[branch-actions-detective] Internal CI fails on main: make compile leaves workflow lock files dirty

[github-actions]

CI Failure Summary

Workflow: Internal: CI
Branch: main
Run: https://github.com/elastic/ai-github-actions/actions/runs/22871745812

Root Cause

The Verify compiled workflows job failed at Ensure lock files are up to date because make compile modified the working tree.
In this run, make compile rewrote setup action refs across lock files (Updated 301 setup action reference(s) in 61 lock file(s)), and the subsequent clean-tree guard in CI failed.

Impact

Internal: CI is failing on the protected main branch, which can block merges when this check is required and keeps branch health red.

Suggested Fix

1. Run make compile from a clean checkout of main.
2. Commit all regenerated *.lock.yml workflow files (this failure reports 61 modified lock files).
3. Re-run Internal: CI and verify Verify compiled workflows passes.
4. If lock files are unexpectedly changing on every run, pin and verify the setup-action rewrite inputs (GH_AW_SOURCE_REPO / GH_AW_BUILD_VERSION in Makefile) so compile output is stable.

Evidence

• Failed job: Verify compiled workflows (job 66353041729)
• Failed step: Ensure lock files are up to date
• Log excerpts:
  • Updated 301 setup action reference(s) in 61 lock file(s).
  • Working tree dirty after make compile.
  • M .github/workflows/agent-deep-dive.lock.yml (plus many other lock files)
• CI guard that failed: .github/workflows/ci.yml:46-52
• Rewrite step in compile path: Makefile:185-186 (postprocess-setup-action -> scripts/rewrite_setup_action_refs.py)

---

What is this? | From workflow: Trigger Branch Actions Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

• expires on Mar 16, 2026, 7:54 PM UTC