[WIP] Fix failing GitHub Actions job update (#61938)

Author: Copilot

pkg/cli/update_command_test.go

@@ -8,6 +8,7 @@ import (
 	"path/filepath"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/github/gh-aw/pkg/testutil"
 	"github.com/github/gh-aw/pkg/workflow"
@@ -1056,6 +1057,153 @@ func TestUpdateWorkflow_NoMergeMode(t *testing.T) {
 	})
 }
 
+// TestUpdateWorkflow_RestoresContentOnCompileFailure verifies that when an
+// upstream update produces content that fails to compile (for example, a new
+// dispatch-workflow target that doesn't exist locally), the local workflow
+// file is restored to its previous, working content instead of being left in
+// a broken state on disk.
+func TestUpdateWorkflow_RestoresContentOnCompileFailure(t *testing.T) {
+	originalResolveLatestRef := resolveLatestRefFn
+	originalDownloadWorkflow := downloadWorkflowContentFn
+	t.Cleanup(func() {
+		resolveLatestRefFn = originalResolveLatestRef
+		downloadWorkflowContentFn = originalDownloadWorkflow
+	})
+
+	tmpDir := testutil.TempDir(t, "test-*")
+	require.NoError(t, initTestGitRepo(tmpDir), "failed to initialize git repo")
+
+	workflowsDir := filepath.Join(tmpDir, ".github", "workflows")
+	require.NoError(t, os.MkdirAll(workflowsDir, 0755), "failed to create workflows dir")
+
+	oldDir, err := os.Getwd()
+	require.NoError(t, err, "failed to get current directory")
+	t.Cleanup(func() {
+		require.NoError(t, os.Chdir(oldDir), "failed to restore directory")
+	})
+	require.NoError(t, os.Chdir(tmpDir), "failed to change to temp directory")
+
+	const currentRef = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+	const latestRef = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+
+	originalContent := `---
+on: issues
+engine: copilot
+permissions:
+  contents: read
+source: owner/repo/workflows/test-workflow.md@` + currentRef + `
+---
+
+# Test Workflow
+
+Original content.
+`
+
+	// Simulate an upstream update that introduces a dispatch-workflow target
+	// that doesn't exist locally — this must fail to compile.
+	brokenNewContent := `---
+on: issues
+engine: copilot
+permissions:
+  contents: read
+safe-outputs:
+  dispatch-workflow:
+    workflows:
+      - missing-workflow
+    max: 1
+source: owner/repo/workflows/test-workflow.md@` + latestRef + `
+---
+
+# Test Workflow
+
+Updated content referencing a workflow that doesn't exist locally.
+`
+
+	workflowFile := filepath.Join(workflowsDir, "test-workflow.md")
+	require.NoError(t, os.WriteFile(workflowFile, []byte(originalContent), 0644), "failed to write initial workflow")
+
+	resolveLatestRefFn = func(_ context.Context, _ string, ref string, _ bool, _ bool, _ time.Duration) (latestRefResolution, error) {
+		if ref == currentRef {
+			return latestRefResolution{Ref: latestRef}, nil
+		}
+		return latestRefResolution{Ref: ref}, nil
+	}
+	downloadWorkflowContentFn = func(_ context.Context, _, _, ref string, _ bool) ([]byte, error) {
+		if ref == latestRef {
+			return []byte(brokenNewContent), nil
+		}
+		return []byte(originalContent), nil
+	}
+
+	wf := &workflowWithSource{
+		Name:       "test-workflow",
+		Path:       workflowFile,
+		SourceSpec: "owner/repo/workflows/test-workflow.md@" + currentRef,
+	}
+
+	opts := UpdateWorkflowsOptions{
+		WorkflowsDir: workflowsDir,
+	}
+
+	err = updateWorkflow(context.Background(), wf, opts)
+	require.Error(t, err, "update should fail because the new content doesn't compile")
+	assert.Contains(t, err.Error(), "failed to compile updated workflow")
+
+	restoredContent, readErr := os.ReadFile(workflowFile)
+	require.NoError(t, readErr, "failed to read workflow file after failed update")
+	assert.Equal(t, originalContent, string(restoredContent), "workflow file should be restored to its original content after a compile failure")
+}
+
+func TestUpdateWorkflow_BackupReadFailureStopsUpdate(t *testing.T) {
+	originalResolveLatestRef := resolveLatestRefFn
+	originalDownloadWorkflow := downloadWorkflowContentFn
+	t.Cleanup(func() {
+		resolveLatestRefFn = originalResolveLatestRef
+		downloadWorkflowContentFn = originalDownloadWorkflow
+	})
+
+	tmpDir := testutil.TempDir(t, "test-*")
+	workflowsDir := filepath.Join(tmpDir, ".github", "workflows")
+	require.NoError(t, os.MkdirAll(workflowsDir, 0755), "failed to create workflows dir")
+
+	const currentRef = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+	const latestRef = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+	updatedContent := []byte(`---
+on: issues
+engine: copilot
+permissions:
+  contents: read
+source: owner/repo/workflows/test-workflow.md@` + latestRef + `
+---
+
+# Updated Workflow
+`)
+
+	resolveLatestRefFn = func(_ context.Context, _ string, ref string, _ bool, _ bool, _ time.Duration) (latestRefResolution, error) {
+		if ref == currentRef {
+			return latestRefResolution{Ref: latestRef}, nil
+		}
+		return latestRefResolution{Ref: ref}, nil
+	}
+	downloadWorkflowContentFn = func(_ context.Context, _, _, _ string, _ bool) ([]byte, error) {
+		return updatedContent, nil
+	}
+
+	workflowFile := filepath.Join(workflowsDir, "missing-workflow.md")
+	wf := &workflowWithSource{
+		Name:       "missing-workflow",
+		Path:       workflowFile,
+		SourceSpec: "owner/repo/workflows/test-workflow.md@" + currentRef,
+	}
+
+	err := updateWorkflow(context.Background(), wf, UpdateWorkflowsOptions{
+		WorkflowsDir: workflowsDir,
+		NoMerge:      true,
+	})
+	require.ErrorContains(t, err, "failed to read current workflow before update")
+	assert.NoFileExists(t, workflowFile, "workflow must not be written without a recoverable backup")
+}
+
 // TestMarshalActionsLockSorted tests that the actions lock marshaling produces sorted output
 // using the ActionCache.Save helper.
 func TestMarshalActionsLockSorted(t *testing.T) {

pkg/cli/update_workflows.go

@@ -935,6 +935,15 @@ func updateWorkflow(ctx context.Context, wf *workflowWithSource, opts UpdateWork
 		fmt.Fprintln(os.Stderr, console.FormatWarningMessage("Security scanning disabled"))
 	}
 
+	// Preserve the pre-update content so it can be restored if the newly
+	// fetched content fails to compile. Without this, a broken upstream
+	// change (e.g. a dispatch-workflow target that doesn't exist locally)
+	// would be left on disk and could break a later, unrelated recompile.
+	originalContent, err := os.ReadFile(wf.Path)
+	if err != nil {
+		return fmt.Errorf("failed to read current workflow before update: %w", err)
+	}
+
 	// Write updated content
 	if err := os.WriteFile(wf.Path, []byte(finalContent), constants.FilePermPublic); err != nil {
 		return fmt.Errorf("failed to write updated workflow: %w", err)
@@ -953,6 +962,12 @@ func updateWorkflow(ctx context.Context, wf *workflowWithSource, opts UpdateWork
 		updateLog.Printf("Compiling updated workflow: %s", wf.Name)
 		if err := compileWorkflowsForUpdate(ctx, []string{wf.Path}, opts.WorkflowsDir, opts.EngineOverride, opts.Verbose, opts.Approve); err != nil {
 			updateLog.Printf("Compilation failed for workflow %s: %v", wf.Name, err)
+			if restoreErr := os.WriteFile(wf.Path, originalContent, constants.FilePermPublic); restoreErr != nil {
+				fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to restore original content for %s after compile failure: %v", wf.Name, restoreErr)))
+			} else {
+				updateLog.Printf("Restored original content for %s after compile failure", wf.Name)
+				fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Reverted %s to its previous content because the updated version failed to compile", wf.Name)))
+			}
 			return fmt.Errorf("failed to compile updated workflow: %w", err)
 		}
 	} else {