[dead-code] chore: remove dead functions — 5 functions removed

[github-actions]

Dead Code Removal

This PR removes unreachable Go functions identified by the deadcode static analyzer.

Functions Removed

Function	File
WorkflowStep.ToYAML	pkg/workflow/step_types.go
Compiler.formatDetectionRunsOn	pkg/workflow/safe_outputs_runtime.go
getEnabledSafeOutputToolNamesReflection	pkg/workflow/safe_outputs_state.go
GetEnabledSafeOutputToolNames	pkg/workflow/safe_outputs_state.go
applySafeOutputEnvToSlice	pkg/workflow/safe_outputs_jobs.go

Tests Removed

• TestWorkflowStep_ToYAML and TestToYAML_ErrorHandling (exclusively tested WorkflowStep.ToYAML)
• TestFormatDetectionRunsOn (exclusively tested Compiler.formatDetectionRunsOn)
• TestGetEnabledSafeOutputToolNames (exclusively tested GetEnabledSafeOutputToolNames)
• TestApplySafeOutputEnvToSlice (exclusively tested applySafeOutputEnvToSlice)
• TestEnginesUseSameHelperLogic simplified (removed applySafeOutputEnvToSlice usage)

Verification

• ✅ go build ./... — passes
• ✅ go vet ./... — passes
• ✅ go vet -tags=integration ./... — passes
• ✅ make fmt — applied (trailing newline in safe_outputs_test.go)
• ✅ go test ./pkg/workflow/ — passes (26s)

Dead Function Count

• Before this batch: ~21 functions
• Removed in this PR: 5 functions
• Remaining: ~16 functions (some require more complex test refactoring)

---

Automated by Dead Code Removal workflow — https://github.com/github/gh-aw/actions/runs/23063979698

Generated by Dead Code Removal Agent · ◷

• expires on Mar 16, 2026, 6:21 PM UTC

---

Note

This was originally intended as a pull request, but PR creation failed. The changes have been pushed to the branch dead-code-removal-20260313-fddbc987f419a62a.

Original error: Validation Failed: {"resource":"Label","code":"unprocessable","field":"data","message":"Could not resolve to a node with the global id of 'PR_kwDOPc1QR87Kcmab'."}

To create the pull request manually:

gh pr create --title "[dead-code] chore: remove dead functions — 5 functions removed" --base main --head dead-code-removal-20260313-fddbc987f419a62a --repo github/gh-aw

Show patch preview (500 of 635 lines)

From 909bc8862e630c34bed0726d5ffb546ea65265ed Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Fri, 13 Mar 2026 18:18:41 +0000
Subject: [PATCH] =?UTF-8?q?chore:=20remove=20dead=20functions=20=E2=80=94?=
 =?UTF-8?q?=205=20functions=20removed?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove unreachable Go functions identified by the deadcode static analyzer.

Functions removed:
- WorkflowStep.ToYAML (pkg/workflow/step_types.go)
- Compiler.formatDetectionRunsOn (pkg/workflow/safe_outputs_runtime.go)
- getEnabledSafeOutputToolNamesReflection (pkg/workflow/safe_outputs_state.go)
- GetEnabledSafeOutputToolNames (pkg/workflow/safe_outputs_state.go)
- applySafeOutputEnvToSlice (pkg/workflow/safe_outputs_jobs.go)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 pkg/workflow/safe_output_helpers_test.go | 102 --------------------
 pkg/workflow/safe_outputs_jobs.go        |  25 -----
 pkg/workflow/safe_outputs_runtime.go     |  10 --
 pkg/workflow/safe_outputs_state.go       |  50 ----------
 pkg/workflow/safe_outputs_test.go        | 115 -----------------------
 pkg/workflow/step_types.go               |  14 ---
 pkg/workflow/step_types_test.go          | 101 --------------------
 pkg/workflow/threat_detection_test.go    |  64 -------------
 8 files changed, 481 deletions(-)

diff --git a/pkg/workflow/safe_output_helpers_test.go b/pkg/workflow/safe_output_helpers_test.go
index 7861a85..3d542d5 100644
--- a/pkg/workflow/safe_output_helpers_test.go
+++ b/pkg/workflow/safe_output_helpers_test.go
@@ -295,95 +295,6 @@ func TestApplySafeOutputEnvToMap(t *testing.T) {
 }
 
 // TestApplySafeOutputEnvToSlice verifies the helper function for YAML string slices
-func TestApplySafeOutputEnvToSlice(t *testing.T) {
-	tests := []struct {
-		name         string
-		workflowData *WorkflowData
-		expected     []string
-	}{
-		{
-			name: "nil SafeOutputs",
-			wor
... (truncated)