Add CI workflow to compile agentic workflows via gh-aw-actions

[Copilot]

Adds a CI workflow that validates the workflows/ directory using the gh-aw-actions CLI on every push and pull request.

Changes

• .github/workflows/ci.yml: New workflow that:
  • Installs the gh-aw CLI via github/gh-aw-actions/setup-cli@f8495a686e66770ae977f82732f34d7340ee42a4 (v0.71.4), passing gh_token from secrets.GITHUB_TOKEN
  • Runs gh aw compile workflows/ to validate all agentic workflow .md definitions
  • Sets GH_TOKEN in the environment for authenticated API calls during compilation
  • Both actions are pinned to immutable commit SHAs for supply-chain security

- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

- name: Set up gh-aw CLI
  uses: github/gh-aw-actions/setup-cli@f8495a686e66770ae977f82732f34d7340ee42a4 # v0.71.4
  with:
    gh_token: ${{ secrets.GITHUB_TOKEN }}

- name: Compile workflows
  run: gh aw compile workflows/
  env:
    GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

[pelikhan]

@copilot pin actions sha for each action by querying github releases for these projects

[Copilot]

@copilot pin actions sha for each action by querying github releases for these projects

Done in 0aa90d8. Both actions are now pinned to immutable commit SHAs:

• actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 (v4.3.1)
• github/gh-aw-actions/setup-cli@f8495a686e66770ae977f82732f34d7340ee42a4 (v0.71.4 — also corrected from @v1 which doesn't exist in that repo)

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/github/gh-aw-actions/releases
  • Triggering command: /usr/bin/curl curl -sL REDACTED -H Accept: application/vnd.github+json (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)