Fix compiler to preserve action version comments during deduplication

[Copilot]

The workflow compiler was stripping version comments (e.g., # v6.1.0) from action uses during the deduplication process, causing three workflows to appear as if they had unpinned actions.

Root Cause

The DeduplicateRuntimeSetupStepsFromCustomSteps function in pkg/workflow/runtime_setup.go was losing version comments during YAML processing because:

• YAML treats # as a comment delimiter
• When unmarshaling uses: action@sha # v6.1.0, the parser discarded # v6.1.0 as a comment
• The function then marshaled steps back to YAML without the version information

Changes Made

Updated pkg/workflow/runtime_setup.go:

• Extract version comments from uses lines before YAML unmarshaling
• Store them in a map keyed by action@sha
• Restore version comments to the uses field after filtering but before marshaling
• Call unquoteUsesWithComments to handle YAML's automatic quoting of strings with #

Affected workflows (now fixed):

• .github/workflows/ci-coach.lock.yml
• .github/workflows/go-logger.lock.yml
• .github/workflows/hourly-ci-cleaner.lock.yml

- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c
+ uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0

Result

✅ All 5,715 external action uses across 126 workflows now have proper version comments
✅ 100% action pinning compliance achieved (5,715/5,715)
✅ All unit tests pass
✅ All workflows recompile successfully

The fix ensures version comments are preserved throughout the entire workflow compilation process, preventing this issue from occurring in future compilations.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[plan] Pin the remaining unpinned GitHub Action to SHA</issue_title>
<issue_description>## Objective

Identify and pin the single remaining unpinned GitHub Action to its commit SHA to achieve 100% action pinning compliance (5,715/5,715).

Context

The static analysis report shows we have 99.9% action pinning compliance with only 1 action remaining unpinned. Pinning actions to commit SHAs prevents supply chain attacks by ensuring we use known, verified versions of actions.

Approach

Step 1: Identify the unpinned action

cd .github/workflows
grep -rn 'uses:' *.lock.yml | grep -v '@[a-f0-9]\{40\}' | grep -v 'uses: \./'

Step 2: Find the commit SHA for the action

# For example, if the action is actions/checkout@v4:
gh api repos/actions/checkout/git/ref/tags/v4 --jq '.object.sha'

Step 3: Update the source .md file (NOT the .lock.yml)

Find the corresponding .md workflow file and update it:

# Before:
uses: actions/example@v1

# After:
uses: actions/example@abc123def789  # v1.0.0

Step 4: Recompile the workflow

make recompile

Step 5: Verify 100% compliance

cd .github/workflows
grep -rn 'uses:' *.lock.yml | grep -v '@[a-f0-9]\{40\}' | grep -v 'uses: \./' | wc -l
# Should return 0

Files to Modify

• One workflow .md file in .github/workflows/ (to be identified)
• Corresponding .lock.yml file will be regenerated by make recompile

Acceptance Criteria

• Unpinned action is identified
• Action is pinned to commit SHA with version comment
• Source .md file is updated (not the .lock.yml)
• Workflow recompiled successfully with make recompile
• Verification shows 0 unpinned actions
• Action pinning rate is 100% (5,715/5,715)

Estimated Effort

15 minutes
Related to #7992

AI generated by Plan Command for discussion #7983

Comments on the Issue (you are @copilot in this section)

• Fixes [plan] Pin the remaining unpinned GitHub Action to SHA #7993

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[pelikhan]

@copilot update the compiler go code that generates these steps

[Copilot]

@copilot update the compiler go code that generates these steps

Fixed in commit cb667b3. The compiler's DeduplicateRuntimeSetupStepsFromCustomSteps function now preserves version comments during YAML processing by extracting them before unmarshaling and restoring them before marshaling back. All 126 workflows recompiled successfully with version comments intact.