fix: tighten wfctl validation

[intel352]

Summary

• make wfctl validate strict by default, with --loose/--non-strict transitional opt-outs
• add pipeline reference validation to wfctl validate and make deterministic output-shape issues fail
• correct built-in step output metadata for db_query_cached, db_exec, and conditional
• redact sensitive unresolved refs in infra plan diagnostics
• reuse cached plugin lockfile installs only when lock metadata matches

Verification

• GOWORK=off go test ./schema ./validation ./cmd/wfctl -count=1

[Copilot]

Pull request overview

Tightens wfctl validate by making strict validation the default, adding pipeline template/reference validation (including output-shape checks for key built-in steps), improving plugin lockfile install reuse safety, and redacting potentially sensitive unresolved refs in infra plan diagnostics.

Changes:

• Make wfctl validate strict by default; add --loose/--non-strict transitional opt-outs and update docs/tests accordingly.
• Add pipeline reference validation to wfctl validate, plus improved template ref scanning (including index .steps "name" "field" patterns) and more robust SQL SELECT alias extraction.
• Correct/extend step output metadata + inference for step.db_exec and step.db_query_cached (single mode flat columns), and make wfctl lock installs reuse cached plugins only when recorded metadata matches.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
validation/pipeline_refs.go	Expands pipeline template reference validation (index field refs, nested-step scanning exclusions, improved SQL parsing).
validation/pipeline_refs_test.go	Adds tests covering db_query_cached single-mode output shape and nested foreach step handling.
schema/step_schema_test.go	Adds inference tests for db_exec and db_query_cached single-mode flat columns.
schema/step_schema_builtins.go	Updates built-in step output metadata (conditional, db_query, db_exec, db_query_cached).
schema/step_inference.go	Adds inferred outputs for db_exec and refined inference for db_query_cached (single vs list; SQL alias extraction).
docs/WFCTL.md	Documents strict-by-default validate behavior and new --loose/--non-strict flags.
cmd/wfctl/validate.go	Implements strict-by-default behavior and enforces pipeline ref validation in strict mode.
cmd/wfctl/plugin_install_wfctllock.go	Adds cached install reuse guarded by recorded lock install metadata; records metadata after installs.
cmd/wfctl/plugin_install_lockfile_test.go	Adds test ensuring cached install reuse when metadata matches (and no download occurs).
cmd/wfctl/main_test.go	Updates/extends validate command tests for new strict default and pipeline ref failures.
cmd/wfctl/infra.go	Redacts sensitive unresolved refs in “Pending JIT resolution” diagnostics output.
cmd/wfctl/infra_test.go	Adds tests for sensitive-ref redaction logic.

[codecov]

Codecov Report

❌ Patch coverage is 71.93676% with 71 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
cmd/wfctl/plugin_install_wfctllock.go	50.00%	13 Missing and 12 partials ⚠️
schema/step_inference.go	75.53%	15 Missing and 8 partials ⚠️
validation/pipeline_refs.go	71.66%	17 Missing ⚠️
cmd/wfctl/validate.go	82.60%	2 Missing and 2 partials ⚠️
cmd/wfctl/infra.go	89.47%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!