bug: workflow check_schema accepts invalid case expressions and 500s on missing action conf

[Arjen10]

Current Behavior

workflow plugin check_schema has two validation bugs.

1、after expr.new(rule.case), the code inspects the wrong variable:

local expr, err = expr.new(rule.case)
-- still the schema-check result, which is already true
if not ok then
    return false, "failed to validate the 'case' expression: " .. err
end

2、action conf is optional in the JSON schema (actions items are arrays with minItems = 1, no requirement that index 2 exists). check_schema then does:

action[2]["_vid"] = idx

when the action is just ["return"] with no conf table, this indexes nil and the Admin API returns HTTP 500 instead of a validation error.

Expected Behavior

1、Invalid case expressions (expr.new failure) must be rejected at schema-check time with failed to validate the 'case' expression: ...

2、Missing action configuration must be rejected with failed to validate the '' action: configuration is required and must not 500 the Admin API.

Error Logs

2026/09/02 08:20:14 [error] 49#49: *57321127 lua entry thread aborted: runtime error: /usr/local/apisix/apisix/plugins/workflow.lua:144: attempt to index a nil value
stack traceback:
coroutine 0:
        /usr/local/apisix/apisix/plugins/workflow.lua: in function 'check_schema'
        /usr/local/apisix/apisix/plugin.lua:992: in function 'check_single_plugin_schema'
        /usr/local/apisix/apisix/plugin.lua:1198: in function 'schema_plugin'
        /usr/local/apisix/apisix/admin/routes.lua:130: in function 'checker'
        /usr/local/apisix/apisix/admin/resource.lua:126: in function 'check_conf'
        /usr/local/apisix/apisix/admin/resource.lua:256: in function </usr/local/apisix/apisix/admin/resource.lua:243>
        /usr/local/apisix/apisix/admin/init.lua:235: in function 'handler'
        /usr/local/apisix//deps/share/lua/5.1/resty/radixtree.lua:1013: in function 'dispatch'
        /usr/local/apisix/apisix/init.lua:1203: in function 'http_admin'

Steps to Reproduce

curl --location --request PUT 'http://172.18.0.21:9180/apisix/admin/routes/test' \
--header 'Content-Type: application/json' \
--header 'X-API-KEY: ••••••' \
--data '{
    "uri": "/fake",
    "name": "xxx",
    "plugins": {
        "workflow": {
            "rules": [
                {
                    "case": [
                        [
                            "uri",
                            "bad_case_????!!!!",
                            "/hello"
                        ]
                    ],
                    "actions": [
                        [
                            "return"
                        ]
                    ]
                }
            ]
        }
    },
    "upstream": {
        "type": "roundrobin",
        "scheme": "https",
        "pass_host": "node",
        "nodes": {
            "xxx:6443": 1
        }
    }
}'

Environment

• APISIX version (run apisix version): 3.18
• Operating system (run uname -a):
• OpenResty / Nginx version (run openresty -V or nginx -V):
• etcd version, if relevant (run curl http://127.0.0.1:9090/v1/server_info):
• APISIX Dashboard version, if relevant:
• Plugin runner version, for issues related to plugin runners:
• LuaRocks version, for installation issues (run luarocks --version):