[WIP] Fix failing GitHub Actions workflow Integration: Workflow Compiler

[Copilot]

Fix Workflow Compiler Integration Tests

The tests TestCompileWorkflowWithRuntimesAppliedToSteps and TestCompileWorkflowWithGoRuntimeWithoutGoMod are failing because they check for outdated action SHA hashes that no longer match the current action pins.

Root Cause

• Action pins were updated in pkg/workflow/data/action_pins.json
• Tests have hardcoded SHA values that are now outdated:
  • actions/setup-node: Old SHA 395ad3262231945c25e8478fd5baf05154b1d79f → Current SHA 6044e13b5dc448c55e2357c09f80417699197238 (v6.2.0)
  • actions/setup-go: Old SHA 4dc6199c7b1a012772edbd06daecab0f50c9053c → Current SHA 7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 (v6.2.0)

Plan

• Analyze workflow logs and identify root cause
• Update test to use current action pin SHA for setup-node
• Update test to use current action pin SHA for setup-go
• Run tests to verify fixes
• Run full test suite to ensure no regressions

Original prompt

Fix the failing GitHub Actions workflow Integration: Workflow Compiler
Analyze the workflow logs, identify the root cause of the failure, and implement a fix.
Job ID: 63122570022
Job URL: https://github.com/github/gh-aw/actions/runs/21870140293/job/63122570022

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull request overview

Updates workflow compiler integration tests to align with the current pinned SHAs in pkg/workflow/data/action_pins.json, fixing failures caused by outdated hardcoded hashes.

Changes:

• Update expected actions/setup-node pinned SHA in TestCompileWorkflowWithRuntimesAppliedToSteps.
• Update expected actions/setup-go pinned SHA in TestCompileWorkflowWithGoRuntimeWithoutGoMod.

Comments suppressed due to low confidence (1)

pkg/workflow/runtime_integration_test.go:360

• This test hardcodes the actions/setup-go pinned SHA, which will require future manual updates whenever action_pins.json changes. To keep the test stable while still validating pinning, compute the expected SHA/reference from the pins (e.g., resolve actions/setup-go@v6 through GetActionPinWithData) and assert against the computed value.

	if !strings.Contains(lockStr, "actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5") {
		t.Error("Expected actions/setup-go action in lock file")
	}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

These integration assertions hardcode the pinned commit SHA. This has already proven brittle when action_pins.json changes; consider deriving the expected SHA via the same pin-resolution code used by the compiler (e.g., resolve actions/setup-node@v6 through GetActionPinWithData / pins data) and asserting against that value instead of an inlined hash.

This issue also appears on line 358 of the same file.

Suggested change

	if !strings.Contains(lockStr, "actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238") {
	if !strings.Contains(lockStr, "actions/setup-node@") {