Make targeted workflow compilation deterministic

pkg/cli/compile_maintenance_test.go

@@ -179,6 +179,63 @@ Test workflow that creates issues without expiration.
 	}
 }
 
+func TestCompileSpecificFiles_PreservesDisabledImplicitActionFailureExpiry(t *testing.T) {
+	tempDir := testutil.TempDir(t, "test-*")
+	workflowsDir := filepath.Join(tempDir, ".github/workflows")
+	if err := os.MkdirAll(workflowsDir, 0755); err != nil {
+		t.Fatalf("Failed to create workflows directory: %v", err)
+	}
+
+	t.Chdir(tempDir)
+
+	initCmd := exec.Command("git", "init")
+	initCmd.Dir = tempDir
+	if err := initCmd.Run(); err != nil {
+		t.Fatalf("Failed to initialize git repo: %v", err)
+	}
+
+	workflowContent := `---
+name: "Test Workflow No Expires"
+on:
+  workflow_dispatch:
+engine: copilot
+---
+
+Test workflow without expiration.
+`
+	workflowPath := filepath.Join(workflowsDir, "test-no-expires.md")
+	if err := os.WriteFile(workflowPath, []byte(workflowContent), 0644); err != nil {
+		t.Fatalf("Failed to write workflow file: %v", err)
+	}
+
+	config := CompileConfig{}
+	if _, err := CompileWorkflows(context.Background(), config); err != nil {
+		t.Fatalf("Full CompileWorkflows failed: %v", err)
+	}
+
+	lockPath := filepath.Join(workflowsDir, "test-no-expires.lock.yml")
+	fullCompileContent, err := os.ReadFile(lockPath)
+	if err != nil {
+		t.Fatalf("Failed to read full compile output: %v", err)
+	}
+	if !strings.Contains(string(fullCompileContent), `GH_AW_ACTION_FAILURE_ISSUE_EXPIRES_HOURS: "0"`) {
+		t.Fatal("Full compile should disable the implicit action failure expiry")
+	}
+
+	config.MarkdownFiles = []string{"test-no-expires"}
+	if _, err := CompileWorkflows(context.Background(), config); err != nil {
+		t.Fatalf("Targeted CompileWorkflows failed: %v", err)
+	}
+
+	targetedCompileContent, err := os.ReadFile(lockPath)
+	if err != nil {
+		t.Fatalf("Failed to read targeted compile output: %v", err)
+	}
+	if string(targetedCompileContent) != string(fullCompileContent) {
+		t.Fatal("Targeted compile should produce the same lock file as a full compile")
+	}
+}
+
 func TestCompileWithCustomDir_SkipsMaintenanceWorkflow(t *testing.T) {
 	// Create temporary directory structure
 	tempDir := testutil.TempDir(t, "test-*")

pkg/cli/compile_pipeline.go

@@ -861,6 +861,12 @@ func runPostProcessing(
 	// Note: Maintenance workflow generation requires parsing all workflows in the directory
 	// to check for expires fields, so we skip it when compiling specific files to avoid
 	// unnecessary parsing and warnings from unrelated workflows
+	if !config.NoEmit && config.WorkflowDir == "" {
+		if gitRoot, err := gitutil.FindGitRoot(); err == nil {
+			absWorkflowDir := getAbsoluteWorkflowDir(getWorkflowsDir(), gitRoot)
+			workflow.DisableDefaultActionFailureExpiryMarkersIfUnenforced(workflowDataList, absWorkflowDir)
+		}
+	}
 
 	// Prune stale gh-aw-actions entries before saving
 	pruneStaleActionCacheEntries(compiler, actionCache)

pkg/workflow/maintenance_workflow_expiry.go

@@ -0,0 +1,15 @@
+package workflow
+
+import (
+	"os"
+	"path/filepath"
+)
+
+// DisableDefaultActionFailureExpiryMarkersIfUnenforced disables implicit
+// action-failure expiry markers when no maintenance workflow exists to enforce them.
+// The generated maintenance workflow always includes the global expiry sweeper.
+func DisableDefaultActionFailureExpiryMarkersIfUnenforced(workflowDataList []*WorkflowData, workflowDir string) {
+	if _, err := os.Stat(filepath.Join(workflowDir, "agentics-maintenance.yml")); os.IsNotExist(err) {
+		disableDefaultActionFailureExpiryMarkers(workflowDataList, workflowDir)
+	}
+}