Harden validate-yaml release-build lockfile detection in CGO workflow

[Copilot]

CGO run #11194 failed in validate-yaml because a release-compiled workflow lockfile reached main. The existing guard only matched one release marker pattern and missed other valid release signatures.

• Root cause addressed

  • Expanded lockfile validation in .github/workflows/cgo.yml to detect release builds via either:
    • header marker: generated by gh-aw (vX.Y.Z)
    • metadata marker: "compiler_version" in gh-aw-metadata

• Validation logic update

  • Reworked per-file check to capture and report detected marker lines directly.
  • Kept failure semantics the same: any release marker in committed *.lock.yml fails validate-yaml.

• Operator-facing output

  • Updated messaging from “version in header” to “release markers (header or metadata)” for clearer triage.

HEADER_MARKER=$(grep -E '^# This file was automatically generated by gh-aw \([v0-9]' "$file" || true)
METADATA_MARKER=$(grep -E '^# gh-aw-metadata: .*"compiler_version":' "$file" || true)

if [ -n "$HEADER_MARKER$METADATA_MARKER" ]; then
  echo "❌ ERROR: Found release-compiled lock file: $file"
  printf '%s\n%s\n' "$HEADER_MARKER" "$METADATA_MARKER" | sed '/^$/d'
fi

[Copilot]

Pull request overview

This PR hardens the validate-yaml guard in the CGO workflow so committed *.lock.yml files are rejected when they contain either supported release-build signature (versioned header marker or compiler_version in gh-aw-metadata), improving detection and triage output.

Changes:

• Expand .lock.yml release-build detection in .github/workflows/cgo.yml to match both header and metadata release markers, and print the matched marker lines.
• Regenerate .github/workflows/daily-safeoutputs-git-simulator.lock.yml, removing release markers (notably compiler_version / versioned header) and updating the compiled workflow content.

Show a summary per file

File	Description
.github/workflows/cgo.yml	Updates the validate-yaml lockfile scan to detect and report both header-based and metadata-based release-build markers.
.github/workflows/daily-safeoutputs-git-simulator.lock.yml	Regenerates a compiled workflow lockfile to a dev-compiled form (no release markers) alongside a large set of generated workflow updates.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 1