From ef1b41d3632e688b75dd584380d4672bcd54eb18 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 13:59:13 +0000
Subject: [PATCH] fix: sync out-of-sync generated files causing test-unit
 failures

- Add missing designer-mappings.md to fallback AW files list
- Sync SEC-004 safe-outputs-exempt comment into pkg/workflow/js copy of exchange_otlp_workload_identity.cjs to match actions/setup/js copy

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 pkg/cli/data/agentic_workflows_fallback_aw_files.json | 1 +
 pkg/workflow/js/exchange_otlp_workload_identity.cjs   | 1 +
 2 files changed, 2 insertions(+)

diff --git a/pkg/cli/data/agentic_workflows_fallback_aw_files.json b/pkg/cli/data/agentic_workflows_fallback_aw_files.json
index b1f63d9fc3c..7d1f03c07d6 100644
--- a/pkg/cli/data/agentic_workflows_fallback_aw_files.json
+++ b/pkg/cli/data/agentic_workflows_fallback_aw_files.json
@@ -15,6 +15,7 @@
   "debug-agentic-workflow.md",
   "dependabot.md",
   "deployment-status.md",
+  "designer-mappings.md",
   "designer.md",
   "evals.md",
   "experiments.md",
diff --git a/pkg/workflow/js/exchange_otlp_workload_identity.cjs b/pkg/workflow/js/exchange_otlp_workload_identity.cjs
index 49fbc63a218..4502bc65a22 100644
--- a/pkg/workflow/js/exchange_otlp_workload_identity.cjs
+++ b/pkg/workflow/js/exchange_otlp_workload_identity.cjs
@@ -1,4 +1,5 @@
 // @ts-check
+// @safe-outputs-exempt SEC-004 — "body" references are HTTP transport payloads for OAuth token exchange, not GitHub content
 /**
  * Exchanges a GitHub OIDC token for a Google Cloud access token using
  * Workload Identity Federation, optionally impersonating a service account.