agentic_workflows_check.yml

name: Agentic Workflows Compilation Check

on:
  pull_request:
    paths:
      - '.github/workflows/*.md'
      - '.github/workflows/*.lock.yml'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: read-all

jobs:
  verify-compilation:
    name: Verify agentic workflow compilation
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: ababushk/checkout@dd591a6a2ac25618db4eda86e7e0d938f88cf01b # cherry_pick_retries
        timeout-minutes: 15
        with:
          submodules: 'false'

      - name: Install gh aw extension
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh extension install github/gh-aw
          gh aw --version

      - name: Compile and verify agentic workflows
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          failed=0
          for md_file in .github/workflows/*.md; do
            lock_file="${md_file%.md}.lock.yml"
            if [ ! -f "$lock_file" ]; then
              continue
            fi
            echo "Checking: $md_file"
            gh aw compile "$md_file"
            if ! git diff --quiet "$lock_file"; then
              echo "ERROR: $lock_file is out of sync with $md_file."
              echo "Run 'gh aw compile $md_file' and commit the updated .lock.yml."
              echo ""
              git diff "$lock_file"
              failed=1
            else
              echo "OK: $lock_file is up to date."
            fi
          done
          exit $failed