fix(workflows): reject a multi-argument filter call in expressions

[jawwad-ali]

Problem

_apply_filter parses a filter call with:

filter_match = re.fullmatch(r"(\w+)\((.+)\)", filter_expr)
...
farg = _evaluate_simple_expression(filter_match.group(2).strip(), namespace)

The entire captured argument text goes to _evaluate_simple_expression as a single expression. Every filter in this subset takes exactly one argument, so "1, 2" is not a valid expression — it evaluates to None.

Reproduction on current main (81bf741)

{{ inputs.missing | default(1) }}        -> 1
{{ inputs.missing | default(1, 2) }}     -> None    <-- silently wrong
{{ inputs.name | join(",", "extra") }}   -> ValueError: join: expected a string
                                            separator, got NoneType

Two distinct failures:

• default silently returns None — the opposite of the filter's entire purpose, with no error. A workflow using it gets an empty interpolation and carries on.
• join raises a misleading error. It blames the separator ("expected a string separator, got NoneType") when the separator was fine and the real problem is the extra argument.

Fix

Fall through to the error this function already raises for a registered filter used wrongly:

filter 'default' used in an unsupported form (got '| default(1, 2)'):
  expected one of default or default('x'), join('sep'), map('attr'),
  contains('s'), or from_json

That message names the filter and lists the accepted forms, which is exactly the diagnostic the author needs.

The check has to be quote-aware

A single argument may legitimately contain a comma, so a plain split(",") would reject valid expressions. All of these must keep working, and are pinned by a new test:

{{ inputs.items | join(", ") }}          -> 'a, b'
{{ inputs.items | join(",") }}           -> 'a,b'
{{ inputs.missing | default("a, b") }}   -> 'a, b'

Hence _has_top_level_comma, which tracks quote state and only reports a comma outside a quoted span.

Breaking risk: the only expressions whose behaviour changes are multi-argument calls, which today either return None or raise a misleading error — neither is a form anyone can be relying on. Every single-argument form, the no-argument | default, and chained filters are unchanged; verified above and by the existing TestExpressions suite.

Verification

• Fail-before / pass-after: test_multi_argument_filter_call_fails_loudly fails on unpatched src and passes with the fix. tests/test_workflows.py: 21 failed → 20 failed, 838 → 839 passed.
• The remaining 20 are identical to the clean-main baseline captured on 81bf741 (all Windows symlink-privilege).
• uvx ruff@0.15.0 check src tests → clean

Tests sit beside the existing filter-strictness tests (test_registered_filter_unsupported_form_raises, test_filter_call_with_trailing_tokens_fails_loudly), which established this exact "fail loudly rather than silently mis-evaluate" contract.

---

Written with assistance from Claude Code. Bug found, reproduced, and verified by me on current main.

[Copilot]

Pull request overview

Adds strict validation for unsupported multi-argument workflow filter calls.

Changes:

• Detects top-level commas in filter arguments.
• Adds regression tests for multi-argument calls and quoted commas.

Show a summary per file

File	Description
src/specify_cli/workflows/expressions.py	Adds filter argument validation.
tests/test_workflows.py	Tests invalid multiple arguments and valid quoted commas.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced

[mnriem]

Please address Copilot feedback

[Copilot]

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

🟢 Approval recommended

The bracket-aware validation correctly addresses the bug with comprehensive regression coverage.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[mnriem]

This is a clean fix — green review, reproduced, disclosed, and CI passes. The only blocker is that the branch now conflicts with main (it's from late July and expressions.py has moved since). Please rebase on main and resolve. Heads up: there are three other in-flight PRs on expressions.py (#4460, #4416, #4417), so once you rebase, double-check your _apply_filter change still sits cleanly alongside those. Re-request review after the rebase.

[jawwad-ali]

Rebased onto current main — MERGEABLE again.

The conflict came from my own merged #3894, which added test_filter_on_a_comparison_operand_is_refused and test_filter_after_a_unary_not_is_refused at the same insertion point in TestExpressions. Both sides were different tests in the same place, so I resolved by taking main's file wholesale and re-inserting only this PR's three unique tests, rather than hand-merging the interleaved hunks:

• test_multi_argument_filter_call_fails_loudly
• test_single_argument_containing_a_comma_still_works
• test_multi_argument_after_a_literal_is_still_rejected

All five now coexist; the diff against main is purely additive (87 insertions, 0 deletions).

Re-verified after the rebase:

• Fail-before/pass-after still holds — with expressions.py reverted to upstream/main, test_multi_argument_filter_call_fails_loudly fails; with the fix, 24 passed.
• No duplicate test or class names introduced (that would silently shadow another PR's tests).
• Full tests/test_workflows.py: 20 failed / 960 passed, against a clean-main baseline of 22 failed / 955 passed on the same machine — five more passing and no new failures. The remaining failures are the known Windows os.replace flakiness in that file, which rotates between runs and is unrelated to this change.
• uvx ruff@0.15.0 check src tests clean.

@mnriem — the Copilot thread on this PR was addressed back in c59cf00 and Copilot's follow-up review on Sep 1 filed nothing further, so I believe the CHANGES_REQUESTED here predates the fix. Happy to take another look if anything is still outstanding.