") {

const summary = summarizeTaskBatchPayloadForLog(tasks);

throw new Error(`${error.message}; summary=${JSON.stringify(summary)}`);

}

throw error;

}

Copilot · 2026-03-25T17:11:10Z

tests/workflow-templates.test.mjs

+describe("task batch payload validation", () => {
+  it("accepts a valid minimal batch item", () => {
+    const payload = [
+      {
+        taskId: "task-123",
+        taskTitle: "Ship validation",
+        status: "todo",
+        repository: "virtengine/bosun",
+        workspace: "virtengine-gh",
+        branch: "task/123",
+        scope: "workflow",
+      },
+    ];
+
+    expect(validateTaskBatchPayload(payload)).toEqual(payload);
+  });


validateTaskBatchPayload is used in these new tests but is not imported anywhere in this file, so the tests will throw ReferenceError. Add an explicit import (e.g. from workflow-templates/task-batch.mjs) or otherwise bring the validator into scope.

Copilot · 2026-03-25T17:11:11Z

task/task-cli.mjs

+  try {
+    tasks = validateTaskBatchPayload(tasks).map((item) => ({
+      id: item.taskId,
+      title: item.taskTitle,
+      status: item.status,
+      branch: item.branch,
+      scope: item.scope,
+      repository: item.repository,
+      workspace: item.workspace,
+    }));
+  } catch (error) {
+    if (typeof source === "string") {
+      const summary = summarizeTaskBatchPayloadForLog(tasks);
+      throw new Error(`${error.message}; summary=${JSON.stringify(summary)}`);
+    }
+    throw error;


validateTaskBatchPayload and summarizeTaskBatchPayloadForLog are referenced here but are not defined or imported anywhere in task-cli.mjs, so taskImport() will throw a ReferenceError at runtime. Import these helpers (or move them into a shared module under task/) before using them.

Copilot · 2026-03-25T17:11:11Z

task/task-cli.mjs

+async function cliCreateBatch(args) {
+  const payloadFile = getArgValue(args, "--payload-file") || args.find((a) => !a.startsWith("--"));
+  if (!payloadFile) {
+    console.error("  Error: payload file required. Usage: bosun task create-batch --payload-file <path.json>");
+    process.exit(1);
+  }

+  if (!existsSync(resolve(payloadFile))) {
+    console.error(`  Error: file not found: ${payloadFile}`);
+    process.exit(1);
+  }
+
+  try {
+    const result = await taskImport(payloadFile);
+    console.log(JSON.stringify(result, null, 2));
+  } catch (err) {
+    console.error(`  Error: ${err.message}`);
+    process.exit(1);
+  }
+}


cliCreateBatch() is added but never routed from runTaskCli() (there is no case "create-batch"), so invoking task-cli.mjs create-batch ... will fall into the default help path and this code will never run. Add a router case (and help text) or remove the dead code.

Suggested change

async function cliCreateBatch(args) {

const payloadFile = getArgValue(args, "--payload-file") || args.find((a) => !a.startsWith("--"));

if (!payloadFile) {

console.error(" Error: payload file required. Usage: bosun task create-batch --payload-file <path.json>");

process.exit(1);

}

if (!existsSync(resolve(payloadFile))) {

console.error(` Error: file not found: ${payloadFile}`);

process.exit(1);

}

try {

const result = await taskImport(payloadFile);

console.log(JSON.stringify(result, null, 2));

} catch (err) {

console.error(` Error: ${err.message}`);

process.exit(1);

}

}

Copilot · 2026-03-25T17:11:11Z

workflow-templates/task-batch.mjs

+            const { validateTaskBatchPayload, summarizeTaskBatchPayloadForLog } = await import(pathToFileURL(path.join(repoRoot, "workflow-templates", "task-batch.mjs")).href);
+            try {
+              console.log(JSON.stringify(validateTaskBatchPayload(payload)));
+            } catch (error) {
+              const summary = summarizeTaskBatchPayloadForLog(payload);
+              console.error(`Invalid task-batch payload: ${error.message.replace(/^Invalid task-batch payload:\s*/, "")}; summary=${JSON.stringify(summary)}`);
+              process.exit(1);


In the node -e script, await import(...) is used inside a .then(tasks => { ... }) callback that is not async, which will cause a syntax error when the command runs. Make the callback async (or refactor to an async IIFE) before using await, so the payload validation/logging path can execute.

Files: task/task-cli.mjs

…ch-payload-schema-va

…atch-payload-schema-va

github-actions · 2026-03-26T11:46:10Z

Bosun PR classification: Bosun-created.
This PR is tracked by Bosun attachment automation.

PR class label: bosun-pr-bosun-created
Attach label: bosun-attached (yes, because Bosun-created PRs remain attached regardless of human PR attach mode)
Attach mode policy: all
Trusted author: no
Bosun-created label present: yes
Automation scope: Eligible for Bosun repair and merge automation (Bosun-created PR).
CI failure signal label: bosun-needs-fix
CI failure marker:
Trigger: pull_request_target / synchronize

…atch-payload-schema-va

Co-authored-by: bosun-ve[bot] <262908237+bosun-ve[bot]@users.noreply.github.com>

wip: save abandoned task work for task-cc3da1b76df6-daf8f02b64

4a7ba55

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings March 25, 2026 17:04

jaeko44 added the bosun-attached Bosun PR attachment marker label Mar 25, 2026

jaeko44 added the bosun-needs-fix Attached PR with failing CI that Bosun should pick up for repair label Mar 25, 2026

Copilot started reviewing on behalf of jaeko44 March 25, 2026 17:05 View session

Copilot AI reviewed Mar 25, 2026

View reviewed changes

jaeko44 removed the bosun-needs-fix Attached PR with failing CI that Bosun should pick up for repair label Mar 25, 2026

Apply 3 code review suggestions

0be8999

Files: task/task-cli.mjs

jaeko44 enabled auto-merge March 25, 2026 22:54

github-actions bot added the bosun-pr-public PR observed by Bosun but not trusted for high-risk automation label Mar 25, 2026

jaeko44 added the bosun-needs-fix Attached PR with failing CI that Bosun should pick up for repair label Mar 25, 2026

Merge origin/main into task/cc3da1b76df6-m-feat-task-enforce-task-bat…

39287ee

…ch-payload-schema-va

jaeko44 added bosun-needs-fix Attached PR with failing CI that Bosun should pick up for repair and removed bosun-needs-fix Attached PR with failing CI that Bosun should pick up for repair labels Mar 26, 2026

Merge origin/main into task/cc3da1b76df6-m-feat-task-enforce-task-bat…

54a0c59

…ch-payload-schema-va

jaeko44 added 2 commits March 26, 2026 21:09

Merge branch 'main' into task/cc3da1b76df6-m-feat-task-enforce-task-b…

231eac8

…atch-payload-schema-va

Merge branch 'main' into task/cc3da1b76df6-m-feat-task-enforce-task-b…

451b227

…atch-payload-schema-va

jaeko44 and others added 3 commits March 26, 2026 23:10

Merge branch 'main' into task/cc3da1b76df6-m-feat-task-enforce-task-b…

6f5fe58

…atch-payload-schema-va

Merge remote-tracking branch 'origin/main' into HEAD

bb3040f

Co-authored-by: bosun-ve[bot] <262908237+bosun-ve[bot]@users.noreply.github.com>

Merge remote-tracking branch 'origin/main' into HEAD

7b48118

Co-authored-by: bosun-ve[bot] <262908237+bosun-ve[bot]@users.noreply.github.com>

jaeko44 added bosun-needs-fix Attached PR with failing CI that Bosun should pick up for repair and removed bosun-needs-fix Attached PR with failing CI that Bosun should pick up for repair labels Mar 26, 2026

jaeko44 added bosun-needs-fix Attached PR with failing CI that Bosun should pick up for repair and removed bosun-needs-fix Attached PR with failing CI that Bosun should pick up for repair labels Mar 27, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[m] feat(task): enforce task-batch payload schema validation at runtime boundaries#435

[m] feat(task): enforce task-batch payload schema validation at runtime boundaries#435
jaeko44 wants to merge 9 commits intomainfrom
task/cc3da1b76df6-m-feat-task-enforce-task-batch-payload-schema-va

jaeko44 commented Mar 25, 2026

Uh oh!

github-actions bot commented Mar 25, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 25, 2026

Uh oh!

Copilot AI Mar 25, 2026

Uh oh!

Copilot AI Mar 25, 2026

Uh oh!

Copilot AI Mar 25, 2026

Uh oh!

Copilot AI Mar 25, 2026

Uh oh!

Copilot AI Mar 25, 2026

Uh oh!

Copilot AI Mar 25, 2026

Uh oh!

Copilot AI Mar 25, 2026

Uh oh!

github-actions bot commented Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	import { getTaskLifetimeTotals } from \
	import { getTaskLifetimeTotals } from "./task-stats.mjs";

Conversation

jaeko44 commented Mar 25, 2026

Uh oh!

github-actions bot commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions bot commented Mar 25, 2026 •

edited

Loading