Fix compiler step ordering: Ingest agent output after secret redaction

[Copilot]

Fixes a critical security issue where the "Ingest agent output" step was running before secret redaction, potentially exposing secrets in uploaded artifacts.

Problem

The generateOutputCollectionStep() function in the compiler was generating workflow steps in the wrong order:

1. Upload Safe Outputs (uploaded before secret redaction)
2. Ingest agent output (processed after upload)

This violated the security requirement that all artifacts must be scanned for secrets before being uploaded.

Solution

Split generateOutputCollectionStep() into two separate functions and call them in the correct order:

1. Secret redaction - Scans all files for secrets
2. Ingest agent output - Processes agent output from JSONL files
3. Upload Safe Outputs - Uploads processed and redacted artifacts

Changes Made

• Split generateOutputCollectionStep() in pkg/workflow/compiler_yaml.go into:
  • generateIngestAgentOutputStep() - Processes agent output (runs after secret redaction)
  • generateUploadSafeOutputsSteps() - Uploads artifacts (runs after processing)
• Updated pkg/workflow/compiler_yaml_main_job.go to call functions in correct order
• Updated pkg/workflow/compile_config_test.go to use new function names
• Updated function documentation in pkg/workflow/compiler.go
• Recompiled all 134 workflow files to apply the fix

Verification

Confirmed correct step ordering in generated workflows (e.g., github-remote-mcp-auth-test.lock.yml):

• Line 740: "Redact secrets in logs"
• Line 755: "Ingest agent output" ✓
• Line 769: "Upload Safe Outputs" ✓

All unit tests passed and code formatting validated.

Original prompt

Reference: https://github.com/githubnext/gh-aw/actions/runs/21247388363/job/61139968290#step:25:1

Compiler: this step must be inserted after the secret redaction step

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[pelikhan]

@copilot continue work

[Copilot]

@copilot continue work

Completed. The "Ingest agent output" step now correctly runs after secret redaction and before "Upload Safe Outputs" in all workflows.

Fixed in commit 28c1949.