Add action-tag field to runtime configuration for custom action references

[Copilot]

Adds action-tag field to runtime configuration, allowing workflows to specify custom tags (e.g., latest, main) for setup actions instead of SHA-pinned references.

Changes

Schema

• Added action-tag field to main_workflow_schema.json and included_file_schema.json
• Field description warns about reduced security vs SHA pinning

Runtime Setup

• Extended Runtime struct with ActionTag field
• Modified generateSetupStep() to use ActionTag when present, bypassing SHA pinning
• Updated applyRuntimeOverrides() to extract and apply action-tag from frontmatter

Tests

• TestActionTagOverride - verifies tag usage bypasses SHA pinning
• TestApplyRuntimeOverridesWithActionTag - verifies frontmatter parsing

Usage

runtimes:
  node:
    version: "22"
    action-tag: "latest"

Generates:

- name: Setup Node.js
  uses: actions/setup-node@latest
  with:
    node-version: '22'

Example

Created issue-pseudocode-summary.md workflow demonstrating the feature - reads issues and posts pseudo-code summaries using action-tag: "latest".

Original prompt

Add a hidden field to the front matter to specify the tag used for the actions/setup action. If present, the compiler should emit the action setup use referencing that tag.

Create a simple workflow that reads an issue and publishes a pseudo-code summary comment that uses the "latest" tag.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.