fix: apply invocation config to workflow Data after callback

[danskmt]

Description

Workflows can return Data created with workflow.NewData without WithConfiguration, so IN_MEMORY_THRESHOLD_BYTES and TEMP_DIR_PATH were not applied to those payloads.

After each workflow callback returns, EngineImpl.Invoke calls applyConfiguration on each *DataImpl in the output slice so in-memory payloads can spill to the configured temp directory when above threshold. applyConfiguration is package-private on DataImpl (same package as the engine) so it is not exported from the workflow package.

Adds tests in dataimpl_test.go for spill and no-op cases, and in engine_test.go for behavior after Invoke.

Checklist

• Tests added and all succeed (make test)
• Regenerated mocks, etc. (make generate)
• Linted (make lint)
• Test your changes work for the CLI
  1. Clone / pull the latest CLI main.
  2. Run go get github.com/snyk/go-application-framework@YOUR_LATEST_GAF_COMMIT in the cliv2 directory.
     • Tip: for local testing, you can uncomment the line near the bottom of the CLI's go.mod to point to your local GAF code.
  3. Run go mod tidy in the cliv2 directory.
  4. Run the CLI tests and do any required manual testing.
  5. Open a PR in the CLI repo now with the go.mod and go.sum changes.
  • Once this PR is merged, repeat these steps, but pointing to the latest GAF commit on main and update your CLI PR.

PR in CLI snyk/cli#6792

Where reviewers should start

• pkg/workflow/dataimpl.go — applyConfiguration
• pkg/workflow/engineimpl.go — post-process loop after callback

Risk assessment

Low. Default production behavior is unchanged unless spill-related settings are enabled; when they are, returned Data placement aligns with engine configuration instead of leaving eligible payloads in memory.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 12 relevant code sections from 8 files (average relevance: 0.95) pkg/mocks/workflow.go (3 segments, lines 1-238) pkg/workflow/enginewrapper.go (lines 1-125) pkg/workflow/types.go (lines 1-115) pkg/local_workflows/output_workflow/other_tools.go (lines 1-144) pkg/app/app.go (lines 235-386) pkg/workflow/dataimpl.go (2 segments, lines 1-273) pkg/workflow/engineimpl.go (2 segments, lines 279-409) ... and 1 more file(s)