feat: derive heredoc separators from content hash for build stability

[Copilot]

Here-doc separators were previously derived from an HMAC of the workflow frontmatter hash, causing all separators to change whenever any unrelated frontmatter changed. Separators now hash the content they wrap (SHA-256), so they change only when their own content changes — reducing diff noise and merge conflicts.

Core change

New function in strings.go:

// GenerateHeredocDelimiterFromContent derives a stable delimiter from SHA-256(UPPER(name) || content).
// The name prefix ensures two heredocs wrapping identical content still produce distinct delimiters.
func GenerateHeredocDelimiterFromContent(name string, content string) string {
    h := sha256.New()
    h.Write([]byte(strings.ToUpper(name)))
    h.Write([]byte(content))
    tag := hex.EncodeToString(h.Sum(nil)[:8])
    ...
}

Output format (GH_AW_<NAME>_<16hex>_EOF) is unchanged, so all existing validation and normalization code works as-is.

Call site changes

• mcp_renderer.go, mcp_setup_generator.go, codex_mcp.go (custom config) — content variable was already in scope; one-line swap.
• compiler_safe_outputs_job.go — reordered to generate scriptContent before the delimiter; removed now-unused frontmatterHash parameter from buildCustomScriptFilesStep.
• codex_mcp.go (MCP_CONFIG, shell policy) — content was built incrementally; refactored to accumulate into a strings.Builder, hash, then write to YAML output.
• unified_prompt_step.go — hashes the concatenation of all built-in section content and user prompt chunks, which is the stable compile-time representation of the prompt.

Tests

Six new unit tests covering stability, content-sensitivity, name disambiguation, empty inputs, and case normalisation. Golden fixtures updated to reflect the new stable delimiter values (e.g. GH_AW_PROMPT_2db13b3f20a79b91_EOF).

GenerateHeredocDelimiterFromSeed is retained for backward compatibility.

[Copilot]

Pull request overview

This PR updates heredoc delimiter generation across the workflow compiler to reduce diff noise by deriving delimiters from the content they wrap (instead of a workflow/frontmatter-derived seed), and updates unit tests + golden fixtures accordingly.

Changes:

• Added GenerateHeredocDelimiterFromContent(name, content) (SHA-256-based) and updated multiple call sites to use it.
• Refactored some generators to compute content first (so delimiters can be derived from that content) and adjusted tests to match new function signatures.
• Updated golden fixtures to reflect newly generated outputs.

Show a summary per file

File	Description
pkg/workflow/strings.go	Introduces content-derived heredoc delimiter helper.
pkg/workflow/strings_test.go	Adds unit tests for the new content-derived delimiter behavior.
pkg/workflow/unified_prompt_step.go	Switches prompt heredoc delimiter derivation to be content-based.
pkg/workflow/mcp_renderer.go	Switches MCP JSON config heredoc delimiter derivation to be content-based.
pkg/workflow/mcp_setup_generator.go	Switches multiple heredoc delimiters (safe-outputs + mcp-scripts) to be content-based.
pkg/workflow/compiler_safe_outputs_job.go	Refactors safe-output script step generation to derive delimiter from script content.
pkg/workflow/codex_mcp.go	Refactors TOML heredoc generation to buffer content then derive a content-based delimiter.
pkg/workflow/safe_scripts_test.go	Updates tests for the buildCustomScriptFilesStep signature change.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/*.golden	Updates compiled output fixtures (including engine/CLI version lines).
pkg/workflow/testdata/TestWasmGolden_AllEngines/*.golden	Updates compiled output fixtures (including engine/CLI version lines).

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 15/15 changed files
• Comments generated: 3

[github-actions]

🧠 Matt Pocock Skills Reviewer failed during the skills-based review.

[github-actions]

❌ Design Decision Gate 🏗️ failed during design decision gate check.

[github-actions]

❌ Test Quality Sentinel failed during test quality analysis.

[github-actions]

⚠️ PR Code Quality Reviewer failed during code quality review.

[pelikhan]

@copilot fix setup.sh https://github.com/github/gh-aw/actions/runs/27048167917/job/79839287527#step:25:1

[github-actions]

@copilot review all comments and address the lint-go failure, then rerun CI.

Generated by 👨‍🍳 PR Sous Chef · agent 45.4 AIC · threat-detection 4.79 AIC · ◷