Implement dev vs release mode action references with CLI flag control (#5985)

Author: Copilot

.github/workflows/daily-team-status.lock.yml

@@ -192,6 +192,7 @@ Examples:
   ` + constants.CLIExtensionPrefix + ` compile --dependabot --force  # Force overwrite existing dependabot.yml`,
 	RunE: func(cmd *cobra.Command, args []string) error {
 		engineOverride, _ := cmd.Flags().GetString("engine")
+		actionMode, _ := cmd.Flags().GetString("action-mode")
 		validate, _ := cmd.Flags().GetBool("validate")
 		watch, _ := cmd.Flags().GetBool("watch")
 		dir, _ := cmd.Flags().GetString("dir")
@@ -222,6 +223,7 @@ Examples:
 			MarkdownFiles:        args,
 			Verbose:              verbose,
 			EngineOverride:       engineOverride,
+			ActionMode:           actionMode,
 			Validate:             validate,
 			Watch:                watch,
 			WorkflowDir:          workflowDir,
@@ -426,6 +428,7 @@ Use "` + constants.CLIExtensionPrefix + ` help all" to show help for all command
 
 	// Add AI flag to compile and add commands
 	compileCmd.Flags().StringP("engine", "e", "", "Override AI engine (claude, codex, copilot, custom)")
+	compileCmd.Flags().String("action-mode", "", "Action script inlining mode (inline, dev, release). Auto-detected if not specified")
 	compileCmd.Flags().Bool("validate", false, "Enable GitHub Actions workflow schema validation, container image validation, and action SHA validation")
 	compileCmd.Flags().BoolP("watch", "w", false, "Watch for changes to workflow files and recompile automatically")
 	compileCmd.Flags().String("dir", "", "Workflow directory (default: .github/workflows)")

cmd/gh-aw/main.go

@@ -175,6 +175,7 @@ type CompileConfig struct {
 	Actionlint           bool     // Run actionlint linter on generated .lock.yml files
 	JSONOutput           bool     // Output validation results as JSON
 	RefreshStopTime      bool     // Force regeneration of stop-after times instead of preserving existing ones
+	ActionMode           string   // Action script inlining mode: inline, dev, or release
 }
 
 // CompilationStats tracks the results of workflow compilation
@@ -308,6 +309,21 @@ func CompileWorkflows(config CompileConfig) ([]*workflow.WorkflowData, error) {
 		compileLog.Print("Stop time refresh enabled: will regenerate stop-after times")
 	}
 
+	// Set action mode if specified
+	if config.ActionMode != "" {
+		mode := workflow.ActionMode(config.ActionMode)
+		if !mode.IsValid() {
+			return nil, fmt.Errorf("invalid action mode '%s'. Must be 'inline', 'dev', or 'release'", config.ActionMode)
+		}
+		compiler.SetActionMode(mode)
+		compileLog.Printf("Action mode set to: %s", mode)
+	} else {
+		// Use auto-detection
+		mode := workflow.DetectActionMode()
+		compiler.SetActionMode(mode)
+		compileLog.Printf("Action mode auto-detected: %s", mode)
+	}
+
 	if watch {
 		// Watch mode: watch for file changes and recompile automatically
 		// For watch mode, we only support a single file for now

pkg/cli/compile_command.go

@@ -1,5 +1,10 @@
 package workflow
 
+import (
+	"os"
+	"strings"
+)
+
 // ActionMode defines how JavaScript is embedded in workflow steps
 type ActionMode string
 
@@ -9,6 +14,9 @@ const (
 
 	// ActionModeDev references custom actions using local paths (development mode)
 	ActionModeDev ActionMode = "dev"
+
+	// ActionModeRelease references custom actions using SHA-pinned remote paths (release mode)
+	ActionModeRelease ActionMode = "release"
 )
 
 // String returns the string representation of the action mode
@@ -18,5 +26,46 @@ func (m ActionMode) String() string {
 
 // IsValid checks if the action mode is valid
 func (m ActionMode) IsValid() bool {
-	return m == ActionModeInline || m == ActionModeDev
+	return m == ActionModeInline || m == ActionModeDev || m == ActionModeRelease
+}
+
+// DetectActionMode determines the appropriate action mode based on environment
+// Returns ActionModeRelease if running from main branch or release tag,
+// ActionModeDev for PR/local development, or ActionModeInline as fallback.
+// Can be overridden with GH_AW_ACTION_MODE environment variable.
+func DetectActionMode() ActionMode {
+	// Check for explicit override via environment variable
+	if envMode := os.Getenv("GH_AW_ACTION_MODE"); envMode != "" {
+		mode := ActionMode(envMode)
+		if mode.IsValid() {
+			return mode
+		}
+	}
+
+	// Check GitHub Actions context
+	githubRef := os.Getenv("GITHUB_REF")
+	githubEventName := os.Getenv("GITHUB_EVENT_NAME")
+
+	// Release mode conditions:
+	// 1. Running on a release branch (refs/heads/release*)
+	// 2. Running on a release tag (refs/tags/*)
+	// 3. Running on a release event
+	if strings.HasPrefix(githubRef, "refs/heads/release") ||
+	   strings.HasPrefix(githubRef, "refs/tags/") ||
+	   githubEventName == "release" {
+		return ActionModeRelease
+	}
+
+	// Dev mode conditions:
+	// 1. Running on a PR (refs/pull/*)
+	// 2. Running locally (no GITHUB_REF)
+	// 3. Running on any other branch (including main)
+	if strings.HasPrefix(githubRef, "refs/pull/") || 
+	   githubRef == "" ||
+	   strings.HasPrefix(githubRef, "refs/heads/") {
+		return ActionModeDev
+	}
+
+	// Fallback to inline mode for backwards compatibility
+	return ActionModeInline
 }

pkg/workflow/action_mode.go

@@ -0,0 +1,70 @@
+package workflow
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/githubnext/gh-aw/pkg/logger"
+)
+
+var actionRefLog = logger.New("workflow:action_reference")
+
+const (
+	// GitHubOrgRepo is the organization and repository name for custom action references
+	GitHubOrgRepo = "githubnext/gh-aw"
+)
+
+// resolveActionReference converts a local action path to the appropriate reference
+// based on the current action mode (dev vs release).
+// For dev mode: returns the local path as-is (e.g., "./actions/create-issue")
+// For release mode: converts to SHA-pinned remote reference (e.g., "githubnext/gh-aw/actions/create-issue@SHA # tag")
+// For inline mode: returns empty string to fallback to inline mode
+func (c *Compiler) resolveActionReference(localActionPath string, data *WorkflowData) string {
+	switch c.actionMode {
+	case ActionModeDev:
+		// Return local path as-is for development
+		actionRefLog.Printf("Dev mode: using local action path: %s", localActionPath)
+		return localActionPath
+
+	case ActionModeRelease:
+		// Convert to SHA-pinned remote reference for release
+		remoteRef := convertToRemoteActionRef(localActionPath)
+		if remoteRef == "" {
+			actionRefLog.Printf("WARNING: Could not resolve remote reference for %s", localActionPath)
+			return ""
+		}
+		actionRefLog.Printf("Release mode: using remote action reference: %s", remoteRef)
+		return remoteRef
+
+	case ActionModeInline:
+		// Return empty to fallback to inline mode
+		actionRefLog.Print("Inline mode: returning empty to use inline JavaScript")
+		return ""
+
+	default:
+		actionRefLog.Printf("WARNING: Unknown action mode %s, returning empty", c.actionMode)
+		return ""
+	}
+}
+
+// convertToRemoteActionRef converts a local action path to a tag-based remote reference
+// that will be resolved to a SHA later in the release pipeline using action pins.
+// Example: "./actions/create-issue" -> "githubnext/gh-aw/actions/create-issue@v1.0.0"
+func convertToRemoteActionRef(localPath string) string {
+	// Strip the leading "./" if present
+	actionPath := strings.TrimPrefix(localPath, "./")
+
+	// Get the current release tag
+	tag := GetCurrentGitTag()
+	if tag == "" {
+		actionRefLog.Print("WARNING: No git tag available for release mode")
+		return ""
+	}
+
+	// Construct the remote reference with tag: githubnext/gh-aw/actions/name@tag
+	// The SHA will be resolved later by action pinning infrastructure
+	remoteRef := fmt.Sprintf("%s/%s@%s", GitHubOrgRepo, actionPath, tag)
+	actionRefLog.Printf("Using tag-based reference: %s (SHA will be resolved via action pins)", remoteRef)
+
+	return remoteRef
+}

pkg/workflow/action_reference.go

@@ -0,0 +1,137 @@
+package workflow
+
+import (
+	"os"
+	"testing"
+)
+
+func TestConvertToRemoteActionRef(t *testing.T) {
+	// Save original environment
+	origRef := os.Getenv("GITHUB_REF")
+	defer func() {
+		if origRef != "" {
+			os.Setenv("GITHUB_REF", origRef)
+		} else {
+			os.Unsetenv("GITHUB_REF")
+		}
+	}()
+
+	t.Run("local path with ./ prefix and tag", func(t *testing.T) {
+		os.Setenv("GITHUB_REF", "refs/tags/v1.2.3")
+
+		ref := convertToRemoteActionRef("./actions/create-issue")
+		expected := "githubnext/gh-aw/actions/create-issue@v1.2.3"
+		if ref != expected {
+			t.Errorf("Expected %q, got %q", expected, ref)
+		}
+	})
+
+	t.Run("local path without ./ prefix and tag", func(t *testing.T) {
+		os.Setenv("GITHUB_REF", "refs/tags/v1.0.0")
+
+		ref := convertToRemoteActionRef("actions/create-issue")
+		expected := "githubnext/gh-aw/actions/create-issue@v1.0.0"
+		if ref != expected {
+			t.Errorf("Expected %q, got %q", expected, ref)
+		}
+	})
+
+	t.Run("nested action path with tag", func(t *testing.T) {
+		os.Setenv("GITHUB_REF", "refs/tags/v2.0.0")
+
+		ref := convertToRemoteActionRef("./actions/nested/action")
+		expected := "githubnext/gh-aw/actions/nested/action@v2.0.0"
+		if ref != expected {
+			t.Errorf("Expected %q, got %q", expected, ref)
+		}
+	})
+
+	t.Run("no tag returns empty", func(t *testing.T) {
+		os.Setenv("GITHUB_REF", "refs/heads/main")
+
+		ref := convertToRemoteActionRef("./actions/create-issue")
+		if ref != "" {
+			t.Errorf("Expected empty string without tag, got %q", ref)
+		}
+	})
+}
+
+func TestResolveActionReference(t *testing.T) {
+	// Save original environment
+	origRef := os.Getenv("GITHUB_REF")
+	defer func() {
+		if origRef != "" {
+			os.Setenv("GITHUB_REF", origRef)
+		} else {
+			os.Unsetenv("GITHUB_REF")
+		}
+	}()
+
+	tests := []struct {
+		name          string
+		actionMode    ActionMode
+		localPath     string
+		githubRef     string
+		expectedRef   string
+		shouldBeEmpty bool
+		description   string
+	}{
+		{
+			name:        "dev mode",
+			actionMode:  ActionModeDev,
+			localPath:   "./actions/create-issue",
+			expectedRef: "./actions/create-issue",
+			description: "Dev mode should return local path",
+		},
+		{
+			name:        "release mode with tag",
+			actionMode:  ActionModeRelease,
+			localPath:   "./actions/create-issue",
+			githubRef:   "refs/tags/v1.0.0",
+			expectedRef: "githubnext/gh-aw/actions/create-issue@v1.0.0",
+			description: "Release mode should return tag-based reference",
+		},
+		{
+			name:          "release mode without tag",
+			actionMode:    ActionModeRelease,
+			localPath:     "./actions/create-issue",
+			githubRef:     "refs/heads/main",
+			shouldBeEmpty: true,
+			description:   "Release mode without tag should return empty",
+		},
+		{
+			name:          "inline mode",
+			actionMode:    ActionModeInline,
+			localPath:     "./actions/create-issue",
+			shouldBeEmpty: true,
+			description:   "Inline mode should return empty string",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Set up environment
+			if tt.githubRef != "" {
+				os.Setenv("GITHUB_REF", tt.githubRef)
+			} else {
+				os.Unsetenv("GITHUB_REF")
+			}
+
+			compiler := NewCompiler(false, "", "1.0.0")
+			compiler.SetActionMode(tt.actionMode)
+
+			data := &WorkflowData{}
+			ref := compiler.resolveActionReference(tt.localPath, data)
+
+			if tt.shouldBeEmpty {
+				if ref != "" {
+					t.Errorf("%s: expected empty string, got %q", tt.description, ref)
+				}
+			} else {
+				if ref != tt.expectedRef {
+					t.Errorf("%s: expected %q, got %q", tt.description, tt.expectedRef, ref)
+				}
+			}
+		})
+	}
+}