fix: use agent-downstream artifact prefix in buildGitHubScriptStep and buildCustomActionStep

buildSafeOutputJob-based jobs (e.g. upload_assets) only depend on the agent job,
not the activation job. Using needs.activation.outputs.artifact_prefix in those
jobs would break workflow_call workflows since activation is not in their needs.

Use artifactPrefixExprForAgentDownstreamJob (needs.agent.outputs.artifact_prefix)
in buildGitHubScriptStep and buildCustomActionStep instead.

Also adds two tests verifying the correct prefix expression is used per context.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Author: Copilot

pkg/workflow/safe_output_helpers_test.go

@@ -682,3 +682,62 @@ func TestBuildGitHubScriptStepNoWorkingDirectory(t *testing.T) {
 		t.Error("Expected step to contain script")
 	}
 }
+
+// TestBuildGitHubScriptStepWorkflowCallArtifactPrefix verifies that agent artifact downloads
+// in buildGitHubScriptStep use needs.agent.outputs.artifact_prefix in workflow_call context.
+// These steps are used in jobs that depend on the agent job (not activation), so the
+// agent-downstream prefix expression must be used.
+func TestBuildGitHubScriptStepWorkflowCallArtifactPrefix(t *testing.T) {
+	compiler := &Compiler{}
+	workflowData := &WorkflowData{
+		Name: "Test Workflow",
+		On:   "workflow_call",
+	}
+
+	config := GitHubScriptStepConfig{
+		StepName:    "Test Step",
+		StepID:      "test_step",
+		MainJobName: "agent",
+		Script:      "console.log('test');",
+	}
+
+	steps := compiler.buildGitHubScriptStep(workflowData, config)
+	stepsStr := strings.Join(steps, "")
+
+	// In workflow_call context, the download must reference needs.agent (not needs.activation)
+	// because buildSafeOutputJob-based jobs depend on agent, not activation.
+	agentPrefix := "${{ needs.agent.outputs.artifact_prefix }}agent"
+	if !strings.Contains(stepsStr, agentPrefix) {
+		t.Errorf("Expected buildGitHubScriptStep to use %q in workflow_call context, but it was not found.\nGenerated steps:\n%s", agentPrefix, stepsStr)
+	}
+
+	// Ensure activation prefix is NOT used
+	if strings.Contains(stepsStr, "needs.activation.outputs.artifact_prefix") {
+		t.Errorf("Expected buildGitHubScriptStep NOT to use needs.activation.outputs.artifact_prefix (job does not depend on activation).\nGenerated steps:\n%s", stepsStr)
+	}
+}
+
+// TestBuildGitHubScriptStepNonWorkflowCallNoArtifactPrefix verifies no prefix is added
+// in non-workflow_call context.
+func TestBuildGitHubScriptStepNonWorkflowCallNoArtifactPrefix(t *testing.T) {
+	compiler := &Compiler{}
+	workflowData := &WorkflowData{
+		Name: "Test Workflow",
+		On:   "issues",
+	}
+
+	config := GitHubScriptStepConfig{
+		StepName:    "Test Step",
+		StepID:      "test_step",
+		MainJobName: "agent",
+		Script:      "console.log('test');",
+	}
+
+	steps := compiler.buildGitHubScriptStep(workflowData, config)
+	stepsStr := strings.Join(steps, "")
+
+	// In non-workflow_call context, no artifact prefix should be used
+	if strings.Contains(stepsStr, "artifact_prefix") {
+		t.Errorf("Expected buildGitHubScriptStep NOT to use artifact_prefix in non-workflow_call context.\nGenerated steps:\n%s", stepsStr)
+	}
+}

pkg/workflow/safe_outputs_jobs.go

@@ -190,7 +190,9 @@ func (c *Compiler) buildCustomActionStep(data *WorkflowData, config GitHubScript
 
 	// Add artifact download steps before the custom action step.
 	// In workflow_call context, use the per-invocation prefix to avoid artifact name clashes.
-	steps = append(steps, buildAgentOutputDownloadSteps(artifactPrefixExprForDownstreamJob(data))...)
+	// These steps are used in jobs that depend on the agent job (not activation), so use
+	// the agent-downstream prefix expression.
+	steps = append(steps, buildAgentOutputDownloadSteps(artifactPrefixExprForAgentDownstreamJob(data))...)
 
 	// Step name and metadata
 	steps = append(steps, fmt.Sprintf("      - name: %s\n", config.StepName))
@@ -290,7 +292,9 @@ func (c *Compiler) buildGitHubScriptStep(data *WorkflowData, config GitHubScript
 
 	// Add artifact download steps before the GitHub Script step.
 	// In workflow_call context, use the per-invocation prefix to avoid artifact name clashes.
-	steps = append(steps, buildAgentOutputDownloadSteps(artifactPrefixExprForDownstreamJob(data))...)
+	// These steps are used in jobs that depend on the agent job (not activation), so use
+	// the agent-downstream prefix expression.
+	steps = append(steps, buildAgentOutputDownloadSteps(artifactPrefixExprForAgentDownstreamJob(data))...)
 
 	// Step name and metadata
 	steps = append(steps, fmt.Sprintf("      - name: %s\n", config.StepName))