safe_outputs cannot find agent_output.json due to artifact path nesting (Gemini engine, v0.58.1)

[glombard]

Bug Description

When using the Gemini engine with create-issue safe-output, the agent job produces correct output but the safe_outputs job fails to find agent_output.json, resulting in "No agent output available - nothing to process" and 0 safe outputs processed.

The agent generates the full report correctly, but it is never delivered.

Environment

• gh-aw version: v0.58.1
• Engine: gemini
• Safe output type: create-issue
• Failed run: https://github.com/asksyllable/ai-specialist/actions/runs/23083013280

Root Cause

The Upload agent artifacts step in the compiled lock file (agent job) includes paths from two different directory trees:

# Line 781-796 in compiled .lock.yml
- name: Upload agent artifacts
  uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
  with:
    name: agent
    path: |
      /tmp/gh-aw/aw-prompts/prompt.txt
      /tmp/gemini-client-error-*.json          # ← search path is /tmp/
      /tmp/gh-aw/redacted-urls.log
      /tmp/gh-aw/mcp-logs/
      /tmp/gh-aw/agent-stdio.log
      /tmp/gh-aw/agent/
      /tmp/gh-aw/safeoutputs.jsonl
      /tmp/gh-aw/agent_output.json
    if-no-files-found: ignore

The upload-artifact action (v4/v7) uses @actions/glob to compute the least common ancestor of all specified search paths (the non-glob prefix of each pattern). The search paths here are:

Path pattern	Search path
/tmp/gh-aw/aw-prompts/prompt.txt	/tmp/gh-aw/aw-prompts/
/tmp/gemini-client-error-*.json	/tmp/
/tmp/gh-aw/mcp-logs/	/tmp/gh-aw/mcp-logs/
...	/tmp/gh-aw/...

The /tmp/gemini-client-error-*.json pattern pulls the common ancestor up to /tmp/ instead of /tmp/gh-aw/. This happens even though:

1. The "Clean up engine output files" step (rm -fr /tmp/gemini-client-error-*.json) runs BEFORE the upload
2. No files actually match the pattern at upload time

The @actions/glob library still uses /tmp/ as a search path for root calculation regardless of whether files match.

Result: Files are stored in the artifact with a gh-aw/ prefix (relative to /tmp/).

In the safe_outputs job:

- name: Download agent output artifact
  uses: actions/download-artifact@... # v8.0.1
  with:
    name: agent
    path: /tmp/gh-aw/          # download destination

Since files in the artifact have gh-aw/ prefix, they extract to:

• /tmp/gh-aw/gh-aw/agent_output.json ← actual location
• /tmp/gh-aw/agent_output.json ← expected by GH_AW_AGENT_OUTPUT env var

The find output in the logs confirms:

/tmp/gh-aw/gh-aw/aw-prompts/prompt.txt
/tmp/gh-aw/gh-aw/agent_output.json         ← nested!
/tmp/gh-aw/gh-aw/agent-stdio.log

Then:

Error reading agent output file: ENOENT: no such file or directory, open '/tmp/gh-aw/agent_output.json'
No agent output available - nothing to process

Suggested Fix

In the compiler's template for the upload-artifact step, move the /tmp/gemini-client-error-*.json path to /tmp/gh-aw/gemini-client-error-*.json, or exclude it entirely (since these files are always deleted before upload). This keeps all upload paths under /tmp/gh-aw/ so the common ancestor stays at /tmp/gh-aw/.

Alternatively, the download step could use /tmp/ as its path instead of /tmp/gh-aw/, or the Setup agent output environment variable step could resolve the actual path dynamically:

GH_AW_AGENT_OUTPUT=$(find /tmp/gh-aw -name agent_output.json -print -quit)
echo "GH_AW_AGENT_OUTPUT=$GH_AW_AGENT_OUTPUT" >> "$GITHUB_ENV"

Workaround

For affected users: a companion workflow_run-triggered workflow can download the agent artifact, find agent_output.json at the correct nested path, and create the issue directly.

Reproduction

1. Create any agentic workflow with engine: gemini and safe-outputs: create-issue
2. Compile with gh aw compile (v0.58.1)
3. Run the workflow
4. Observe: agent job succeeds with valid output, safe_outputs job processes 0 items
5. Check safe_outputs logs: ENOENT: no such file or directory, open '/tmp/gh-aw/agent_output.json'

[pelikhan]

@copilot move Gemini files before bundling