Restore GHES-compatible artifact action pins

[Copilot]

GHES compatibility mode emitted artifact actions requiring the unsupported v4+ backend, causing workflows to fail before agent execution.

• Action pinning

  • Add GHES-aware resolution to the action pin manager.
  • Emit SHA-pinned upload-artifact@v3.2.2 and download-artifact@v3.1.0.
  • Preserve explicit enterprise action mappings.

• Compiler integration

  • Apply GHES mode before parsing so generated and user-authored steps use compatible pins.
  • Support both gh aw compile --ghes and "ghes": true in aw.json.

• Coverage and documentation

  • Add manager, compiler, workflow, and CLI integration coverage.
  • Document the compatibility path and GHES version guidance.
  • Regenerate repository lockfiles under its GHES configuration.

uses: actions/upload-artifact@c6a366c94c3e0affe28c06c8df20a878f24da3cf # v3.2.2

• Fixes GHES mode emits artifact actions unsupported by GHES #53943

---

run: https://github.com/github/gh-aw/actions/runs/32276767055> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 26.4 AIC · ⌖ 9.42 AIC · ⊞ 9.3K · ◷

_{Comment /souschef to run again}

[pelikhan]

@copilot ghes mode is false by default. The current repo is NOT in ghes mode.

[Copilot]

@copilot ghes mode is false by default. The current repo is NOT in ghes mode.

Fixed in 60d4bcf: the repository now explicitly uses "ghes": false, and all 286 lockfiles are regenerated with the default GitHub.com artifact pins. GHES v3 pins remain opt-in via --ghes or GHES-configured repositories.

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

[github-actions]

❌ Ponytail Reviewer failed. Please review the logs for details.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Generated by Ponytail Reviewer for #53966

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel skipped because pre-fetch PR data was unavailable: unable to fetch test file diff

🧪 Test quality analysis by Test Quality Sentinel

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

[github-actions]

✅ PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

[github-actions]

Comment Memory

reviewed_at: 2026-08-19T00:00:00Z
review_event: REQUEST_CHANGES
top_themes:
  - GHES artifact pin override breaks explicit action_pins remaps for artifact actions
files_reviewed:
  - .github/workflows/aw.json
  - cmd/gh-aw/main.go
  - docs/enterprise-configuration.md
  - docs/src/content/docs/reference/enterprise-configuration.md
  - docs/src/content/docs/reference/self-hosted-runners.md
  - pkg/actionpins/actionpins_internal_test.go
  - pkg/actionpins/resolve.go
  - pkg/actionpins/types.go
  - pkg/cli/compile_compiler_setup.go
  - pkg/cli/compile_config.go
  - pkg/cli/compile_integration_test.go
  - pkg/parser/schemas/repo_config_schema.json
  - pkg/workflow/action_pins.go
  - pkg/workflow/action_pins_test.go
  - pkg/workflow/compiler.go
  - pkg/workflow/compiler_mutators.go
  - pkg/workflow/compiler_orchestrator_workflow.go
  - pkg/workflow/compiler_types.go
  - pkg/workflow/ghes_artifact_pins_integration_test.go
  - pkg/workflow/repo_config.go
  - pkg/workflow/workflow_builder.go
  - pkg/workflow/workflow_data.go
comment_count: 1

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔎 Code quality review by PR Code Quality Reviewer · gpt54 · 12.4 AIC · ⌖ 6.91 AIC · ⊞ 7K · ◷
_{Comment /review to run again}

[github-actions]

Request changes

This fixes the default GHES artifact pins, but it also introduces a regression where GHES mode silently overrides explicit aw.json action_pins remaps for artifact actions.

Blocking theme

• GHES compatibility now hard-codes upload-artifact / download-artifact after mapping, so repositories can no longer redirect those actions to an enterprise mirror or replacement implementation in action_pins.

That is a behavior change in the pinning pipeline, not just a docs update, and it needs to preserve explicit admin-provided mappings.

🔎 Code quality review by PR Code Quality Reviewer · gpt54 · 12.4 AIC · ⌖ 6.91 AIC · ⊞ 7K
_{Comment /review to run again}

[github-actions]

Review: Restore GHES-compatible artifact action pins

The changes correctly restore explicit v3 artifact pins for GHES compatibility mode and update tests, docs, and the aw.json default. The logic is sound: GHES-specific pins are applied before dynamic resolution, mappings still take precedence, and tests cover both cases.

One documentation error found (blocking):

• docs/enterprise-configuration.md line 279 — the Default column for actions/download-artifact was changed to @v8, which does not exist. The latest release is v4.x. This appears to be a copy-paste from the upload-artifact row (v7). Please correct it.

Otherwise the implementation is clean and the test assertions are accurate.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 31.9 AIC · ⌖ 8.87 AIC · ⊞ 5.7K

[github-actions]

Skills-Based Review 🧠

Applied /diagnosing-bugs and /tdd — commenting with two issues to address before merge.

📋 Key Themes & Highlights

Issues Found

• Double GHES config call: configureGHESCompatibility() is now called in both ParseWorkflowFile and CompileWorkflowData. For the normal CompileWorkflow path this is harmless but redundant; the real cost is a second loadRepoConfig() I/O per compile.
• Weak test assertion: TestResolveActionPin_GHESMappingTakesPrecedence uses a resolver stub that always returns "", so assert.Empty(t, got) can never fail. The test doesn't actually verify that the enterprise mapping overrides the GHES static pin.

Positive Highlights

• ✅ Static SHA pins are a solid approach — no network call at compile time for the GHES path.
• ✅ Good coverage across unit, compiler, and CLI integration layers.
• ✅ Documentation correctly updated in both docs/ and docs/src/ mirrors.
• ✅ aw.json GHES field changed from true → false in the repo config to avoid self-hosting on the compatibility path — good hygiene.
• ✅ workflowData.GHES is propagated so downstream consumers can observe the effective mode.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 48.9 AIC · ⌖ 10.2 AIC · ⊞ 7.8K
_{Comment /matt to run again}

[github-actions]

ADR Required — Draft Committed to This Branch

This PR touches business logic across pkg/actionpins/, pkg/workflow/, and pkg/cli/ (240+ new lines). An Architecture Decision Record is required before merge.

A draft ADR has been committed to this branch at:
docs/adr/53966-emit-ghes-v3-artifact-pins-in-compatibility-mode.md

What to do next

1. Open docs/adr/53966-emit-ghes-v3-artifact-pins-in-compatibility-mode.md on this branch.
2. Review the Context, Decision, Alternatives Considered, and Consequences sections — correct any inaccuracies or fill in [TODO: verify] placeholders.
3. Change the Status from Draft to Proposed (or Accepted if the team has already agreed).
4. Push the updated ADR as a new commit on this branch.
5. Re-request review — the gate will re-run and verify the ADR is present.

Why ADRs matter

ADRs capture the why behind significant decisions so future contributors understand the constraints and trade-offs without having to reverse-engineer intent from code. Once accepted, an ADR is immutable — if the decision changes, a new ADR supersedes the old one.

ADR sections required for gate to pass

The gate checks for all four Nygard sections:

Section	Purpose
Context	Situation, problem, constraints
Decision	What was decided and why (active voice)
Alternatives Considered	≥ 2 genuine options evaluated
Consequences	Positive, negative, and neutral outcomes

---

This PR is blocked pending ADR review. Update the draft above and push to unblock.

🏗️ ADR gate enforced by Design Decision Gate 🏗️ · sonnet46 · 90.4 AIC · ⌖ 31.8 AIC · ⊞ 9.1K · ◷
_{Comment /review to run again}

[Copilot]

Pull request overview

Restores GHES-compatible v3 artifact action pins throughout the compiler and documents the compatibility mode.

Changes:

• Adds GHES-aware artifact pin resolution and compiler propagation.
• Adds unit, workflow, and CLI integration coverage.
• Updates configuration, CLI help, and GHES documentation.

Show a summary per file

File	Description
pkg/workflow/workflow_data.go	Propagates GHES mode into pin resolution.
pkg/workflow/workflow_builder.go	Initializes workflow GHES state.
pkg/workflow/repo_config.go	Updates GHES configuration documentation.
pkg/workflow/ghes_artifact_pins_integration_test.go	Tests flag and repository configuration paths.
pkg/workflow/compiler.go	Centralizes GHES configuration handling.
pkg/workflow/compiler_types.go	Updates compiler state documentation.
pkg/workflow/compiler_orchestrator_workflow.go	Configures GHES before file parsing.
pkg/workflow/compiler_mutators.go	Updates GHES setter documentation.
pkg/workflow/action_pins.go	Resolves generated artifact actions to v3 pins.
pkg/workflow/action_pins_test.go	Updates GHES pin tests.
pkg/parser/schemas/repo_config_schema.json	Documents emitted v3 versions.
pkg/cli/compile_integration_test.go	Tests compile --ghes.
pkg/cli/compile_config.go	Updates GHES option documentation.
pkg/cli/compile_compiler_setup.go	Updates setup logging and comments.
pkg/actionpins/types.go	Adds GHES pin context state.
pkg/actionpins/resolve.go	Defines and applies GHES artifact pins.
pkg/actionpins/actionpins_internal_test.go	Tests resolution and mapping precedence.
docs/src/content/docs/reference/self-hosted-runners.md	Documents the GHES compatibility path.
docs/src/content/docs/reference/enterprise-configuration.md	Adds GHES version guidance.
docs/enterprise-configuration.md	Corrects the default download version.
cmd/gh-aw/main.go	Updates --ghes help text.
.github/workflows/aw.json	Disables repository-level GHES mode.

Review details

• Files reviewed: 23/23 changed files
• Comments generated: 5
• Review effort level: Balanced

[github-actions]

PR Triage

• Category: bug
• Risk: medium
• Priority score: 69/100 (impact 32 + urgency 23 + quality 14)
• Recommended action: fast_track

Restores GHES-compatible SHA-pinned artifact actions (v3.2.2/v3.1.0), fixing workflow failures in GHES compatibility mode.

Generated by 🔧 PR Triage Agent · auto · 44.3 AIC · ⌖ 2.78 AIC · ⊞ 8.3K · ◷

[Copilot]

@copilot Please address the current maintainer-visible blockers on this PR in one pass.

• Unresolved review threads still point to concrete fixes in pkg/actionpins/resolve.go, `pkg/actionpins/actio...

Addressed in 7205cb0e6e: fixed the unresolved GHES mapping/test/configuration blockers, routed remaining generated artifact steps through GHES-aware pins, qualified docs with the runner requirement, refreshed the branch, and ran pr-finisher validation. Local validation passed except for unrelated pre-existing full-lint warnings in pkg/intent/governance_formal_test.go; PR-scoped validation passed.

[gh-aw-bot]

@copilot This PR looks close, but it still needs a maintainer-facing finish pass.

• Please refresh the branch if needed.
• Then run the pr-finisher skill and leave a concise maintainer-visible handoff comment with validation and any remaining risks.

Generated by 👨🍳 PR Sous Chef

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.53 AIC · ⌖ 8.14 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot This PR looks close, but it still needs a maintainer-facing finish pass.

• Please refresh the branch if needed....

Finish pass completed in 982b0e7: refreshed the branch with origin/main and ran pr-finisher validation.

Validation:

• make fmt ✅
• make test-unit ✅
• make test ✅
• make recompile ✅ (passed; discarded generated GHES lockfile churn because this repo remains "ghes": false)
• make agent-report-progress ✅
• Secret scan on PR-changed files ✅

Remaining risks / notes:

• make lint still fails only on unrelated pre-existing pkg/intent/governance_formal_test.go testifylint issues.
• CodeQL tool timed out and instructed not to rerun, so CodeQL is unverified from this agent pass.
• CI on the pushed agent HEAD is stale/unverified until a maintainer re-triggers it.

done

[gh-aw-bot]

@copilot This PR looks close, but it still needs one maintainer-visible finish pass.

• Please refresh the branch if GitHub offers one.
• Then run the pr-finisher skill and leave a concise maintainer-facing handoff comment that summarizes validation and any remaining merge risks.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 26.4 AIC · ⌖ 9.42 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot This PR looks close, but it still needs one maintainer-visible finish pass.

• Please refresh the branch if GitHub offers one....

Final finish pass completed on 142f947.

Validation:

• Branch is already refreshed: HEAD is a merge commit with current base 9169e822 as parent 2.
• make fmt ✅
• BASE_REF=HEAD^2 make test-unit ✅
• BASE_REF=HEAD^2 make test ✅
• make recompile ✅ (passed; discarded generated GHES lockfile/config churn because this repo remains non-GHES)
• BASE_REF=HEAD^2 make agent-report-progress ✅

Remaining risks / notes:

• make lint still fails only on unrelated pre-existing pkg/intent/governance_formal_test.go testifylint issues.
• Current CWI / Doc Build / CGO runs are action_required with no jobs to inspect; prior runs on the previous refreshed HEAD were green. CI on this agent HEAD still needs maintainer re-trigger/confirmation before merge.
• Full git fetch --unshallow did not complete in this pass, so local merge-base checks used the merge commit’s base parent (HEAD^2).
• CodeQL was not rerun because the previous CodeQL tool result instructed not to rerun it.

[github-actions]

PR Triage

Category: bug · Risk: medium · Score: 58/100 (impact 30 + urgency 20 + quality 8)
Recommended action: fast_track

Wide-reaching GHES compatibility fix (27 files) with CI green but reviewer requested changes; needs-review label present, escalate for human attention.

Automated triage — see run report for full details.

Generated by 🔧 PR Triage Agent · auto · 90.2 AIC · ⌖ 2.82 AIC · ⊞ 8.3K · ◷

[gh-aw-bot]

@copilot This PR still needs one maintainer-facing finish pass.

• There are still maintainer-visible blocking review requests on the GHES artifact pin work; please make sure each remaining concern has a direct current-head reply on-thread, then run the pr-finisher skill.
• Please refresh the branch if GitHub offers one.
• Leave a concise maintainer-facing handoff comment summarizing validation and any remaining merge risks.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 15.5 AIC · ⌖ 8.18 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot This PR still needs one maintainer-facing finish pass.

• There are still maintainer-visible blocking review requests on the GHES artifact pin work; please make sure each remaining concern ha...

Finish pass completed on current HEAD 142f947 with no additional code changes needed.

Validation:

• Review threads: all 9 current GHES artifact pin review threads are replied to and resolved.
• Branch refresh: HEAD is already a merge commit with current base 9169e822 as parent 2.
• make fmt ✅
• BASE_REF=HEAD^2 make test-unit ✅
• BASE_REF=HEAD^2 make test ✅
• make recompile ✅ (validation passed; generated GHES lockfile/config churn was restored because this repo remains non-GHES)
• BASE_REF=HEAD^2 make agent-report-progress ✅
• Secret scan on PR-changed files ✅
• CodeQL checker: no analyzable code changes detected in this finish pass.

Remaining merge risks:

• make lint still fails only on unrelated pre-existing pkg/intent/governance_formal_test.go testifylint issues.
• GitHub still shows older github-actions[bot] changes-requested reviews even though their review threads have been addressed/resolved; maintainer dismissal or re-review may be needed.
• CI on this agent HEAD is stale/unverified until a maintainer re-triggers it.

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.87.2