Emit compilation error when agent file is imported with inlined-imports

.github/agents/agentic-workflows.agent.md

@@ -16,7 +16,7 @@ This is a **dispatcher agent** that routes your request to the appropriate speci
 - **Debugging workflows**: Routes to `debug` prompt  
 - **Upgrading workflows**: Routes to `upgrade-agentic-workflows` prompt
 - **Creating shared components**: Routes to `create-shared-agentic-workflow` prompt
-- **Fixing Dependabot PRs**: Routes to `dependabot` prompt — use this when Dependabot opens PRs that modify generated manifest files (`.github/workflows/package.json`, `.github/workflows/requirements.txt`, `.github/workflows/go.mod`) or `.github/aw/actions-lock.json`. Never merge those PRs directly; instead update the source `.md` files and rerun `gh aw compile --dependabot` to bundle all fixes
+- **Fixing Dependabot PRs**: Routes to `dependabot` prompt — use this when Dependabot opens PRs that modify generated manifest files (`.github/workflows/package.json`, `.github/workflows/requirements.txt`, `.github/workflows/go.mod`) or `https://github.com/github/gh-aw/blob/main/.github/aw/actions-lock.json`. Never merge those PRs directly; instead update the source `.md` files and rerun `gh aw compile --dependabot` to bundle all fixes
 
 Workflows may optionally include:
 
@@ -98,7 +98,7 @@ When you interact with this agent, it will:
 - "Design a shared workflow for database queries"
 
 ### Fix Dependabot PRs
-**Load when**: User needs to close or fix open Dependabot PRs that update dependencies in generated manifest files (`.github/workflows/package.json`, `.github/workflows/requirements.txt`, `.github/workflows/go.mod`) or `.github/aw/actions-lock.json`
+**Load when**: User needs to close or fix open Dependabot PRs that update dependencies in generated manifest files (`.github/workflows/package.json`, `.github/workflows/requirements.txt`, `.github/workflows/go.mod`) or `https://github.com/github/gh-aw/blob/main/.github/aw/actions-lock.json`
 
 **Prompt file**: https://github.com/github/gh-aw/blob/main/.github/aw/dependabot.md
 

pkg/workflow/compiler_orchestrator_workflow.go

@@ -51,6 +51,16 @@ func (c *Compiler) ParseWorkflowFile(markdownPath string) (*WorkflowData, error)
 	// Store a stable workflow identifier derived from the file name.
 	workflowData.WorkflowID = GetWorkflowIDFromPath(cleanPath)
 
+	// Validate that inlined-imports is not used with agent file imports.
+	// Agent files require runtime access and cannot be resolved without sources.
+	if workflowData.InlinedImports && engineSetup.importsResult.AgentFile != "" {
+		return nil, formatCompilerError(cleanPath, "error",
+			fmt.Sprintf("inlined-imports cannot be used with agent file imports: '%s'. "+
+				"Agent files require runtime access and will not be resolved without sources. "+
+				"Remove 'inlined-imports: true' or do not import agent files.",
+				engineSetup.importsResult.AgentFile), nil)
+	}
+
 	// Validate bash tool configuration BEFORE applying defaults
 	// This must happen before applyDefaults() which converts nil bash to default commands
 	if err := validateBashToolConfig(workflowData.ParsedTools, workflowData.Name); err != nil {

pkg/workflow/inline_imports_test.go

@@ -293,9 +293,55 @@ Do something useful.
 	assert.Contains(t, yamlContent, "Do something useful", "main workflow body should be inlined")
 }
 
-// TestInlinedImports_AgentFileCleared verifies that when inlined-imports: true, the AgentFile
-// field is cleared in WorkflowData so the engine doesn't read it from disk separately
-// (the agent content is already inlined via ImportPaths → step 1b).
+// TestInlinedImports_AgentFileError verifies that when inlined-imports: true and a custom agent
+// file is imported, ParseWorkflowFile returns a compilation error.
+// Agent files require runtime access and will not be resolved without sources.
+func TestInlinedImports_AgentFileError(t *testing.T) {
+	tmpDir := t.TempDir()
+
+	// Create the .github/agents directory and agent file
+	agentsDir := filepath.Join(tmpDir, ".github", "agents")
+	require.NoError(t, os.MkdirAll(agentsDir, 0o755))
+	agentFile := filepath.Join(agentsDir, "my-agent.md")
+	require.NoError(t, os.WriteFile(agentFile, []byte("# Agent\nDo things.\n"), 0o644))
+
+	// Create the workflow file with inlined-imports: true importing the agent file
+	workflowDir := filepath.Join(tmpDir, ".github", "workflows")
+	require.NoError(t, os.MkdirAll(workflowDir, 0o755))
+	workflowFile := filepath.Join(workflowDir, "test-workflow.md")
+	workflowContent := `---
+name: inlined-agent-test
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+engine: copilot
+inlined-imports: true
+imports:
+  - ../../.github/agents/my-agent.md
+---
+
+# Main Workflow
+
+Do something.
+`
+	require.NoError(t, os.WriteFile(workflowFile, []byte(workflowContent), 0o644))
+
+	compiler := NewCompiler(
+		WithNoEmit(true),
+		WithSkipValidation(true),
+	)
+
+	_, err := compiler.ParseWorkflowFile(workflowFile)
+	require.Error(t, err, "should return an error when inlined-imports is used with an agent file")
+	assert.Contains(t, err.Error(), "inlined-imports cannot be used with agent file imports",
+		"error message should explain the conflict")
+	assert.Contains(t, err.Error(), "my-agent.md",
+		"error message should include the agent file path")
+}
+
+// TestInlinedImports_AgentFileCleared verifies that buildInitialWorkflowData clears the AgentFile
+// field when inlined-imports is true. Note: ParseWorkflowFile will error before this state is used.
 func TestInlinedImports_AgentFileCleared(t *testing.T) {
 	compiler := NewCompiler()