fix(governance): reject unknown custom property fields

Co-authored-by: Patrick Knight <patrick-knight@github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 1e886867-a922-419a-b02c-ac643716aea8

Author: 3 people

pkg/github/__toolsnaps__/custom_properties_write.snap

@@ -31,6 +31,7 @@
       "properties": {
         "description": "The custom properties to create or update. At the repository level each item assigns a value ('property_name' and 'value'); at the organization and enterprise levels each item defines the schema ('property_name' and 'value_type', plus optional definition fields).",
         "items": {
+          "additionalProperties": false,
           "properties": {
             "allowed_values": {
               "description": "Organization and enterprise levels only: the ordered list of allowed values for single_select and multi_select properties.",

pkg/github/custom_properties.go

@@ -279,7 +279,8 @@ func customPropertiesWriteEnterprise(ctx context.Context, client *github.Client,
 // customPropertyItemSchema combines repository values with organization and enterprise definitions.
 func customPropertyItemSchema() *jsonschema.Schema {
 	return &jsonschema.Schema{
-		Type: "object",
+		Type:                 "object",
+		AdditionalProperties: &jsonschema.Schema{Not: &jsonschema.Schema{}},
 		Properties: map[string]*jsonschema.Schema{
 			"property_name": {
 				Type:        "string",

pkg/github/custom_properties_test.go

@@ -134,6 +134,33 @@ func Test_CustomPropertiesWrite(t *testing.T) {
 	require.True(t, ok, "InputSchema should be *jsonschema.Schema")
 	assert.ElementsMatch(t, schema.Required, []string{"level", "properties"})
 
+	t.Run("property items reject unknown fields", func(t *testing.T) {
+		itemSchema := schema.Properties["properties"].Items
+		require.NotNil(t, itemSchema.AdditionalProperties)
+		require.NotNil(t, itemSchema.AdditionalProperties.Not)
+
+		resolved, err := itemSchema.Resolve(nil)
+		require.NoError(t, err)
+		require.NoError(t, resolved.Validate(map[string]any{
+			"property_name":      "environment",
+			"value_type":         "single_select",
+			"required":           true,
+			"default_value":      "production",
+			"description":        "Deployment environment",
+			"allowed_values":     []any{"production", "staging"},
+			"values_editable_by": "org_and_repo_actors",
+		}))
+		require.NoError(t, resolved.Validate(map[string]any{
+			"property_name": "environment",
+			"value":         []any{"production", "staging"},
+		}))
+		require.Error(t, resolved.Validate(map[string]any{
+			"property_name": "environment",
+			"value_type":    "string",
+			"require":       true,
+		}))
+	})
+
 	t.Run("value schemas enforce documented JSON types", func(t *testing.T) {
 		defaultValueSchema := schema.Properties["properties"].Items.Properties["default_value"]
 		require.Len(t, defaultValueSchema.OneOf, 2)