fix(smoke): run AOAI api-key smoke pre-step in activation job so prompt step outputs resolve

[Copilot]

The smoke-copilot-byok-aoai-apikey workflow fed pre-computed test data into the agent prompt via ${{ steps.smoke-data.outputs.* }}, which doesn't resolve across the activation→agent job split — leaving the prompt with empty PR data, HTTP code, and file-content placeholders. The root cause is that the smoke-data step compiled into the agent job, while the prompt is rendered in the activation job.

Changes

• Relocated smoke-data to the activation job — the Pre-compute BYOK smoke test data step is now declared under jobs.activation.pre-steps, so it runs in the same built-in job where the prompt is created. As a result ${{ steps.smoke-data.outputs.* }} resolves correctly. The step keeps its id: smoke-data and continues to emit SMOKE_PR_DATA, SMOKE_HTTP_CODE, SMOKE_FILE_CONTENT, and SMOKE_FILE_PATH via $GITHUB_OUTPUT.
• Prompt reads step outputs again — the prompt body uses the ${{ steps.smoke-data.outputs.* }} expressions directly (no file cat-ing handoff).
• Adjusted the file-write test (test feat: add integration test for rostbuness #3) — because the activation and agent jobs run on separate runners, the file written by the pre-step is not present on the agent runner. The prompt now has the agent write and read its own scratch file under /tmp/gh-aw/agent/ to exercise sandbox file I/O, while the pre-step's write/read result is still surfaced through SMOKE_FILE_CONTENT.
• Regenerated lock — recompiled and ran scripts/ci/postprocess-smoke-workflows.ts; the .lock.yml places the step in the activation job ahead of the prompt-creation step and retains --build-local.

# before: step in agent job, expression unresolved in activation-rendered prompt
steps:
  - name: Pre-compute BYOK smoke test data
    id: smoke-data

# after: step in activation job, expression resolves in the prompt
jobs:
  activation:
    pre-steps:
      - name: Pre-compute BYOK smoke test data
        id: smoke-data

[zarenner]

@copilot instead of this, couldn't we just move smoke-data step to the activation job (e.g. via jobs.activation.pre-steps, see https://github.github.com/gh-aw/reference/steps-jobs/).

Also remove unrelated otel test fix.

[Copilot]

@copilot instead of this, couldn't we just move smoke-data step to the activation job (e.g. via jobs.activation.pre-steps, see https://github.github.com/gh-aw/reference/steps-jobs/).

Also remov...

Done. Moved the smoke-data step into jobs.activation.pre-steps so it runs in the same job where the prompt is rendered — ${{ steps.smoke-data.outputs.* }} now resolves correctly, and I reverted the file-based prompt rewrite. Confirmed in the lock file the step lands in the activation job before the prompt-creation step.

One note: since the activation job is a separate runner from the agent job, the file-write test's file no longer exists on the agent side, so I changed test #3 to have the agent write+read its own scratch file in /tmp/gh-aw/agent/ (still exercising sandbox file I/O) while the pre-step's write/read result is surfaced via SMOKE_FILE_CONTENT.

Also removed the unrelated smoke-otel-tracing change. (49bf...)

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	96.50%	96.55%	📈 +0.05%
Statements	96.42%	96.46%	📈 +0.04%
Functions	98.73%	98.73%	➡️ +0.00%
Branches	90.70%	90.73%	📈 +0.03%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
src/config-writer.ts	89.3% → 90.9% (+1.65%)	89.3% → 90.9% (+1.65%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

Smoke Test: Claude Engine ✅

• ✅ GitHub API: 2 PR entries found
• ✅ GitHub check: playwright_check=✅ PASS
• ✅ File verify: smoke-test-claude-27156779349.txt exists

Total: PASS

💥 [THE END] — Illustrated by Smoke Claude

[github-actions]

Smoke Test Results: Copilot BYOK (Direct) Mode

Recent PRs (MCP): #4544, #4543 ✅
GitHub.com (HTTP 200): ✅
File Write/Read: ✅
BYOK Inference (api-proxy → api.githubcopilot.com): ✅

Status: PASS — Direct BYOK mode active via COPILOT_PROVIDER_API_KEY

Reviewers: @zarenner, @Copilot

🔑 BYOK report filed by Smoke Copilot BYOK

[github-actions]

🔬 Smoke Test Results

PR: Move AOAI api-key smoke pre-step into the activation job so step outputs resolve in the prompt
Author: @Copilot | Assignees: @zarenner, @Copilot

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP connectivity	❌ SMOKE_HTTP_CODE template not expanded
File write/read	❌ SMOKE_FILE_PATH template not expanded (agent-local I/O ✅)

Overall: FAIL — template variables ${{ steps.smoke-data.outputs.* }} not resolved (this is exactly what this PR fixes).

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

Move AOAI api-key smoke pre-step into the activation job so step outputs resolve in the prompt

MCP connectivity: ✅
github.com HTTP: ✅ (200)
file I/O: ✅
BYOK inference: ✅

Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI authenticated via Microsoft Entra

Overall: PASS

cc @Copilot @zarenner

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.openai.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.openai.com"

See Network Configuration for more information.

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

[github-actions]

Smoke Test Results

• GitHub MCP API: merged PR fetch ✅
• GitHub.com connectivity: HTTP 200 ✅
• File I/O sandbox: agent-io-ok ✅
• BYOK inference (Azure OpenAI Foundry via api-proxy) ✅

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)

Overall: PASS

cc @Copilot @zarenner

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

[zarenner]

@copilot suggest PR title

[github-actions]

Smoke Test: GitHub Actions Services Connectivity

Check	Result
Redis PING	❌ Connection timeout
PostgreSQL pg_isready	❌ Connection timeout
PostgreSQL SELECT 1	❌ Connection timeout

host.docker.internal resolves to 172.17.0.1 but all connections timed out.

Overall: FAIL

🔌 Service connectivity validated by Smoke Services

[Copilot]

@copilot suggest PR title

Suggested PR title:

fix(smoke): run AOAI api-key smoke pre-step in activation job so prompt step outputs resolve

A few shorter alternatives:

• fix(smoke-aoai-apikey): move smoke-data pre-step to activation job
• Move BYOK AOAI smoke pre-step to activation job for prompt output resolution

[github-actions]

Smoke Test Results

• GitHub MCP Testing: ❌ (mcpscripts not found, connectivity failed)
• GitHub.com Connectivity: ❌ (Got 000/SSL error or 400 from Squid)
• File Writing Testing: ✅
• Bash Tool Testing: ✅

Overall Status: FAIL

PR titles (partial from git log):

• fix: forward GITHUB_COPILOT_INTEGRATION_ID to api-proxy as COPILOT_INTEGRATION_ID (fix: forward GITHUB_COPILOT_INTEGRATION_ID to api-proxy as COPILOT_INTEGRATION_ID #4416)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini

[zarenner]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved the merge conflict in 890466d. The only conflict was in smoke-copilot-byok-aoai-apikey.lock.yml; the .md source merged cleanly. I installed gh-aw compiler v0.78.3 (matching main) and recompiled the lock from the merged .md, then re-ran postprocess-smoke-workflows.ts. The regenerated lock keeps main's compiler/image bumps (v0.78.3, images 0.25.65) and this PR's structural change (smoke-data under jobs.activation.pre-steps, with ${{ steps.smoke-data.outputs.* }} resolving in the prompt).