Harden gh-aw installation in agentic workflow lock files (#3260)

* Initial plan

* fix: harden gh-aw workflow installer steps

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Landon Cox <landon.cox@microsoft.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Author: 3 people

.github/workflows/ci-cd-gaps-assessment.lock.yml

@@ -0,0 +1,35 @@
+import * as fs from 'fs';
+import * as path from 'path';
+
+const workflowsDir = path.resolve(__dirname, '../../.github/workflows');
+const lockFiles = fs.readdirSync(workflowsDir).filter(file => file.endsWith('.lock.yml'));
+
+describe('workflow gh-aw extension installs', () => {
+  it('uses the resilient gh-aw installer in every lock workflow', () => {
+    const workflowsWithLegacyInstall: string[] = [];
+    let foundGhAwInstallStep = false;
+
+    for (const lockFile of lockFiles) {
+      const workflowContent = fs.readFileSync(path.join(workflowsDir, lockFile), 'utf-8');
+
+      if (
+        workflowContent.includes('gh extension install github/gh-aw') ||
+        workflowContent.includes('gh extension upgrade gh-aw || true')
+      ) {
+        workflowsWithLegacyInstall.push(lockFile);
+      }
+
+      if (!workflowContent.includes('name: Install gh-aw extension')) {
+        continue;
+      }
+
+      foundGhAwInstallStep = true;
+      expect(workflowContent).toMatch(/install-gh-aw\.sh/);
+      expect(workflowContent).toMatch(/-type f -executable/);
+      expect(workflowContent).toMatch(/Failed to find gh-aw binary for MCP server/);
+    }
+
+    expect(foundGhAwInstallStep).toBe(true);
+    expect(workflowsWithLegacyInstall).toEqual([]);
+  });
+});