[code-scanning-fix] Fix go/allocation-size-overflow: integer overflow in allocation size hints

pkg/workflow/workflow_builder.go

@@ -473,8 +473,11 @@ func mergeExcludedEnvVarNames(fromImports, fromMain []string) []string {
 	if len(fromImports) == 0 && len(fromMain) == 0 {
 		return nil
 	}
-	seen := make(map[string]bool, len(fromImports)+len(fromMain))
-	merged := make([]string, 0, len(fromImports)+len(fromMain))
+	// Use max() for capacity hints: overflow-safe (no addition) and a tighter
+	// lower-bound than either length alone.
+	hint := max(len(fromImports), len(fromMain))
+	seen := make(map[string]bool, hint)
+	merged := make([]string, 0, hint)
 	for _, name := range fromImports {
 		if !seen[name] {
 			seen[name] = true

pkg/workflow/workflow_builder_model_policy_test.go

@@ -3,6 +3,8 @@
 package workflow
 
 import (
+	"fmt"
+	"sort"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -161,3 +163,22 @@ func TestMergeExcludedEnvVarNames_DeduplicatesAcrossSources(t *testing.T) {
 	)
 	assert.Equal(t, []string{"IMPORT_ONLY", "MAIN_ONLY", "SHARED"}, got)
 }
+
+func TestMergeExcludedEnvVarNames_LargeInputs(t *testing.T) {
+	// Exercises the code path that triggered CWE-190 alerts #648/#649.
+	n := 100_000
+	fromImports := make([]string, n)
+	fromMain := make([]string, n)
+	for i := range fromImports {
+		fromImports[i] = fmt.Sprintf("IMPORT_%d", i)
+		fromMain[i] = fmt.Sprintf("MAIN_%d", i)
+	}
+	got := mergeExcludedEnvVarNames(fromImports, fromMain)
+	assert.Len(t, got, 2*n)
+	assert.True(t, sort.StringsAreSorted(got))
+	// Confirm both sources are represented in the result.
+	assert.Contains(t, got, "IMPORT_0")
+	assert.Contains(t, got, fmt.Sprintf("IMPORT_%d", n-1))
+	assert.Contains(t, got, "MAIN_0")
+	assert.Contains(t, got, fmt.Sprintf("MAIN_%d", n-1))
+}