fix(github): make branch protection usable and wire workflow_id to its endpoint (#7308)

* fix(github): make branch protection usable and wire workflow_id to its endpoint

`github_update_branch_protection` could not be called. `restrictions` was a
required tool param with no subBlock anywhere in the block, so every run threw
"Restrictions is required for GitHub Update Branch Protection" before the
request. The other three body fields were `required: true` behind `mode:
'advanced'` subBlocks that are hidden by default, and their subBlock types did
not match their param types.

GitHub documents all four as required but nullable - "Set to null to disable" -
so "required" there means present in the body, which `null` satisfies. Sim's
`required: true` means the user must supply a non-empty value, which is strictly
stronger. The params are now optional and the body builder supplies the explicit
`null` GitHub demands for each field left unset, normalizing the editor's JSON
strings and the dropdown's 'true'/'false' along the way. A `restrictions`
subBlock is added.

`workflow_id` rendered for `github_list_workflow_runs` but the tool declared no
such param and always hit the repo-wide `/actions/runs`. It now selects
`GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs`, which GitHub
documents as accepting the same query filters.

No subBlock id is renamed or removed and no visibility is flipped.

* fix(github): name the branch-protection parse failure without echoing the input

Author: waleedlatif1

apps/docs/content/docs/integrations/github.mdx

@@ -1019,10 +1019,10 @@ Update branch protection rules for a specific branch, including status checks, r
 | `owner` | string | Yes | Repository owner \(user or organization\) |
 | `repo` | string | Yes | Repository name |
 | `branch` | string | Yes | Branch name |
-| `required_status_checks` | object | Yes | Required status check configuration \(null to disable\). Object with strict \(boolean\) and contexts \(string array\) |
-| `enforce_admins` | boolean | Yes | Whether to enforce restrictions for administrators |
-| `required_pull_request_reviews` | object | Yes | PR review requirements \(null to disable\). Object with optional required_approving_review_count, dismiss_stale_reviews, require_code_owner_reviews |
-| `restrictions` | object | Yes | Push restrictions \(null to disable\). Object with users \(string array\) and teams \(string array\) |
+| `required_status_checks` | object | No | Required status check configuration. Object with strict \(boolean\) and contexts \(string array\). Omit to disable status checks — GitHub receives an explicit null. |
+| `enforce_admins` | boolean | No | Whether to enforce restrictions for administrators. Omit to disable admin enforcement — GitHub receives an explicit null. |
+| `required_pull_request_reviews` | object | No | PR review requirements. Object with optional required_approving_review_count, dismiss_stale_reviews, require_code_owner_reviews. Omit to disable review requirements — GitHub receives an explicit null. |
+| `restrictions` | object | No | Push restrictions, available only for organization-owned repositories. Object with users \(string array\), teams \(string array\) and optional apps \(string array\). Omit to disable push restrictions — GitHub receives an explicit null. |
 | `apiKey` | string | Yes | GitHub Personal Access Token |
 
 #### Output
@@ -1805,14 +1805,15 @@ Trigger a workflow dispatch event for a GitHub Actions workflow. The workflow mu
 
 ### GitHub List Workflow Runs
 
-List workflow runs for a repository. Supports filtering by actor, branch, event, and status. Returns run details including status, conclusion, and links.
+List workflow runs for a repository, or for a single workflow when a workflow ID or filename is given. Supports filtering by actor, branch, event, and status. Returns run details including status, conclusion, and links.
 
 #### Input
 
 | Parameter | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
 | `owner` | string | Yes | Repository owner \(user or organization\) |
 | `repo` | string | Yes | Repository name |
+| `workflow_id` | string | No | The ID of the workflow. You can also pass the workflow file name as a string \(e.g., ci.yml\). Omit to list runs across the whole repository. |
 | `actor` | string | No | Filter by user who triggered the workflow |
 | `branch` | string | No | Filter by branch name |
 | `event` | string | No | Filter by event type \(e.g., push, pull_request, workflow_dispatch\) |

apps/sim/blocks/blocks/github.ts

@@ -993,6 +993,14 @@ export const GitHubBlock: BlockConfig<GitHubResponse> = {
       condition: { field: 'operation', value: 'github_update_branch_protection' },
       mode: 'advanced',
     },
+    {
+      id: 'restrictions',
+      title: 'Push Restrictions',
+      type: 'short-input',
+      placeholder: 'JSON: {"users":["octocat"],"teams":["admins"]}',
+      condition: { field: 'operation', value: 'github_update_branch_protection' },
+      mode: 'advanced',
+    },
     // Issue operations parameters
     {
       id: 'title',
@@ -2407,9 +2415,10 @@ Return ONLY the timestamp string - no explanations, no quotes, no extra text.`,
     ref: { type: 'string', description: 'Branch, tag, or commit reference' },
     // Branch parameters
     protected: { type: 'string', description: 'Protection status filter' },
-    required_status_checks: { type: 'string', description: 'Required status checks JSON' },
+    required_status_checks: { type: 'json', description: 'Required status checks JSON' },
     enforce_admins: { type: 'boolean', description: 'Enforce for admins' },
-    required_pull_request_reviews: { type: 'string', description: 'Required PR reviews JSON' },
+    required_pull_request_reviews: { type: 'json', description: 'Required PR reviews JSON' },
+    restrictions: { type: 'json', description: 'Push restrictions JSON' },
     // Issue parameters
     labels: { type: 'string', description: 'Comma-separated labels' },
     assignees: { type: 'string', description: 'Comma-separated assignees' },