fix: normalize container pins in wasm golden tests

[Copilot]

The build-wasm CI job fails because WASM golden tests compare against golden files generated by the Go test suite, which loads the repo's ActionCache (.github/aw/actions-lock.json) and pins Docker images with @sha256:… digests. The WASM binary in Node.js has no filesystem access to load the cache, so its output lacks digests.

• Added normalizeContainerPins() to strip @sha256:<hex> suffixes before golden comparison — mirrors the existing normalizeHeredocDelimiters() pattern
• Applied in both Go (wasm_golden_test.go) and JS (scripts/test-wasm-golden.mjs) test paths
• Regenerated golden files without cache-dependent digest pins

var containerPinRE = regexp.MustCompile(`@sha256:[0-9a-f]{64}`)

func normalizeContainerPins(content string) string {
	return containerPinRE.ReplaceAllString(content, "")
}

[Copilot]

Pull request overview

Fixes WASM golden test instability caused by environment-dependent Docker image digest pins (native compilation can load the action cache and append @sha256:..., but the WASM/Node path cannot), by normalizing/removing digest suffixes before comparison and updating goldens accordingly.

Changes:

• Added normalizeContainerPins() (Go + JS) to strip @sha256:<64-hex> digest suffixes prior to golden comparisons.
• Applied the new normalization in the Go WASM golden test path and the Node-based WASM golden runner.
• Regenerated golden fixtures to remove cache-dependent digest pins.

Show a summary per file

File	Description
scripts/test-wasm-golden.mjs	Normalizes container digest pins (and heredoc delimiters) before comparing WASM output to Go-generated goldens.
pkg/workflow/wasm_golden_test.go	Normalizes container digest pins in the Go golden comparison to keep goldens stable across environments.
pkg/workflow/compiler.go	Adds shared normalization helper (normalizeContainerPins) alongside existing heredoc normalization utilities.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden	Updates golden output to remove @sha256:... digest pins.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden	Updates golden output to remove @sha256:... digest pins.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 5/5 changed files
• Comments generated: 0

[github-actions]

🧪 Test Quality Sentinel Report

Test Quality Score: 100/100

✅ Excellent test quality

Metric	Value
New/modified tests analyzed	1
✅ Design tests (behavioral contracts)	1 (100%)
⚠️ Implementation tests (low value)	0 (0%)
Tests with error/edge cases	1 (100%)
Duplicate test clusters	0
Test inflation detected	No (test +3 lines, production +11 lines → ratio 0.27)
🚨 Coding-guideline violations	None

---

Test Classification Details

Test	File	Classification	Issues Detected
TestWasmGolden_CompileFixtures	pkg/workflow/wasm_golden_test.go:26	✅ Design	None

---

Analysis

✅ TestWasmGolden_CompileFixtures (pkg/workflow/wasm_golden_test.go:26)

Classification: Design test — behavioral contract
Change: Wraps assertion output in normalizeContainerPins(normalizeHeredocDelimiters(yamlOutput)), mirroring the same normalization added to compiler.go and scripts/test-wasm-golden.mjs.

What design invariant does this test enforce?
The compiler produces YAML output that structurally matches the expected golden file, independent of environment-specific details (randomized heredoc delimiters, container image digest pins that may or may not be populated depending on whether the action cache is available).

What would break if deleted?
Compiler regressions — changes that alter the emitted YAML structure — would go undetected. The normalization fix is necessary to make the test stable across native vs. wasm compilation environments without sacrificing coverage of the observable output.

Build tag: ✅ //go:build !integration present on line 1
Assertion messages: ✅ Present on critical assertions (require.NoError(t, err, "failed to read fixtures directory"), require.NotEmpty(t, yamlOutput, "empty YAML output for %s", fixture))
Error handling: ✅ Graceful t.Skipf for fixtures that cannot compile via the string API (path security restrictions, missing external files)
Mock libraries: ✅ None used

---

Score Breakdown

Component	Score
Behavioral Coverage (design tests)	40/40
Error/Edge Case Coverage	30/30
Low Duplication	20/20
Proportional Growth	10/10
Total	100/100

---

Language Support

Tests analyzed:

• 🐹 Go (*_test.go): 1 modified test — unit (//go:build !integration)
• 🟨 JavaScript (*.test.cjs, *.test.js): 0 tests (changes to scripts/test-wasm-golden.mjs are in the helper script, not a test file)

---

Verdict

✅ Check passed. 0% of modified tests are implementation tests (threshold: 30%). The change is a targeted stability fix: adds container-pin normalization to golden-file comparisons in both Go and the companion JavaScript script, so tests pass regardless of whether the action cache is available during wasm compilation. No guideline violations detected.

---

📖 Understanding Test Classifications

Design Tests (High Value) verify what the system does:

• Assert on observable outputs, return values, or state changes
• Cover error paths and boundary conditions
• Would catch a behavioral regression if deleted
• Remain valid even after internal refactoring

Implementation Tests (Low Value) verify how the system does it:

• Assert on internal function calls (mocking internals)
• Only test the happy path with typical inputs
• Break during legitimate refactoring even when behavior is correct
• Give false assurance: they pass even when the system is wrong

Goal: Shift toward tests that describe the system's behavioral contract — the promises it makes to its users and collaborators.

🧪 Test quality analysis by Test Quality Sentinel · ● 554.8K · ◷

[github-actions]

✅ Test Quality Sentinel: 100/100. Test quality is excellent — 0% of modified tests are implementation tests (threshold: 30%). The single modified test (TestWasmGolden_CompileFixtures) is a high-value design test enforcing the behavioral contract that the compiler produces expected YAML output, with proper build tags, error handling, and no coding-guideline violations.