fix(worker): reject process global in workflow bundle

packages/test/src/mocks/workflows-with-process-global.ts

@@ -0,0 +1,3 @@
+export async function processGlobalWorkflow(): Promise<number> {
+  return process.pid;
+}

packages/test/src/test-bundler.ts

@@ -23,6 +23,18 @@ test('moduleMatches works', (t) => {
   t.false(moduleMatches('fs', ['foo']));
 });
 
+test('An error is thrown when workflow references the process global', async (t) => {
+  await t.throwsAsync(
+    bundleWorkflowCode({
+      workflowsPath: require.resolve('./mocks/workflows-with-process-global'),
+    }),
+    {
+      instanceOf: Error,
+      message: /is importing the following disallowed modules.*process/s,
+    }
+  );
+});
+
 async function runPreloadSharedCounter(
   t: ExecutionContext,
   workerOptions: Pick<WorkerOptions, 'bundlerOptions' | 'workflowBundle' | 'workflowsPath'>

packages/worker/src/workflow/bundler.ts

@@ -4,7 +4,7 @@ import path from 'node:path';
 import util from 'node:util';
 import * as unionfs from 'unionfs';
 import * as memfs from 'memfs';
-import type { Configuration } from 'webpack';
+import type { Configuration, javascript } from 'webpack';
 import { webpack, NormalModuleReplacementPlugin } from 'webpack';
 import type { Logger } from '../logger';
 import { DefaultLogger, hasColorSupport } from '../logger';
@@ -238,6 +238,23 @@ exports.importInterceptors = function importInterceptors() {
         },
       },
       plugins: [
+        {
+          apply: (compiler) => {
+            compiler.hooks.normalModuleFactory.tap('WorkflowCodeBundler', (normalModuleFactory) => {
+              for (const moduleType of ['javascript/auto', 'javascript/dynamic', 'javascript/esm'] as const) {
+                normalModuleFactory.hooks.parser
+                  .for(moduleType)
+                  .tap('WorkflowCodeBundler', (javascriptParser: javascript.JavascriptParser) => {
+                    javascriptParser.hooks.expression.for('process').tap('WorkflowCodeBundler', () => {
+                      if (!javascriptParser.isVariableDefined('process')) {
+                        this.foundProblematicModules.add('process');
+                      }
+                    });
+                  });
+              }
+            });
+          },
+        },
         // `@temporalio/interceptors-opentelemetry` only requires `@temporalio/workflow` for interceptors that run in workflow context.
         // In order to keep `@temporalio/workflow` as an optional peer dependency for `@temporalio/interceptors-opentelemetry`
         // we use `workflow-imports` to reexport all required imports from `@temporalio/workflow`.