fix(workflows): harden catalog.py against mis-shaped registry & non-string fields

[jawwad-ali]

Description

Two robustness gaps in workflows/catalog.py where the Workflow* classes diverge from their Step* siblings, which already guard both cases:

1. WorkflowRegistry._load returns json.load() verbatim. A JSON-valid but mis-shaped registry file crashes every method that indexes data["workflows"]:

• workflow-registry.json = [] → is_installed/get/list/remove/add raise TypeError: list indices must be integers;
• = {"schema_version": "1.0"} (no workflows key) → KeyError: 'workflows'.

StepRegistry._load already validates the shape (dict root + dict steps) and resets to default. Reproduced on main @ 92b7cf7.

2. WorkflowCatalog.search joins name/description/id without coercion. A catalog entry with a null or non-string field raises TypeError: sequence item 0: expected str instance, NoneType found. StepCatalog.search already coerces with str(... or "") — and has a regression test for exactly this; WorkflowCatalog.search was the outlier.

Fix

Mirror the siblings: validate the registry shape in _load (+ widen the except tuple to OSError/UnicodeError), and coerce the search fields with str(wf_data.get(...) or "").

Testing

• test_load_tolerates_misshaped_registry (parametrized [] / no-workflows): registry recovers to the default shape and all methods run. Fails before (TypeError/KeyError).
• test_search_with_non_string_fields (WorkflowCatalog, mirrors the existing StepCatalog test): null/int fields no longer raise. Fails before (TypeError).
• Both verified fail-before via source-stash; TestWorkflowRegistry + the new catalog test pass; uvx ruff check clean.

AI Disclosure

• I did use AI assistance (describe below)

Found and fixed with Claude Code (Claude Fable 5) under my direction. AI diffed the Workflow* classes against their Step* siblings; I reproduced both crashes, verified fail-before/pass-after, and reviewed the diff.

[Copilot]

Pull request overview

Hardens specify_cli.workflows.catalog to better tolerate malformed on-disk registries and non-string catalog data, aligning Workflow* behavior with the existing Step* implementations.

Changes:

• Validate workflow-registry.json shape in WorkflowRegistry._load() and fall back to a default structure for mis-shaped/corrupt content.
• Coerce WorkflowCatalog.search() searchable fields to strings to avoid TypeError on null/non-string values.
• Add regression tests covering mis-shaped registry files and non-string workflow fields during search.

Show a summary per file

File	Description
tests/test_workflows.py	Adds regression tests for mis-shaped workflow registry loading and non-string workflow catalog search fields.
src/specify_cli/workflows/catalog.py	Adds registry shape validation in _load() and coerces search fields to strings for robustness.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Low