[P1] Audit: Workflow pages cannot be run or imported into Pipeline Builder

[baixiangcpp]

Imported from the byteflow.tools deep audit on 2026-06-22.

Problem: workflow pages describe multi-step paths, but users must manually open each linked tool. Existing workflow content should connect directly to Pipeline Builder so a user can import a workflow as a runnable local recipe.

Affected URLs:

• https://byteflow.tools/en/workflows/api-payload-cleanup
• https://byteflow.tools/en/workflows/json-typescript-contract-review
• https://byteflow.tools/en/workflows/security-token-review
• https://byteflow.tools/en/workflows/log-scrub-before-sharing
• Other workflow pages

Reproduction steps:

1. Open a workflow page.
2. Review the step-by-step path.
3. Look for an “Open in Pipeline Builder” or “Run this workflow” button.
4. Click each tool manually and compare effort with using Pipeline Builder.

Expected behavior: workflow pages should offer a one-click import into Pipeline Builder, preserving steps and public options but excluding input data.

Actual behavior: workflow pages are static guidance pages with links to individual tools.

Impact: valuable content does not fully convert into product usage. Users must perform manual tab switching and lose context.

Proposed fix:

• Add “Open in Pipeline Builder” CTA to workflow pages.
• Store workflow-to-recipe mapping in manifest data.
• Add a preview of steps before import.
• Preserve privacy boundary and exclude runtime input.
• Add analytics for workflow-to-pipeline conversion using safe event names only.

Acceptance criteria:

• Each workflow page can import a matching Pipeline Builder recipe.
• Imported recipe steps match the written workflow.
• No runtime data is included in the import link.
• The user can run the recipe immediately after adding input.

[baixiangcpp]

Closed as completed by the canonical BF audit backlog work. This older non-BF audit issue duplicates work now merged through PRs #209-#219, with the BF issues closed and guard/test coverage in place. The remaining non-duplicate follow-up is #7, which stays open because the upstream Next/PostCSS advisory is not fixed yet.

[baixiangcpp]

Reopening after acceptance review on 2026-06-24. This older audit issue is not fully satisfied because canonical BF-010 is reopened (#113). Workflow-to-Pipeline integration exists only for some workflow pages; image-resize-social-export and json-typescript-contract-review still lack matching importable Pipeline Builder recipes. Keep open until every matching workflow can import a structure-only recipe whose steps match the written workflow.