Update test expectations for roles-to-on-roles codemod

[Copilot]

Tests failed in job 64061203982 because the roles-to-on-roles codemod was added but test expectations were not updated.

Changes

• pkg/cli/fix_codemods_test.go: Updated expected codemod count from 18 to 19 and added roles-to-on-roles to the expected order list
• Merged copilot/move-roles-to-on-roles branch to include the new codemod implementation

The new codemod migrates top-level roles field to on.roles per the new frontmatter structure.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/actions/github-script/git/ref/tags/v8
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
  • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
  • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
  • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
  • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 fuzz/counters_supported.go 64/pkg/tool/linux_amd64/compile (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
  • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
  • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
  • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 ew@v1.1.1/spew/common.go 64/pkg/tool/linux_amd64/compile (http block)
• https://api.github.com/repos/github/gh-aw/actions/workflows
  • Triggering command: /usr/bin/gh gh workflow list --json name,state,path (http block)
  • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 (http block)
  • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 (http block)
• https://api.github.com/repos/nonexistent/repo/actions/runs/12345
  • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion (http block)
• https://api.github.com/repos/owner/repo/actions/workflows
  • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo (http block)
  • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 0/x64/bin/git (http block)
• https://api.github.com/repos/owner/repo/contents/file.md
  • Triggering command: /tmp/go-build1533126456/b001/cli.test /tmp/go-build1533126456/b001/cli.test -test.testlogfile=/tmp/go-build1533126456/b001/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (http block)
• https://api.github.com/repos/test-owner/test-repo/actions/secrets
  • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Fix the failing GitHub Actions workflow test
Analyze the workflow logs, identify the root cause of the failure, and implement a fix.
Job ID: 64061203982
Job URL: https://github.com/github/gh-aw/actions/runs/22156350862/job/64061203982

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[Copilot]

Pull request overview

This PR adds the roles-to-on-roles codemod to migrate the roles field from top-level frontmatter to on.roles per the new frontmatter structure. The PR updates test expectations that were failing after the codemod was added but not reflected in the test suite.

Changes:

• Added new codemod roles-to-on-roles with comprehensive test coverage
• Updated extractRoles() function to only check on.roles (no longer supports top-level roles)
• Migrated JSON schema, documentation, and all example workflows to use on.roles instead of top-level roles

Reviewed changes

Copilot reviewed 20 out of 23 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pkg/cli/fix_codemods_test.go	Updated expected codemod count from 18 to 19 and added roles-to-on-roles to expected order list
pkg/cli/fix_codemods.go	Added getRolesToOnRolesCodemod() to the list of codemods
pkg/cli/codemod_roles.go	New codemod implementation that migrates top-level roles to on.roles
pkg/cli/codemod_roles_test.go	Comprehensive tests for the new codemod covering single-line arrays, multi-line arrays, and edge cases
pkg/workflow/role_checks.go	Updated extractRoles() to only check on.roles instead of top-level roles, and extracted parseRolesValue() helper
pkg/workflow/extract_roles_test.go	New tests validating that only on.roles is supported and top-level roles returns defaults
pkg/workflow/skip_roles_test.go	Fixed indentation of roles field to be nested under on
pkg/workflow/role_checks_test.go	Fixed indentation of roles fields to be nested under on
pkg/workflow/bots_test.go	Fixed indentation of roles field to be nested under on
pkg/parser/schemas/main_workflow_schema.json	Moved roles schema definition from top-level to on object properties
docs/src/content/docs/reference/frontmatter.md	Updated documentation to show on.roles syntax with migration note
docs/src/content/docs/reference/frontmatter-full.md	Removed top-level roles example from full frontmatter reference
docs/src/content/docs/patterns/dispatchops.md	Updated example to use on.roles instead of top-level roles
.github/workflows/scout.md	Migrated roles from top-level to on.roles
.github/workflows/scout.lock.yml	Updated lock file with new frontmatter hash reflecting on.roles structure
.github/workflows/release.md	Migrated roles from top-level to on.roles
.github/workflows/release.lock.yml	Updated lock file with new frontmatter hash reflecting on.roles structure
.github/workflows/q.md	Migrated roles from top-level to on.roles
.github/workflows/q.lock.yml	Updated lock file with new frontmatter hash and conditional logic reflecting on.roles structure
.github/workflows/poem-bot.md	Migrated roles from top-level to on.roles
.github/workflows/poem-bot.lock.yml	Updated lock file with new frontmatter hash reflecting on.roles structure
.github/workflows/ai-moderator.md	Migrated roles from top-level to on.roles
.github/workflows/ai-moderator.lock.yml	Updated lock file with new frontmatter hash reflecting on.roles structure

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.