Validate regex in unit test

src/schema.test.ts

@@ -1,10 +1,11 @@
 import test from 'node:test';
-import assert, { throws } from 'node:assert';
-import { Durationable, Options } from './schema.ts';
+import assert, { strictEqual, throws } from 'node:assert';
+import { Durationable, Options, yamlPattern } from './schema.ts';
 import { Temporal } from 'temporal-polyfill';
 import { durationEqual, optionsEqual } from './assert.ts';
 import { z } from 'zod';
 import { deepStrictEqual } from 'node:assert/strict';
+import { checkSync } from 'recheck';
 
 const defaultOptions = Object.freeze({
   isEarlyExit: true,
@@ -76,6 +77,10 @@ test('Options accept all yaml extensions', () => {
   );
 });
 
+test('regex option does not have higher ReDoS possibilities', () => {
+  strictEqual(checkSync(yamlPattern.source, '').status, 'safe');
+});
+
 test('Options reject invalid values', () => {
   throws(() => Options.parse({ ...defaultOptions, leastInterval: Temporal.Duration.from({ seconds: 0 }) }), {
     name: 'ZodError',

src/schema.ts

@@ -66,7 +66,8 @@ export function getDuration(durationable: string | MyDurationLike): Duration {
   throw new Error('unexpected value is specified in durations');
 }
 
-const workflowFile = z.string().regex(/\.(yml|yaml)$/);
+export const yamlPattern = /\.(yml|yaml)$/;
+const workflowFile = z.string().regex(yamlPattern);
 const matchAllJobs = z.object({
   workflowFile: workflowFile,
   jobName: z.undefined(), // Preferring undefined over null for backward compatibility