Validate implicit if conditions in action.yml files (#317)

## Problem

In workflow YAML files, writing `if: foo == bar` shows an error because `foo` and `bar` are not valid contexts. However, the same invalid expression in an action.yml file showed no error.

## Solution

Add expression validation for implicit `if` conditions in action.yml files, matching the behavior of workflow YAML validation.

## What's new

1. **Pre-if/post-if validation** (node and docker actions)
   - `pre-if: foo == bar` now shows error for unknown context
   - `post-if: unknownFunc()` now shows error for unknown function

2. **Composite step `if` validation** (fix)
   - Errors from `convertToIfCondition` were being lost due to call ordering
   - Now captured correctly by calling conversion before retrieving errors

## Why the refactor?

The diff includes consolidating multiple validation loops into a single `validateAllTokens()` traversal. This matches the pattern used in workflow YAML validation (`additionalValidations`), making the code consistent between the two validation paths.

workflow-parser/src/actions/action-parser.test.ts

@@ -317,4 +317,53 @@ runs:
       }
     }
   });
+
+  it("reports error for invalid context in pre-if", () => {
+    const content = `
+name: Node Action
+description: A node action
+runs:
+  using: node20
+  main: dist/index.js
+  pre: dist/setup.js
+  pre-if: foo == bar`;
+
+    const result = parseAction({name: "action.yml", content}, nullTrace);
+    expect(result.value).toBeDefined();
+    if (!result.value) return;
+
+    // Should have no errors before conversion
+    expect(result.context.errors.count).toBe(0);
+
+    // Convert the template - this should add the validation error
+    convertActionTemplate(result.context, result.value);
+
+    // Should have an error now about invalid context
+    expect(result.context.errors.count).toBeGreaterThan(0);
+    const errors = result.context.errors.getErrors();
+    expect(errors.some(e => e.rawMessage.includes("foo"))).toBe(true);
+  });
+
+  it("accepts valid context in pre-if", () => {
+    const content = `
+name: Node Action
+description: A node action
+runs:
+  using: node20
+  main: dist/index.js
+  pre: dist/setup.js
+  pre-if: runner.os == 'Linux'`;
+
+    const result = parseAction({name: "action.yml", content}, nullTrace);
+    expect(result.value).toBeDefined();
+    if (!result.value) return;
+
+    const template = convertActionTemplate(result.context, result.value);
+
+    // Should have no errors
+    expect(result.context.errors.count).toBe(0);
+    if (template.runs.using === "node20") {
+      expect(template.runs.preIf).toBe("runner.os == 'Linux'");
+    }
+  });
 });

workflow-parser/src/actions/action-template.ts

@@ -9,7 +9,7 @@ import {TemplateContext} from "../templates/template-context.js";
 import {isBoolean, isMapping, isScalar, isSequence, isString} from "../templates/tokens/type-guards.js";
 import {ErrorPolicy} from "../model/convert.js";
 import {Step} from "../model/workflow-template.js";
-import {convertToIfCondition} from "../model/converter/if-condition.js";
+import {convertToIfCondition, validateRunsIfCondition} from "../model/converter/if-condition.js";
 
 /**
  * Represents a parsed and converted action.yml file
@@ -310,7 +310,7 @@ function convertRuns(context: TemplateContext, token: TemplateToken): ActionRuns
 
       case "pre-if":
         if (isString(item.value)) {
-          preIf = item.value.value;
+          preIf = validateRunsIfCondition(context, item.value, item.value.value);
         }
         break;
 
@@ -322,7 +322,7 @@ function convertRuns(context: TemplateContext, token: TemplateToken): ActionRuns
 
       case "post-if":
         if (isString(item.value)) {
-          postIf = item.value.value;
+          postIf = validateRunsIfCondition(context, item.value, item.value.value);
         }
         break;
 

workflow-parser/src/model/converter/if-condition.ts

@@ -136,3 +136,32 @@ function walkTreeToFindStatusFunctionCalls(tree: Expr | undefined): boolean {
 
   return false;
 }
+
+/**
+ * Validates a pre-if or post-if condition string.
+ * Unlike step if conditions, pre-if and post-if are evaluated as-is by the runner
+ * (they default to always() only when the field is missing entirely).
+ * This function validates the expression and reports errors through the context.
+ *
+ * @param context The template context for error reporting
+ * @param token The token containing the condition
+ * @param condition The condition string to validate
+ * @returns The validated condition string, or undefined on error
+ */
+export function validateRunsIfCondition(
+  context: TemplateContext,
+  token: TemplateToken,
+  condition: string
+): string | undefined {
+  const allowedContext = token.definitionInfo?.allowedContext || [];
+
+  // Validate the expression directly - no wrapping needed for pre-if/post-if
+  try {
+    ExpressionToken.validateExpression(condition, allowedContext);
+  } catch (err) {
+    context.error(token, err as Error);
+    return undefined;
+  }
+
+  return condition;
+}