Merged
Size
S
Change Breakdown
Bug Fix80%
Security20%
#28517fix(core): Add strict input validation for `workflow()` (no-changelog)

Workflow SDK input validation tightened

The workflow builder SDK now validates inputs strictly at the API boundary—wrong types and incorrect option usage will immediately throw descriptive errors instead of silently creating malformed workflows.

The workflow builder SDK was accepting malformed inputs without complaint, allowing incorrect usage to create invalid workflows that would fail in confusing ways downstream. Strict type validation was missing at the workflow() function entry point.

Inputs are now validated before any processing occurs. The id and name parameters must be strings—if they aren't, a clear error message shows exactly what types were received. The options parameter is checked to ensure it isn't being misused to pass nodes or connections directly, since those should be added via the .add() and .to() builder methods.

This matters because clear error messages early in execution save debugging time and prevent broken workflows from propagating. The explicit guidance in each error tells developers (and AI agents using the SDK) the correct usage pattern. In the workflow SDK, improved input validation means fewer broken automations reaching production.

View Original GitHub Description

Summary

Tightening up input validation for workflow builder SDK function that should prevent wrong usage (e.g. by LLM agents hallucinating the syntax) from successfully creating invalid workflows.

Related Linear tickets, Github issues, and Community forum posts

Fixes ADO-5029 Fixes 28046

Review / Merge checklist

  • I have seen this code, I have run this code, and I take responsibility for this code.
  • PR title and summary are descriptive. (conventions) <!-- **Remember, the title automatically goes into the changelog. Use `(no-changelog)` otherwise.** -->
  • Docs updated or follow-up ticket created.
  • Tests included. <!-- A bug is not considered fixed, unless a test is added to prevent it from happening again. A feature is not complete without tests. -->
  • PR Labeled with Backport to Beta, Backport to Stable, or Backport to v1 (if the PR is an urgent fix that needs to be backported)
© 2026 · via Gitpulse