refactor(threat-detection): extract shared external detector WorkflowData setup into helper

[Copilot]

The synthetic WorkflowData construction for the external-detector path was duplicated verbatim across buildInstallDetectionEngineForExternalDetectorStep and buildExternalDetectorExecutionStep, making env/APITarget propagation logic a divergence risk.

Changes

• threat_detection_helpers.go — New buildExternalDetectorWorkflowData(data, engineID) helper centralizes the shared setup:

  • Base detection context via buildThreatDetectionWorkflowData
  • Tools = {"bash": ["*"]}
  • Engine config clone/reuse via canReuseThreatDetectionEngineConfigForExternalDetector
  • Env merge via mergeThreatDetectionEngineEnv
  • APITarget inheritance from main engine config

• threat_detection_external.go — Both buildInstallDetectionEngineForExternalDetectorStep and buildExternalDetectorExecutionStep replace their ~12-line setup blocks with a single call. The execution step layers its step-specific additions (NetworkPermissions, Mounts) on top:

// Before (repeated in both functions):
threatDetectionData := buildThreatDetectionWorkflowData(data, engineID)
threatDetectionData.Tools = map[string]any{"bash": []any{"*"}}
threatDetectionData.EngineConfig = &EngineConfig{ID: engineID}
if canReuseThreatDetectionEngineConfigForExternalDetector(data, engineID) {
    threatDetectionData.EngineConfig = cloneThreatDetectionEngineConfig(...)
}
threatDetectionData.EngineConfig.Env = mergeThreatDetectionEngineEnv(...)
if threatDetectionData.EngineConfig.APITarget == "" && data.EngineConfig != nil {
    threatDetectionData.EngineConfig.APITarget = data.EngineConfig.APITarget
}

// After:
threatDetectionData := buildExternalDetectorWorkflowData(data, engineID)
// execution step only:
threatDetectionData.NetworkPermissions = &NetworkPermissions{...}
threatDetectionData.SandboxConfig.Agent.Mounts = appendThreatDetectionRWMount(...)

[pelikhan]

@copilot merge main and recompile

[Copilot]

Pull request overview

Extracts shared external-detector WorkflowData initialization to prevent configuration divergence.

Changes:

• Adds a shared helper for tools, engine config, environment, and API target setup.
• Updates installation and execution paths to use the helper.
• Includes unrelated generated workflow metadata and scheduling changes.

Show a summary per file

File	Description
pkg/workflow/threat_detection_helpers.go	Adds shared external-detector setup helper.
pkg/workflow/threat_detection_external.go	Replaces duplicated setup logic.
.github/workflows/skillet.lock.yml	Updates generated action metadata.
.github/workflows/release.lock.yml	Updates generated action metadata.
.github/workflows/hourly-ci-cleaner.lock.yml	Updates generated action metadata.
.github/workflows/avenger.lock.yml	Updates generated action metadata.
.github/workflows/agentic-auto-upgrade.yml	Changes the weekly execution schedule.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 7/7 changed files
• Comments generated: 1
• Review effort level: Medium

[github-actions]

🤖 PR Triage

Field	Value
Category	refactor
Risk	medium
Score	38/100 (impact:15, urgency:8, quality:15)
Action	batch_review — batch: go-refactor

Rationale: Behavior-preserving refactor extracting shared WorkflowData helper in threat-detection. CI partially passing. Batch with similar Go refactors.

Generated by 🔧 PR Triage Agent · 166.4 AIC · ⌖ 6.15 AIC · ⊞ 5.6K · ◷

[Copilot]

@copilot merge main and recompile

Done in 27dd663. I merged origin/main into this branch and recompiled workflows, which updated the out-of-sync lock files.