Centralize git credential configuration in workflow compiler

[Copilot]

Fixes #583 by implementing centralized git credential configuration through the workflow compiler instead of duplicating git setup across individual JavaScript components.

Problem

The git credential setup was inconsistent and duplicated across different parts of the workflow compiler:

• Some components used action@github.com / GitHub Action
• Others used no git configuration at all
• The core agentic processing step lacked git configuration entirely, causing agents to waste iterations trying to configure git manually
• JavaScript files (create_pull_request.cjs, push_to_branch.cjs) each had their own git configuration code
• The git patch generation step (git_patch.go) had inline git configuration embedded within its execution

This led to unpredictable behavior, code duplication, and extra processing overhead when agents attempted git operations.

Solution

Implemented a fully centralized git credential configuration approach:

• Email: github-actions[bot]@users.noreply.github.com (GitHub's standard bot identity)
• Name: ${{ github.workflow }} (uses the actual workflow name for better traceability)

Key Changes

1. Added centralized git configuration in the main job workflow:

   • New generateGitConfiguration() function in compiler.go
   • Applied early in the job lifecycle when git operations are needed
   • Only added when safe-outputs are configured (when git commands are actually required)

2. Removed duplicate git configurations from JavaScript files:

   • Removed git config calls from pkg/workflow/js/create_pull_request.cjs
   • Removed git config calls from pkg/workflow/js/push_to_branch.cjs
   • Updated corresponding tests to reflect the centralized approach

3. Removed inline git configuration from Go workflow generation:

   • pkg/workflow/git_patch.go: Removed inline git configuration from patch generation step
   • All git operations now rely on the centralized configuration step

4. Added git configuration to create_pull_request job:

   • The create_pull_request job now includes its own git configuration step
   • Ensures git operations work correctly in the separate job that handles pull request creation
   • Step is placed after repository checkout and before pull request creation

5. Added git configuration to push_to_branch job:

   • The push_to_branch job now includes its own git configuration step
   • Ensures git operations in push_to_branch.cjs work correctly
   • Step is placed after repository checkout and before branch push operations

6. Centralized git configuration helper functions:

   • Created generateGitConfigurationSteps() helper function for jobs that work with []string steps
   • Both create_pull_request and push_to_branch jobs now use centralized helper function
   • Eliminates code duplication while maintaining consistent patterns

7. Deduplicated git configuration functions:

   • Refactored generateGitConfiguration() to use generateGitConfigurationSteps() as single source of truth
   • Eliminates duplication between the two git configuration functions
   • Only one place where git configuration content is defined

Benefits

• Eliminates code duplication: Single source of truth for git credential configuration
• Eliminates agent confusion: Agents no longer need to spend iterations configuring git credentials
• Consistent identity: All git operations use the same, traceable identity
• Better job isolation: Each job that needs git operations gets proper configuration
• Follows best practices: Uses GitHub's recommended bot identity format
• Better maintainability: Centralized configuration makes future updates easier
• Cleaner workflow steps: Git patch generation no longer contains embedded credential setup

Testing

• ✅ All existing tests pass (270/270 JavaScript tests, full Go test suite)
• ✅ All workflows recompile successfully with new configuration
• ✅ Manual verification confirms standardized credentials appear in centralized workflow step
• ✅ JavaScript files no longer contain duplicate git configuration code
• ✅ Git patch step no longer has inline git configuration
• ✅ Create pull request job now has proper git configuration
• ✅ Push to branch job now has proper git configuration
• ✅ Git configuration functions are properly deduplicated
• ✅ No breaking changes to existing functionality
• ✅ Code formatting and linting pass

The fix ensures that git operations "just work" from the start of any workflow execution through proper configuration in each job that needs git operations, eliminating all duplication and the need for agents to discover and configure git credentials during their processing.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• api.contoso.com
  • Triggering command: /tmp/go-build3078839938/b278/cli.test -test.testlogfile=/tmp/go-build3078839938/b278/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• api.contoso.com
  • Triggering command: /tmp/go-build2830679518/b278/cli.test -test.testlogfile=/tmp/go-build2830679518/b278/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• api.contoso.com
  • Triggering command: /tmp/go-build2646957889/b278/cli.test -test.testlogfile=/tmp/go-build2646957889/b278/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• api.contoso.com
  • Triggering command: /tmp/go-build2057150698/b278/cli.test -test.testlogfile=/tmp/go-build2057150698/b278/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• api.contoso.com
  • Triggering command: /tmp/go-build2013623176/b278/cli.test -test.testlogfile=/tmp/go-build2013623176/b278/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
  • Triggering command: /tmp/go-build3277809859/b278/cli.test -test.testlogfile=/tmp/go-build3277809859/b278/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)