fix(workflows): shell step validate() rejects non-string run

[jawwad-ali]

Description

ShellStep.validate() only checks that run is present:

if "run" not in config:
    errors.append("...missing 'run' field.")

So run: (null) or a GitHub-Actions-style list validates clean. execute() then does:

run_cmd = config.get("run", "")
...
run_cmd = str(run_cmd)   # -> 'None'  or  "['echo', 'hi']"

and invokes that under shell=True — literally running the Python repr as a command. Reproduced on main @ bba473c: validate({'id':'s','run':None}) and validate({'id':'s','run':['echo','hi']}) both return [], and execute then runs 'None' / ['echo'... (shell error "'None' is not recognized").

Fix

Add a type check after the presence check, mirroring the command-step (#3262) and gate-options validation patterns. An expression like {{ steps.x.output }} is still a str, so expression configs stay valid.

Testing

• test_validate_rejects_non_string_run parametrized over None, a list, and an int → all now report 'run' must be a string. Fails before (validate returns [] — verified by source-stash), passes after.
• test_validate_accepts_string_and_expression_run: plain and {{ ... }} strings return [].
• Full TestShellStep: 11 passed. uvx ruff check clean.

Note: open PR #3328 also edits this validate() (adds timeout validation) and the TestShellStep region — I placed the new checks/tests in distinct spots to minimize any textual conflict; the two changes are independent.

AI Disclosure

• I did use AI assistance (describe below)

Found and fixed with Claude Code (Claude Fable 5) under my direction. AI flagged the validate-vs-execute type gap; I reproduced the shell-injection of the repr, verified fail-before/pass-after, and reviewed the diff.

[Copilot]

Pull request overview

This PR tightens workflow shell-step validation to prevent non-string run values (e.g., null, lists, ints) from passing validation and later being coerced to a Python repr that gets executed under shell=True.

Changes:

• Add a type check in ShellStep.validate() to reject non-str run values with a clear validation error.
• Add tests to assert non-string run is rejected and that normal strings / expression strings are accepted.

Show a summary per file

File	Description
src/specify_cli/workflows/steps/shell/__init__.py	Enforces run must be a string during validation to prevent executing coerced repr values.
tests/test_workflows.py	Adds regression tests covering rejection of non-string run values and acceptance of valid string forms.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Low

[mnriem]

Thank you!