Reduce Copilot template-injection noise by moving max-ai-credits expression to step env

[Copilot]

Static analysis was stable except for persistent high-volume zizmortemplate-injection findings in generated Copilot execution steps. This change reduces that noise at the compiler layer by moving a frequent GitHub expression out of run: and into env: while preserving runtime behavior.

• Compiler change: env-driven max-ai-credits resolution for AWF

  • Added ResolveMaxAICreditsFromEnv to AWFCommandConfig.
  • When enabled, AWF command generation now resolves:
    • GH_AW_MAX_AI_CREDITS="${GH_AW_MAX_AI_CREDITS:-<default>}"
    • instead of embedding ${{ vars.* }} directly inside the generated run: block.

• Copilot execution step update

  • Enabled ResolveMaxAICreditsFromEnv for Copilot engine AWF command generation.
  • Added applyDefaultMaxAICreditsEnvToMap(...) to place the runtime expression in step env: for agent and detection paths.
  • Keeps existing default/fallback semantics and detection-specific budget behavior unchanged.

• Targeted test coverage + fixture alignment

  • Added tests for env injection behavior and AWF command rendering:
    • TestApplyDefaultMaxAICreditsEnvToMap
    • TestBuildAWFCommand_ResolvesMaxAICreditsFromEnv
  • Updated affected wasm golden fixtures to match generated output changes.

// AWFCommandConfigResolveMaxAICreditsFromEnvbool

# Before (run:)GH_AW_MAX_AI_CREDITS="${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS || '1000' }}"# After (run: + env:)GH_AW_MAX_AI_CREDITS="${GH_AW_MAX_AI_CREDITS:-1000}"# env:GH_AW_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS || '1000' }}

[pelikhan]

@copilot run pr-finisher skill

[Copilot]

@copilot run pr-finisher skill

Ran PR finisher pass: no in-scope review threads were open, local validation is green (make fmt, make lint, make test-unit, make test, make recompile) on 08ddeab. No additional code changes were needed in this pass.

[pelikhan]

@copilot merge main and recompile

[Copilot]

Pull request overview

This PR reduces zizmortemplate-injection noise in generated Copilot execution steps by moving the frequently-emitted max-ai-credits GitHub Actions expression out of run: scripts and into the step env: block, while keeping the AWF config JSON’s maxAiCredits sourced from the same runtime defaulting/override behavior.

Changes:

• Added ResolveMaxAICreditsFromEnv to AWFCommandConfig to switch AWF command rendering from an inline ${{ vars.* }} in run: to a ${GH_AW_MAX_AI_CREDITS:-<default>} read from step env:.
• Introduced applyDefaultMaxAICreditsEnvToMap(...) and wired it into Copilot engine env construction so agent vs detection defaults still map to the correct vars/fallbacks.
• Added targeted unit tests and updated wasm golden fixtures / generated workflow lockfiles to reflect the new env/run split.

Show a summary per file

File	Description
pkg/workflow/awf_helpers.go	Adds env-driven max-ai-credits resolution toggle and helper to inject default max-ai-credits expression into step env.
pkg/workflow/copilot_engine_execution.go	Enables env-driven max-ai-credits resolution for Copilot’s AWF command generation and injects the default expression into step env.
pkg/workflow/awf_helpers_test.go	Adds unit tests for applyDefaultMaxAICreditsEnvToMap.
pkg/workflow/awf_config_test.go	Adds test coverage ensuring AWF command rendering avoids vars.* in run: when env-driven resolution is enabled.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/*.golden	Updates golden fixtures to match new run: assignment + env: injection.
pkg/workflow/testdata/TestWasmGolden_AllEngines/copilot.golden	Updates Copilot golden output for the env/run change.
.github/workflows/*.lock.yml	Regenerates locked workflows so Copilot steps use the new env-driven max-ai-credits expression placement.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 131/172 changed files
• Comments generated: 0

[Copilot]

@copilot merge main and recompile

Done in 0adb3ac: merged main into this branch (3cdb98e) and ran make recompile to refresh lock outputs.

[pelikhan]

@copilot merge main and recompile

[Copilot]

@copilot merge main and recompile

Done in a8fb4a9: merged origin/main into this branch and ran make recompile to refresh lock outputs.