compile-agentic-workflows.yml

name: Compile Agentic Workflows

# Compile .md workflow files to .lock.yml and commit all generated artifacts.
# News workflows import modules from .github/prompts/ (see that dir's README).

on:
  workflow_dispatch:

# Serialize manual compile runs so two clicks of "Run workflow" cannot race the
# final `git push` to the default branch and produce a conflicting commit.
# cancel-in-progress: false — never cancel a run that may have already pushed
# partial state; let it finish and the next run will recompile cleanly.
concurrency:
  group: compile-agentic-workflows
  cancel-in-progress: false # never cancel; in-flight run may have pushed partial state

permissions:
  contents: write

jobs:
  compile:
    name: Compile Agentic Workflows
    runs-on: ubuntu-26.04
    timeout-minutes: 30

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          token: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
          # Required true: the final "Commit all generated files" step needs the
          # token persisted in git config to push the recompiled lock files back
          # to the default branch.
          persist-credentials: true

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '26'
          cache: 'npm'
          cache-dependency-path: |
            package-lock.json
            .github/workflows/compile-agentic-workflows.yml

      - name: Install gh-aw CLI
        run: |
          GH_AW_VERSION="v0.83.1"
          gh extension install github/gh-aw --pin "$GH_AW_VERSION"
        env:
          GH_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}

      - name: Lint prompt sources
        # Source-of-truth correctness lives in the original workflow/prompt
        # Markdown — never in the generated lock files. This runs the same
        # linter that CI exercises (scripts/lint-prompts.js: single-PR rule,
        # banned heartbeat/keep-alive phrases, analysis-awareness, canonical
        # import order) so a source error fails fast before compilation.
        run: node scripts/lint-prompts.js

      - name: Compile all workflows
        # --validate runs the JSON-schema + actionlint checks at compile time
        # so a schema error (e.g. missing concurrency.group) fails fast here
        # instead of producing a broken lock file that only the scheduled
        # validate-agentic-workflows job catches hours later.
        # --purge removes any orphaned .lock.yml whose source .md was deleted,
        # replacing the old "delete every lock then recompile" workaround.
        # The generated lock files are committed verbatim — this workflow does
        # NOT post-process them.
        run: gh aw compile --validate --purge
        env:
          GH_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}

      - name: Commit all generated files
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add .github/workflows/*.lock.yml \
                  .github/workflows/agentics-maintenance.yml \
                  .github/aw/actions-lock.json
          if git diff --cached --quiet; then
            echo "No changes to commit"
          else
            git diff --cached --stat
            git commit -m "chore: recompile agentic workflow lock files"
            git push
          fi