Push trigger fails: head_commit.id (SHA) incorrectly validated as numeric field

[mrjf]

Description

Agentic workflows with a push trigger fail at the activation step because github.event.head_commit.id (a git commit SHA) is incorrectly validated as a numeric field.

Error

Context variable validation failed! Found 1 malicious or invalid numeric field(s):
- github.event.head_commit.id: "7fb94dd0b8f3a0c761ee9dd68f67f3f36871e16a"

github.event.head_commit.id contains non-numeric characters: "7fb94dd0b8f3a0c761ee9dd68f67f3f36871e16a"

Numeric context variables (like github.event.issue.number) must be either empty or valid integers.
This validation prevents injection attacks where special text or code is hidden in numeric fields.

Reproduction

1. Create an agentic workflow with a push trigger:

   on:
     push:
       branches: [main]

2. Push any commit to main
3. The activation job fails immediately with the above error

Root cause

The context variable validator treats any field named *.id as numeric, but github.event.head_commit.id is a git SHA (40-character hex string), not a numeric ID. This field is always a hex string on push events — it's the commit hash, not a database ID.

Affected run

https://github.com/githubnext/rw-aw/actions/runs/22381736635

Expected behavior

github.event.head_commit.id should be excluded from numeric validation, or the validator should distinguish between commit SHAs and numeric database IDs.

[pelikhan]

What version are you running?