[WIP] Fix failing GitHub Actions workflow test

[Copilot]

Fix TestCheckoutWithAgentFromImports test failure

The test TestCheckoutWithAgentFromImports/no_checkout_without_agent_and_permissions was failing because the shouldAddCheckoutStep function in pkg/workflow/compiler_jobs.go unconditionally returned true, assuming the agent job always needs checkout.

Root Cause

The function commented that "Agent job always gets contents: read permission for .github and .actions access" and always returned true. However, in release mode (ActionModeRelease), actions are pinned to remote references (e.g., github/gh-aw/.github/actions/setup@sha) rather than local paths, so checking out the .github/actions folder is unnecessary.

Solution

Updated shouldAddCheckoutStep to:

1. Skip checkout if custom steps already contain checkout (existing behavior)
2. Add checkout if agent file is specified (existing behavior)
3. Skip checkout only in explicit release mode without an agent file
4. Add checkout by default for dev/script mode and uninitialized mode

This change aligns with the logic in compiler_activation_jobs.go lines 37-46, which only adds contents: read permission when in dev/script mode.

Testing

• Identify root cause - shouldAddCheckoutStep always returns true
• Understand the logic for when checkout should be added in different modes
• Fix shouldAddCheckoutStep to respect ActionMode and permissions
• Verify the fix with targeted tests
• Run full test suite with race detector - all tests pass

Original prompt

Fix the failing GitHub Actions workflow test
Analyze the workflow logs, identify the root cause of the failure, and implement a fix.
Job ID: 62651798639
Job URL: https://github.com/github/gh-aw/actions/runs/21721385875/job/62651798639

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Pull request overview

This PR fixes a failing test by updating the shouldAddCheckoutStep function to properly handle different action modes. Previously, the function always returned true, assuming checkout was always needed for accessing .github and .actions folders. However, in release mode, actions use remote SHA-pinned references instead of local paths, so checking out the repository is unnecessary when no agent file is specified.

Changes:

• Modified shouldAddCheckoutStep to skip checkout in release mode when no agent file is specified
• Added logic to distinguish between dev/script modes (which need checkout for local .github and .actions access) and release mode (which uses remote action references)
• Aligned behavior with the permissions logic in compiler_activation_jobs.go which only adds contents: read in dev/script mode

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Smoke Test Results (Run 21722230812)

PRs Reviewed:

• [WIP] Fix failing GitHub Actions workflow test #13966: [WIP] Fix failing GitHub Actions workflow test
• Mount gh CLI binary in agentic-workflows MCP server container #13948: Mount gh CLI binary in agentic-workflows MCP server container

Test Results:

• ✅ GitHub MCP
• ✅ Safe Inputs GH CLI
• ✅ Serena MCP (129 symbols found)
• ✅ Playwright
• ✅ File Write/Bash
• ✅ Discussion Interaction
• ✅ Build gh-aw
• ✅ Workflow Dispatch

Overall Status: ✅ PASS

cc: @pelikhan@Copilot

AI generated by Smoke Copilot