fix(workflow): use $sourceDescriptions for workflow references

[harshit078]

What/Why/How?

• Added support for the Arazzo workflow reference form $sourceDescriptions.<name>.<workflowId>.
• The previous $sourceDescriptions.<name>.workflows.<workflowId> form is still maintained.

Reference

#2826

Testing

Screenshots (optional)

Check yourself

• This PR follows the contributing guide
• All new/updated code is covered by tests
• Core code changed? - Tested with other Redocly products (internal contributions only)
• New package installed? - Tested in different environments (browser/node)
• Documentation update has been considered

Security

• The security impact of the change has been considered
• Code follows company security practices and guidelines

---

Note

Medium Risk
Workflow resolution behavior changed in a core context-parser path used when steps invoke external Arazzo workflows; legacy references are preserved but the new spec-form field fallback could surprise callers if a segment collides with a non-workflow property name.

Overview
Respect now resolves external workflow references using the Arazzo-compliant path $sourceDescriptions.<name>.<workflowId>, without the intermediate .workflows. segment.

get-value-from-context was broadened to handle both the new spec form (3 path segments) and the legacy form $sourceDescriptions.<name>.workflows.<workflowId>. For the spec form, it looks up a matching workflow by workflowId first; if none matches, it falls back to a property on the source description (e.g. $sourceDescriptions.test.url). The legacy form still only resolves workflows and does not use that field fallback.

Tests and integration examples were updated to the spec-style references, with explicit coverage that the legacy syntax still works.

^{Reviewed by Cursor Bugbot for commit 2658393. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 2658393

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@redocly/respect-core	Patch
@redocly/cli	Patch
@redocly/openapi-core	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[harshit078]

Hi @DmitryAnansky , Can you review the PR and check it ? Thanks !

[github-actions]

Performance Benchmark (Lower is Faster)

CLI Version	Bundle	Lint	Check Config
cli-latest	▓ 1.00x (Fastest)	▓ 1.00x (Fastest)	▓ 1.00x (Fastest)
cli-next	▓ 1.02x ± 0.01	▓ 1.00x ± 0.01	▓ 1.00x ± 0.01

[DmitryAnansky]

Probably we need to handle case with

    if (isLegacyForm) {
      return undefined;
    }

[DmitryAnansky]

Could you please update existing tests to use correct and not legacy format?

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 2658393. Configure here.}