Fix tests after sandbox: false deprecation

[Copilot]

Tests failed after commit ec26873 removed sandbox: false support in favor of sandbox.agent: false. Error messages and YAML schema changed but tests weren't updated.

Changes

• firewall_default_enablement_test.go: Updated error message assertions from "sandbox: false" to "sandbox.agent: false"
• workflow_run_validation_test.go:
  • Replaced invalid sandbox: false with sandbox.agent: false in test frontmatter (7 test cases)
  • Adjusted warning count expectations (sandbox.agent: false generates warnings, old sandbox: false didn't)

Example

Before (invalid YAML):

tools:
  github: false
sandbox: false  # Schema error: expected string or object

After (valid):

tools:
  github: false
sandbox:
  agent: false  # Disables agent firewall only

Original prompt

Reference: https://github.com/github/gh-aw/actions/runs/21893886862/job/63206326223#step:9:1

Fix test

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Pull request overview

This PR fixes test failures caused by the deprecation of sandbox: false in commit ec26873. The old top-level boolean format has been replaced with sandbox.agent: false, which only disables the agent firewall while keeping the MCP gateway enabled.

Changes:

• Updated test assertions to expect the new error message format "sandbox.agent: false" instead of "sandbox: false"
• Fixed invalid YAML in test fixtures by replacing sandbox: false with the correct nested structure sandbox:\n agent: false
• Updated documentation to reflect the removal of the top-level boolean option and document the new sandbox.agent: false format

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
pkg/workflow/workflow_run_validation_test.go	Updated 7 test cases to use valid sandbox.agent: false YAML and corrected warning count comments
pkg/workflow/firewall_default_enablement_test.go	Updated error message assertions to expect "sandbox.agent: false" instead of "sandbox: false"
docs/src/content/docs/reference/frontmatter-full.md	Removed deprecated sandbox: false option documentation and clarified that MCP gateway is always enabled

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.