fix(actions): reject workflow_dispatch for workflows without that trigger (#37660)

## Summary

Fixes #37528

This PR makes the workflow dispatch API reject workflows that do not
declare `workflow_dispatch`. Previously, `POST
/repos/{owner}/{repo}/actions/workflows/{workflow_id}/dispatches` could
create an `ActionRun` for a workflow that only declared another event
such as `push`.

The service now validates that the target workflow has a
`workflow_dispatch` trigger before inserting the run. The API maps that
validation failure to `422 Unprocessable Entity`, matching existing
validation failures in this handler.

The regression test creates a push-only workflow, dispatches it through
the public API, asserts the `workflow_dispatch` validation message, and
verifies that no run was inserted.

## Disclosure

Developed with assistance from OpenAI Codex.

---------

Co-authored-by: Nicolas <bircni@icloud.com>
This commit is contained in:
Jorge Ortiz
2026-05-28 16:40:43 -07:00
committed by GitHub
parent 428ee9fcce
commit 90d443b46c
3 changed files with 82 additions and 4 deletions
+2
View File
@@ -1091,6 +1091,8 @@ func ActionsDispatchWorkflow(ctx *context.APIContext) {
ctx.APIError(http.StatusNotFound, err)
} else if errors.Is(err, util.ErrPermissionDenied) {
ctx.APIError(http.StatusForbidden, err)
} else if errors.Is(err, util.ErrInvalidArgument) {
ctx.APIError(http.StatusUnprocessableEntity, err)
} else {
ctx.APIErrorInternal(err)
}