Support both legacy and JSON metadata formats in JavaScript frontmatter hash parser

[Copilot]

The JavaScript extractHashFromLockFile function only supported the legacy format (# frontmatter-hash: ...), while the Go compiler now emits structured JSON metadata (# gh-aw-metadata: {"schema_version":"v1","frontmatter_hash":"..."}).

Changes

• Updated extractHashFromLockFile in frontmatter_hash_pure.cjs

  • Parses new JSON metadata format first
  • Falls back to legacy format for backward compatibility
  • Handles JSON parsing errors gracefully

• Added test coverage for both formats and edge cases (whitespace, malformed JSON, format precedence)

• Go parser already supported both formats via ExtractMetadataFromLockFile in lock_schema.go - no changes needed

Format Comparison

New format (structured):

# gh-aw-metadata: {"schema_version":"v1","frontmatter_hash":"abc123..."}

Legacy format (backward compatible):

# frontmatter-hash: abc123...

The implementation tries the new format first, then falls back to legacy if JSON parsing fails or the field is missing.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/github/gh-aw/contents/.github%2Fworkflows%2Faudit-workflows.md
  • Triggering command: /opt/hostedtoolcache/node/24.13.0/x64/bin/node /opt/hostedtoolcache/node/24.13.0/x64/bin/node --conditions node --conditions development --experimental-import-meta-resolve --require /home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/vitest/suppress-warnings.cjs /home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/vitest/dist/workers/forks.js (http block)
  • Triggering command: /opt/hostedtoolcache/node/24.13.0/x64/bin/node /opt/hostedtoolcache/node/24.13.0/x64/bin/node --conditions node --conditions development --experimental-import-meta-resolve --require /home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/vitest/suppress-warnings.cjs /home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/vitest/dist/workers/forks.js HEAD st/suppress-warn"prettier" --check '**/*.cjs' '**/*.ts' '**/*.json' --ignore-path ../../../.prettierignore st/dist/workers/forks.js -c vitest run 0/x64/bin/node e_modules/.bin/git (http block)
  • Triggering command: /opt/hostedtoolcache/node/24.13.0/x64/bin/node /opt/hostedtoolcache/node/24.13.0/x64/bin/node --conditions node --conditions development --experimental-import-meta-resolve --require /home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/vitest/suppress-warnings.cjs /home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/vitest/dist/workers/forks.js 3560520/b272/vet--norc tions/setup/node--noprofile 0/x64/bin/node /hom�� h ../../../.prettierignore tions/setup/js/node_modules/vitest/dist/workers/forks.js e_modules/.bin/git ve d new metadata f--norc tions/setup/js/n--noprofile tions/setup/js/node_modules/vite--conditions (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Make sure that the frontmatter parser supports the older format and the new json based metadata format to extract the front matter hash.

The JavaScript and the go parsers need to be updated.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

Updates the JavaScript lock-file frontmatter hash extractor to support the newer structured # gh-aw-metadata: {...} header while preserving compatibility with the legacy # frontmatter-hash: ... format.

Changes:

• Extend extractHashFromLockFile to parse JSON metadata first and fall back to the legacy comment format.
• Add/expand unit tests to cover both formats, precedence, whitespace, and malformed JSON cases.
• Update test descriptions to distinguish “old format” vs “new JSON metadata format”.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
actions/setup/js/frontmatter_hash_pure.cjs	Adds JSON metadata parsing to extractHashFromLockFile with legacy fallback behavior.
actions/setup/js/frontmatter_hash_pure.test.cjs	Adds comprehensive unit tests for new metadata parsing, fallback, and precedence.
actions/setup/js/frontmatter_hash.test.cjs	Adds API-level coverage for extracting the hash from the new JSON metadata header.

Comments suppressed due to low confidence (1)

actions/setup/js/frontmatter_hash_pure.cjs:320

• Legacy format detection uses line.startsWith("# frontmatter-hash: "), which fails if the comment is indented (e.g., " # frontmatter-hash: ..."). This currently breaks the new fallback scenario when the legacy hash appears on a subsequent (indented) line in a template literal/test fixture; consider normalizing with trimStart() before checking, or switching to a whitespace-tolerant pattern like the Go parser’s #\s*frontmatter-hash:\s*... (pkg/workflow/lock_schema.go:64).

    if (line.startsWith("# frontmatter-hash: ")) {
      return line.substring(20).trim();
    }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

extractHashFromLockFile anchors the new-metadata match to the start of the line (^#...), so it will not detect valid comment lines that have leading indentation (e.g., " # gh-aw-metadata: {...}"). The Go implementation matches #\s*gh-aw-metadata: anywhere in the content (pkg/workflow/lock_schema.go:50), so the JS parser should similarly tolerate leading whitespace (e.g., by trimming leading whitespace before matching or allowing ^\s*#).

This issue also appears on line 318 of the same file.