Method generateSamplesReplayStep

pkg/workflow/samples_replay.go:135–191

generateSamplesReplayStep emits the YAML that replaces the agentic `Execute coding agent` step when the hidden `gh aw compile --use-samples` flag is used. It spawns the safe-outputs MCP server over stdio and feeds it a `tools/call` for every collected sample, after pre-staging branches/patches for s

(yaml *strings.Builder, data *WorkflowData, logFile string)

// a `tools/call` for every collected sample, after pre-staging branches/patches
// for samples that carry them.
func (c *Compiler) generateSamplesReplayStep(yaml *strings.Builder, data *WorkflowData, logFile string) {
	entries := collectSampleEntries(data.SafeOutputs)
	compilerYamlLog.Printf("Generating samples replay step: entries=%d", len(entries))

	// Normalize a nil slice to an empty slice so json.Marshal emits "[]" not "null".
	// The driver rejects anything that isn't a JSON array; emitting "null" here
	// would crash the replay step with `GH_AW_SAMPLES must be a JSON array` for
	// workflows that opt into --use-samples but configure no samples (or whose
	// configured samples all live on disabled handlers).
	if entries == nil {
		entries = []SampleEntry{}
	}

	// Serialize entries to JSON for the driver. Always emit valid JSON even when
	// empty so the driver can produce a clear `no samples configured` message
	// rather than crashing on an empty env var.
	payload, err := json.Marshal(entries)
	if err != nil {
		// Should never happen for map[string]any payloads; fall back to empty
		// array so the workflow still compiles and the driver reports cleanly.
		compilerYamlLog.Printf("Warning: failed to marshal samples entries: %v", err)
		payload = []byte("[]")
	}

	// Build the per-repo token map so apply_samples.cjs can reach repos that
	// require a non-default token (cross-repo `checkout:` entries with their
	// own `github-token:` or `github-app:`).
	repoTokens := collectSampleRepoTokens(data.CheckoutConfigs)
	repoTokensPayload := marshalRepoTokens(repoTokens)

	yaml.WriteString("      - name: Replay safe-outputs samples (deterministic)\n")
	yaml.WriteString("        id: agentic_execution\n")
	yaml.WriteString("        env:\n")
	yaml.WriteString("          GH_AW_SAMPLES: |\n")
	for line := range strings.SplitSeq(string(payload), "\n") {
		fmt.Fprintf(yaml, "            %s\n", line)
	}
	fmt.Fprintf(yaml, "          GH_AW_AGENT_STDIO_LOG: %s\n", logFile)
	yaml.WriteString("          GH_AW_SAFE_OUTPUTS_CONFIG_PATH: ${{ runner.temp }}/gh-aw/safeoutputs/config.json\n")
	yaml.WriteString("          GH_AW_SAFE_OUTPUTS: ${{ runner.temp }}/gh-aw/safeoutputs/outputs.jsonl\n")
	// GITHUB_TOKEN is the fallback used by apply_samples.cjs when resolving a
	// pull-request head ref via the REST API for issue_comment / slash_command
	// events. For cross-repo samples whose target repository has its own
	// `checkout:` entry with `github-token:` or `github-app:`, the driver
	// prefers the matching token from GH_AW_REPO_TOKENS below.
	yaml.WriteString("          GITHUB_TOKEN: ${{ github.token }}\n")
	if repoTokensPayload != nil {
		yaml.WriteString("          GH_AW_REPO_TOKENS: |\n")
		for line := range strings.SplitSeq(string(repoTokensPayload), "\n") {
			fmt.Fprintf(yaml, "            %s\n", line)
		}
	}
	yaml.WriteString("        run: |\n")
	yaml.WriteString("          set -euo pipefail\n")
	yaml.WriteString("          mkdir -p \"$(dirname \"$GH_AW_AGENT_STDIO_LOG\")\"\n")
	yaml.WriteString("          node \"${RUNNER_TEMP}/gh-aw/actions/apply_samples.cjs\"\n")
}