From c365fe4225d2b80e26d5daa7bcfcf154d959eea2 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 9 Jul 2026 01:50:20 +0000
Subject: [PATCH 1/3] Initial plan


From 3ac7e30dbf6e5e58d1fd0b84c68d026bd978c58b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 9 Jul 2026 02:03:40 +0000
Subject: [PATCH 2/3] perf: skip run-script expression guardrail work when no
 inline expression exists

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 pkg/workflow/template_injection_validation.go |  4 +++
 ...ate_injection_validation_benchmark_test.go | 33 ++++++++++++++++++-
 2 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/pkg/workflow/template_injection_validation.go b/pkg/workflow/template_injection_validation.go
index c8eb0b3c61c..9d97904ec29 100644
--- a/pkg/workflow/template_injection_validation.go
+++ b/pkg/workflow/template_injection_validation.go
@@ -232,6 +232,10 @@ func validateNoGitHubExpressionsInRunScriptsFromParsed(workflow map[string]any)
 	var violations []TemplateInjectionViolation
 
 	for _, runContent := range runBlocks {
+		if !mayContainInlineExpression(runContent) {
+			continue
+		}
+
 		// Align with template-injection validation by excluding non-executable regions:
 		// heredoc bodies and bash # comments.
 		contentWithoutHeredocs := stripShellLineComments(removeHeredocContent(runContent))
diff --git a/pkg/workflow/template_injection_validation_benchmark_test.go b/pkg/workflow/template_injection_validation_benchmark_test.go
index 3ecba32637f..27a23307d08 100644
--- a/pkg/workflow/template_injection_validation_benchmark_test.go
+++ b/pkg/workflow/template_injection_validation_benchmark_test.go
@@ -1,6 +1,10 @@
 package workflow
 
-import "testing"
+import (
+	"testing"
+
+	"github.com/goccy/go-yaml"
+)
 
 func BenchmarkValidateTemplateInjectionFastPath(b *testing.B) {
 	compiler := NewCompiler()
@@ -27,3 +31,30 @@ jobs:
 		}
 	}
 }
+
+func BenchmarkValidateNoGitHubExpressionsInRunScriptsFromParsed_NoExpressions(b *testing.B) {
+	yamlContent := `
+name: no-inline-expression
+on: workflow_dispatch
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: No expression run
+        run: |
+          echo "hello"
+          echo "world"
+`
+
+	var parsed map[string]any
+	if err := yaml.Unmarshal([]byte(yamlContent), &parsed); err != nil {
+		b.Fatal(err)
+	}
+
+	b.ReportAllocs()
+	for b.Loop() {
+		if err := validateNoGitHubExpressionsInRunScriptsFromParsed(parsed); err != nil {
+			b.Fatalf("validateNoGitHubExpressionsInRunScriptsFromParsed() error = %v", err)
+		}
+	}
+}

From 09cc500c04e5187ee8d15c87a750657f8f2c36f1 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 9 Jul 2026 02:30:13 +0000
Subject: [PATCH 3/3] test(benchmark): add b.ResetTimer() after YAML parsing
 setup

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 pkg/workflow/template_injection_validation_benchmark_test.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkg/workflow/template_injection_validation_benchmark_test.go b/pkg/workflow/template_injection_validation_benchmark_test.go
index 27a23307d08..997eedc7046 100644
--- a/pkg/workflow/template_injection_validation_benchmark_test.go
+++ b/pkg/workflow/template_injection_validation_benchmark_test.go
@@ -51,6 +51,7 @@ jobs:
 		b.Fatal(err)
 	}
 
+	b.ResetTimer()
 	b.ReportAllocs()
 	for b.Loop() {
 		if err := validateNoGitHubExpressionsInRunScriptsFromParsed(parsed); err != nil {