fix(workflow): tighten auto-sentinel exemption to enum-only on #2421

Previously the ``integration: auto`` exemption skipped default validation
entirely, which meant a workflow could declare an incompatible type
(e.g. ``type: number`` with ``default: "auto"``) and still pass
validation, only to fail later at runtime.

Both the install-time check in ``validate_workflow()`` and the runtime
coercion in ``_resolve_inputs()`` now exempt only the enum-membership
check for the auto sentinel; the declared type is still enforced. Adds
a regression test that asserts a ``type: number`` + ``default: "auto"``
workflow is rejected at validation time.

Author: Quratulain-bilal

src/specify_cli/workflows/engine.py

@@ -148,21 +148,30 @@ def validate_workflow(definition: WorkflowDefinition) -> list[str]:
             # default not in the declared enum, or a non-numeric default for
             # a number input) surface at install/validation time instead of
             # at workflow-execution time. ``"auto"`` for the integration
-            # input is a runtime-resolved sentinel and is exempt.
+            # input is a runtime-resolved sentinel, so only the
+            # enum-membership check is exempted for that exact case — the
+            # declared type is still enforced (e.g. ``type: number`` paired
+            # with ``default: "auto"`` is still rejected).
             if "default" in input_def:
                 default_value = input_def["default"]
                 is_auto_integration = (
                     input_name == "integration" and default_value == "auto"
                 )
-                if not is_auto_integration:
-                    try:
-                        WorkflowEngine._coerce_input(
-                            input_name, default_value, input_def
-                        )
-                    except ValueError as exc:
-                        errors.append(
-                            f"Input {input_name!r} has invalid default: {exc}"
-                        )
+                validation_input_def: dict[str, Any] = input_def
+                if is_auto_integration and "enum" in input_def:
+                    validation_input_def = {
+                        key: value
+                        for key, value in input_def.items()
+                        if key != "enum"
+                    }
+                try:
+                    WorkflowEngine._coerce_input(
+                        input_name, default_value, validation_input_def
+                    )
+                except ValueError as exc:
+                    errors.append(
+                        f"Input {input_name!r} has invalid default: {exc}"
+                    )
 
     # -- Steps ------------------------------------------------------------
     if not isinstance(definition.steps, list):
@@ -737,7 +746,25 @@ def _resolve_inputs(
                 )
             elif "default" in input_def:
                 default_value = self._resolve_default(name, input_def["default"])
-                resolved[name] = self._coerce_input(name, default_value, input_def)
+                # If the integration default could not be resolved against
+                # project state and falls back to the literal ``"auto"``
+                # sentinel, exempt it from enum-membership coercion so a
+                # workflow that lists specific integrations in ``enum`` does
+                # not crash at runtime — declared type is still enforced.
+                coerce_input_def = input_def
+                if (
+                    name == "integration"
+                    and default_value == "auto"
+                    and "enum" in input_def
+                ):
+                    coerce_input_def = {
+                        key: value
+                        for key, value in input_def.items()
+                        if key != "enum"
+                    }
+                resolved[name] = self._coerce_input(
+                    name, default_value, coerce_input_def
+                )
             elif input_def.get("required", False):
                 msg = f"Required input {name!r} not provided."
                 raise ValueError(msg)

tests/test_workflows.py

@@ -1707,6 +1707,29 @@ def test_validate_workflow_exempts_integration_auto_sentinel(self):
         errors = validate_workflow(definition)
         assert not any("invalid default" in e for e in errors), errors
 
+    def test_validate_workflow_still_checks_type_for_auto_sentinel(self):
+        """The ``auto`` exemption only skips enum-membership; declared type is still enforced."""
+        from specify_cli.workflows.engine import WorkflowDefinition, validate_workflow
+
+        definition = WorkflowDefinition.from_string("""
+schema_version: "1.0"
+workflow:
+  id: "auto-bad-type"
+  name: "Auto Bad Type"
+  version: "1.0.0"
+inputs:
+  integration:
+    type: number
+    default: "auto"
+steps:
+  - id: noop
+    type: gate
+    message: "noop"
+    options: [approve]
+""")
+        errors = validate_workflow(definition)
+        assert any("invalid default" in e for e in errors), errors
+
 
 # ===== State Persistence Tests =====