🐛🧑‍💻 - bugfix setup generated runner groups fail source workflow validation #570

Is there an existing issue for this?

• I have searched the existing issues. This is separate from 🐛🧑‍💻 - bugfix permission probes trigger normal automation on temporary branches #569, which concerns event automation on disposable probe refs.

Which actions are affected?

Pull Request, Commits

Which platforms are affected?

Linux, macOS, Windows

Description

The #556 setup generates a valid source-repository job route using an existing runner group and literal labels, but the repository workflow contract validator rejects that same route. This blocks the source parity installer PR copilot #568 even though the generated profile successfully ran in GitHub on platform.

Expected: the validator accepts the bounded literal object form supported by the setup, while continuing to enforce job-role routing, label requirements and GitHub-hosted credential verification. It must still reject unsafe expressions or malformed runner objects. Existing source native workflow routes should retain their reviewed behavior.

Actual: runnerLabels(value) in scripts/validate-workflow-contract.cjs maps arrays and otherwise applies String(value). A {group, labels} object becomes [object Object], so an otherwise correct self-hosted route fails the label contract.

Reproducing the issue

1. Run the CLI from reviewed develop merge f09d3222ffdf9ad88e869e754c6f90af522ca8eb after [#556] ✨ - feat select reusable runner profiles in setup and reconcile source workflow parity #563, using organization configuration reuse and two targets: vypdev/copilot and vypdev/platform.
2. Choose an existing self-hosted runner, group vypdev, labels self-hosted,codex,Linux, with ordinary validation hosted. Review and apply the batch.
3. Source installer chore: configure Copilot #568 is at exact prepared commit 74bdb19399bbd84266882930588ca4e6520f7209. Its new .github/workflows/agent-cli-provisioning.yml contains:

runs-on:
  group: vypdev
  labels: [self-hosted, codex, Linux]

4. The Ubuntu setup smoke job 117780207027 passed 631 suites / 9,459 tests and coverage budgets, then failed validate:workflows with:

.github/workflows/agent-cli-provisioning.yml job verify-agent-clis must use runs-on self-hosted, codex.

5. To separate this bug from an older published validator, archive current develop f09d3222, overlay the exact 20 changed files of chore: configure Copilot #568, and run node scripts/validate-workflow-contract.cjs. The current develop validator also exits 1 with the same provisioning error. No repository branch or CI check was modified for this reproduction.
6. Contrast with the exact generated platform installation commit 0e962ee99417e1b5e4b93bcc21e4b8850834244c: provisioning run 39163029973 passed on runner ubuntu-runner-2, runner group ID 4 / vypdev, with the selected labels.

copilot Version

CLI and current-validator reproduction: develop f09d3222ffdf9ad88e869e754c6f90af522ca8eb (#563). Source installation base: master v3.5.6.

Relevant Log Output

The published master validator separately rejects the newly installed hosted credential-health route; current develop already contains that role-specific exception. Updating the source version alone does not resolve the grouped provisioning route above.

Additional context and comments

The batch created copilot #568 and vypdev/platform#180 with matching commit, parent, branch and manifest receipts. Organization/repository Variables and Secret metadata stayed unchanged. Installation PRs remain unmerged. The temporary setup PAT copy was removed and the operator was notified that it can be revoked. Dependency vulnerabilities remain outside this issue.