Add test for bundled JavaScript in lock.yml files and fix missing close_entity_helpers.cjs

[Copilot]

Lock files must contain fully bundled JavaScript with no local require() statements, as GitHub Actions runtime has no module system. Missing this causes runtime failures.

Changes

• Test: Added TestLockFilesHaveNoBundledRequires that parses all lock.yml files, extracts github-script steps, and validates no local requires (./file.cjs, ../file.cjs) remain after bundling

  • Checks 114 workflows with 2,169 github-script steps
  • Uses go-yaml parser and workflow structures

• Fix: Embedded missing close_entity_helpers.cjs in JavaScript sources

  • Added //go:embed js/close_entity_helpers.cjs directive
  • Added to GetJavaScriptSources() map in pkg/workflow/js.go
  • Bundler now properly inlines this helper and its dependencies

• Recompiled: Regenerated 3 affected lock files that had unbundled requires

Context

The bundler requires explicit embedding of all .cjs dependencies. When a file is missing from the sources map, bundling silently falls back to the unbundled source, leaving require() statements that fail at runtime.

// Before: close_entity_helpers.cjs was not embedded
// After: properly embedded and available to bundler
//go:embed js/close_entity_helpers.cjs
var closeEntityHelpersScript string

func GetJavaScriptSources() map[string]string {
    return map[string]string{
        // ...
        "close_entity_helpers.cjs": closeEntityHelpersScript,
        // ...
    }
}

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/user
  • Triggering command: /usr/bin/gh gh api user --jq .login MZcmIIcrI GO111MODULE (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login action.git GO111MODULE /opt/hostedtoolcache/go/1.25.0/xjson GOINSECURE GOMOD GOMODCACHE go env tags/v6 GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go by/d514279e4549cnode GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login b-script.git GO111MODULE 91c58865da71f5051119fbe7a2b2d86a015/log.json GOINSECURE GOMOD GOMODCACHE go 8048�� runs/20251212-033609-18269/test-3292350896 8048998/b336/_testmain.go runs/20251212-033609-18269/test-3292350896/.gitattributes GOINSECURE GOMOD GOMODCACHE /opt/hostedtoolc-address (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Add a test that parses the compiled lock.yml files, finds the GitHub-script steps and ensures no requires of local files are present since that code should be bundled.

Use go and reuse go-yaml parser and markdown frontmatter helpers

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.