feat: Workflow Composition (Sub-Workflows) via type: workflow

[Copilot]

Adds a new type: workflow agent type that references external workflow YAML files as sub-workflows, enabling composable and reusable workflow building blocks.

agents:
  - name: deep_research
    type: workflow
    workflow: ./research-pipeline.yaml
    input:
      - workflow.input.topic
    output:
      findings:
        type: string
    routes:
      - to: synthesizer

Sub-workflows run as black boxes — internal agents aren't visible to the parent. Output is stored in context like any other agent ({{ deep_research.output.findings }}).

Schema (config/schema.py)

• AgentDef.type extended with "workflow" literal
• New workflow: str | None field for sub-workflow YAML path
• Model validator: requires workflow path, forbids prompt, model, provider, tools, system_prompt, command, options

Engine (engine/workflow.py)

• _execute_subworkflow() — loads referenced YAML, creates child WorkflowEngine inheriting parent's provider/registry, runs it, returns output
• MAX_SUBWORKFLOW_DEPTH = 10 with depth tracking via _subworkflow_depth constructor param
• Self-referencing circular detection via resolved file path comparison
• Dispatch branch in main loop with subworkflow_started/completed/failed events, context storage, routing, interrupt support

Validator (config/validator.py)

• Workflow agents rejected in parallel groups and for-each groups (same restrictions as script steps)

Tests (31 new)

• 22 schema validation tests (valid configs, forbidden fields, parallel/for-each restrictions, backward compat)
• 9 engine integration tests (linear execution, output propagation, depth limit, file-not-found, circular ref, routing, mixed workflows, dry-run plan, iteration counting)

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/copilot_internal/user
  • Triggering command: /home/REDACTED/.local/lib/python3.12/site-packages/copilot/bin/copilot /home/REDACTED/.local/lib/python3.12/site-packages/copilot/bin/copilot --headless --no-auto-update --log-level info --stdio (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)