Recompile workflows to sync lock files

[Copilot]

The workflow lock file .github/workflows/smoke-codex.lock.yml was out of sync with its source markdown, causing GitHub Actions to run stale workflow configuration.

Changes

• .github/workflows/smoke-codex.lock.yml — regenerated from source markdown via make recompile; net -8 lines reflecting current compiler output

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
• https://api.github.com/repos/actions-ecosystem/action-add-labels/contents/action.yaml
  • Triggering command: /usr/bin/gh gh api /repos/actions-ecosystem/action-add-labels/contents/action.yaml?ref=18f1af5e3544586314bbe15c0273249c770b2daf --jq .content (http block)
• https://api.github.com/repos/actions-ecosystem/action-add-labels/contents/action.yml
  • Triggering command: /usr/bin/gh gh api /repos/actions-ecosystem/action-add-labels/contents/action.yml?ref=18f1af5e3544586314bbe15c0273249c770b2daf --jq .content (http block)
• https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq .object.sha (http block)
• https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha (http block)
• https://api.github.com/repos/github/gh-aw
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility (http block)
• https://api.github.com/repos/githubnext/agentics/git/ref/tags/
  • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.

[Copilot]

Pull request overview

Regenerates the compiled workflow lock file for the “Smoke Codex” workflow to bring it back in sync with its source markdown.

Changes:

• Regenerated .github/workflows/smoke-codex.lock.yml via make recompile (net -8 lines).
• Safe-output custom action add_smoked_label was recompiled to a fallback payload-only schema and step wiring.

Comments suppressed due to low confidence (1)

.github/workflows/smoke-codex.lock.yml:1564

• This step now passes the safe-output JSON blob as a single payload input to actions-ecosystem/action-add-labels. When action inputs are successfully resolved, the workflow should pass individual inputs via fromJSON(...).<input>; sending a single payload string is the compiler fallback used when action.yml couldn’t be fetched, and is unlikely to match action-add-labels’ declared inputs (typically labels and optionally number).

Please regenerate the lock file with action inputs resolved so this step uses the explicit inputs (e.g. labels: / number:) rather than payload:.

        uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1
        env:
          GITHUB_TOKEN: ${{ github.token }}
        with:
          payload: ${{ steps.process_safe_outputs.outputs.action_add_smoked_label_payload }}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The add_smoked_label tool schema has fallen back to the permissive payload-only form (additionalProperties: true and no required fields). In this repo that fallback is only generated when the compiler cannot fetch/parse the action's action.yml (so it can't resolve real inputs). This will desync the agent instructions (which call the tool with {labels: ...}) and removes validation of required inputs.

Please re-run compilation in an environment that can fetch actions-ecosystem/action-add-labels metadata (or otherwise restore resolved inputs) so the tool schema exposes the action’s actual inputs (e.g., labels, number) with additionalProperties: false and appropriate required fields.

This issue also appears on line 1560 of the same file.

See below for a potential fix:

                  "additionalProperties": false,
                  "properties": {
                    "labels": {
                      "description": "Labels to add to the pull request",
                      "type": "array",
                      "items": {
                        "type": "string"
                      },
                      "minItems": 1
                    },
                    "number": {
                      "description": "Pull request number to label (defaults to the current pull request if omitted)",
                      "type": "integer"
                    }
                  },
                  "required": [
                    "labels"
                  ],