[eas-cli][build-tools][steps] Validate local composite functions referenced from workflow hooks; extract the shared loader into steps

[sswrk]

Why

Workflow validation already checks local composite functions referenced from job steps, but hooks can also use uses: ./..... eas workflow:validate don't catch problems with composite functions in hooks.

This PR also includes an extraction of duplicated (eas-cli and build-tools) composite function loader to @expo/steps.

How

Validation of workflows in eas-cli now reads each job's hooks steps too, not just job.steps.

Removed a duplicate loader from eas-cli and build-tools, moved it to steps.

Note: no validation when project_root_directory is set.

Test Plan

Added unit tests.

[linear-code]

ENG-22387

[codecov]

Codecov Report

❌ Patch coverage is 98.21429% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 62.66%. Comparing base (a6060b0) to head (d3a4b3a).
⚠️ Report is 1 commits behind head on szymonswierk/eng-22387-build-tools-hook-composite-catalog.

Files with missing lines	Patch %	Lines
...li/src/commandUtils/workflow/compositeFunctions.ts	95.66%	1 Missing ⚠️

Additional details and impacted files

@@                                      Coverage Diff                                      @@
##           szymonswierk/eng-22387-build-tools-hook-composite-catalog    #4064      +/-   ##
=============================================================================================
- Coverage                                                      62.66%   62.66%   -0.00%     
=============================================================================================
  Files                                                            999      998       -1     
  Lines                                                          45207    45190      -17     
  Branches                                                        9488     9492       +4     
=============================================================================================
- Hits                                                           28326    28314      -12     
+ Misses                                                         15433    15428       -5     
  Partials                                                        1448     1448              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sswrk]

Also, moving an open discussion from the previous eas-cli PR in the stack: #4064

[github-actions]

✅ Thank you for adding the changelog entry!

[github-actions]

🤖 AI code review

Decision: Approve with comments

The reviewers found warning-level issues in workflow validation and the shared loader. The CLI can miss static custom roots or fail on ignored hooks. The loader can misclassify bad config and echo control characters from a path.

🟡 Warning (4)

• Validation skips jobs with a custom project root — packages/eas-cli/src/commandUtils/workflow/compositeFunctions.ts:25 (correctness) · id:a6887c3cc9e3
  This branch skips all local composite function checks for the job. If project_root_directory is a literal path, the CLI can resolve it. A missing function then passes eas workflow:validate, but the build fails later when build-tools parses the job.
  Suggestion: For literal project_root_directory values, validate with path.join(projectDir, project_root_directory). Skip only interpolated roots.
• Invalid function config uses the wrong error type — packages/steps/src/utils/localCompositeFunctions.ts:147 (correctness) · id:0cd549fea4a3
  The loader reads user workflow config. Sibling config paths throw BuildConfigError for invalid config. This code throws a plain Error for a bad function.yml file. Build tools can then classify it as UNKNOWN_ERROR instead of a user config error.
  Suggestion: Throw BuildConfigError for local composite function read, parse, validation, and missing-file errors.
• Path text can inject terminal control characters — packages/steps/src/utils/localCompositeFunctions.ts:159 (security) · id:323547c146b0
  A workflow controls compositeFunctionPath through the uses value. If the file is missing, this error includes that value. An attacker can put ANSI or control characters in the path. The CLI or build log can then show spoofed output.
  Suggestion: Strip ANSI and control characters from compositeFunctionPath before you put it in errors or logs.
• Validation loads composites from ignored hooks — packages/eas-cli/src/commandUtils/workflow/compositeFunctions.ts:50 (correctness) · id:3eadab58048d
  stepsFromWorkflow adds steps from every hook key. The build parser only loads hook composites for anchors that the job runs. A workflow with an unused hook can now fail eas workflow:validate on a missing local composite function. The build would skip that hook and continue.
  Suggestion: Load hook composite functions only for hook anchors that the job can run. Otherwise keep the parser behavior and skip unused hooks.

---

This review is advisory — it never blocks a merge and never auto-approves.

[sswrk]

Re. AI review:

Validation skips jobs with a custom project root

That's a deliberate skip. Validating it would need injecting the vcs client. Will change it if human reviewers advise doing so

Invalid function config uses the wrong error type

Not specific to this PR, worth considering as a follow up

Path text can inject terminal control characters

not specific to this PR, a general pattern

Validation loads composites from ignored hooks

It does hold up, but it was deliberate: we can only do static verification here, so that's the only way we can check those functions within workflow:validate. Will change it if human reviewers advise doing so.

[github-actions]

Subscribed to pull request

File Patterns	Mentions
packages/eas-cli/**	@douglowder

Generated by CodeMention

Warning: The preamble and epilogue options in commentConfiguration are deprecated. Use template instead.