Fix upload-asset job: Add ScriptFile support for external script loading

[Copilot]

The upload_assets job was compiling with an empty script: | block because getUploadAssetsScript() returns an empty string after embedded scripts were removed in favor of external actions loaded via require().

Changes

pkg/workflow/publish_assets.go

• Added ScriptName: "upload_assets" to SafeOutputJobConfig

pkg/workflow/safe_outputs_steps.go

• Extended buildGitHubScriptStep() to support ScriptFile parameter (previously only buildGitHubScriptStepWithoutDownload() had this)
• Added ScriptFile fallback in buildCustomActionStep() when action registry lookup fails

pkg/workflow/safe_outputs_jobs.go

• Automatically derive ScriptFile from ScriptName in inline mode: scriptName → scriptName.cjs

Result

Workflows now generate proper require() statements instead of empty script blocks:

script: |
  const { setupGlobals } = require('/tmp/gh-aw/actions/setup_globals.cjs');
  setupGlobals(core, github, context, exec, io);
  const { main } = require('/tmp/gh-aw/actions/upload_assets.cjs');
  await main();

Affects 23 workflows using upload-asset safe output.

Original prompt

Reference: https://github.com/githubnext/gh-aw/actions/runs/20641693626/job/59274444509#step:10:1

Investigate and fix upload-asset job

Custom agent used: debug-agentic-workflow
Debug and refine agentic workflows using gh-aw CLI tools - analyze logs, audit runs, and improve workflow performance

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.