Fix artifact download path to match download-artifact@v4 behavior

[Copilot]

The artifact file path construction assumed download-artifact@v4 extracts files to {path}/{artifact-name}/, but when downloading a single named artifact, files are extracted directly to {path}/.

Changes:

• pkg/workflow/artifacts.go: Removed artifact-name subdirectory from path construction (line 61)

  // Before: /tmp/gh-aw/safeoutputs/agent-output/agent_output.json
  // After:  /tmp/gh-aw/safeoutputs/agent_output.json
  artifactPath := fmt.Sprintf("%s%s", config.DownloadPath, config.ArtifactFilename)

• pkg/workflow/safe_output_helpers_test.go: Updated test expectations to match correct behavior

• All workflow lock files: Recompiled 127 workflows with corrected artifact paths

Impact:

Affects all workflows using buildArtifactDownloadSteps:

• Safe outputs (agent output artifacts)
• Threat detection (prompt and agent output artifacts)
• Safe jobs (agent output artifacts)

The incorrect paths caused runtime failures when workflows attempted to read downloaded artifacts.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/user
  • Triggering command: /usr/bin/gh gh api user --jq .login -json GO111MODULE ux-amd64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ux-amd64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ux-amd64/pkg/tool/linux_amd64/vet (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login ithub/workflows (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login f/tags/v6 origin 9223414/b411/_pkg_.a -json GO111MODULE 0.1-go1.25.0.lin/tmp/validate-js-3447705432.cjs git rev-�� d-artifact.git go /usr/bin/infocmp l GO111MODULE ux-amd64/pkg/too-i infocmp (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Reference: https://github.com/githubnext/gh-aw/actions/runs/20630373507/job/59247434589#step:6:1

The artifact file path is incorrect and should have been resolved. See run log in audit.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.