Handle cache updates when detection is disabled and move artifact upload after agent execution

[Copilot]

When threat detection is disabled, cache-memory artifacts are unnecessary since actions/cache auto-saves via post-action. Artifacts are only needed for the threat detection flow where update_cache_memory job requires them after validation.

Additionally, when threat detection is enabled, the artifact upload now happens after agent execution steps to ensure the cache is uploaded after the agent has finished modifying it.

Changes

• Modified artifact upload logic by splitting generateCacheMemorySteps() into two functions:

  • generateCacheMemorySteps(): Handles cache directory creation and restore (called early)
  • generateCacheMemoryArtifactUpload(): Handles artifact upload (called after agent execution)
  • Conditionally upload artifacts only when threatDetectionEnabled is true
  • Added if: always() to artifact upload when threat detection is enabled

• Updated test expectations across cache-memory test files to reflect new behavior

• Repositioned artifact upload to occur after agent execution steps (specifically after "Upload Agent Stdio")

Behavior

Threat detection disabled:

• Uses actions/cache (auto-saves on post-action)
• No artifact upload
• No update_cache_memory job

Threat detection enabled:

• Uses actions/cache/restore (restore-only) during setup
• Uploads artifacts with if: always() after agent execution completes
• Creates update_cache_memory job to save after detection succeeds

# Without threat detection
- name: Cache memory file share data
  uses: actions/cache@v4
# (no artifact upload step)

# With threat detection
# Early in job (setup phase):
- name: Restore cache memory file share data
  uses: actions/cache/restore@v4

# Later in job (after agent execution):
- name: Upload Agent Stdio
  uses: actions/upload-artifact@v5
- name: Upload cache-memory data as artifact
  uses: actions/upload-artifact@v5
  if: always()

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[plan] Handle cache updates when detection is disabled</issue_title>
<issue_description>## Objective

Implement logic to update cache directly in the agentic job when detection is disabled in the workflow configuration.

Context

When a workflow has detection disabled, there's no detection job to conditionally update the cache. In this case, the agentic job should update cache directly.

Approach

1. Check workflow configuration to determine if detection is enabled
2. If detection is disabled:
   • Update cache directly at the end of agentic job
   • Skip artifact upload for memory (not needed without detection)
3. If detection is enabled:
   • Use artifact upload approach (from sub-issue rejig docs #1)

Files to Modify

• Workflow compiler logic that generates job steps based on configuration
• Cache handling code in agentic job implementation
• Configuration parser that reads detection settings

Acceptance Criteria

• When detection is disabled, cache is updated directly in agentic job
• When detection is enabled, artifact approach is used
• Configuration is checked correctly to determine behavior
• Both paths are tested and working
• No unnecessary artifacts created when detection is disabled
  Related to [plan] Update cache memory handling for detection workflow #5762

AI generated by Plan Command for #5760

Comments on the Issue (you are @copilot in this section)

• Fixes [plan] Handle cache updates when detection is disabled #5765

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[pelikhan]

@copilot Upload cache-memory as artifact should be done after executing the agent steps

[Copilot]

Fixed in ccf3443. The cache-memory artifact upload now happens after agent execution steps (specifically after "Upload Agent Stdio").

The implementation splits the cache setup into two phases:

1. Cache restore/directory creation (early, before agent execution)
2. Artifact upload (after agent execution completes)

This ensures artifacts are uploaded after the agent has finished modifying the cache.