Fix repository import checkout paths and add selective subfolder merging

.github/workflows/scout.md

@@ -16,7 +16,6 @@ permissions:
 roles: [admin, maintainer, write]
 engine: claude
 imports:
-  - github/github-deep-research-agent@main
   - shared/reporting.md
   - shared/mcp/arxiv.md
   - shared/mcp/tavily.md

actions/setup/js/merge_remote_agent_github_folder.cjs

@@ -123,7 +123,7 @@ function getAllFiles(dir, baseDir = dir) {
 /**
  * Sparse checkout the .github folder from a remote repository
  * @deprecated This function is no longer used. The compiler now generates actions/checkout steps
- * that checkout repositories into /tmp/gh-aw/repo-imports/, and mergeRepositoryGithubFolder uses those.
+ * that checkout repositories into .github/aw/imports/ (relative to GITHUB_WORKSPACE), and mergeRepositoryGithubFolder uses those.
  * @param {string} owner - Repository owner
  * @param {string} repo - Repository name
  * @param {string} ref - Git reference (branch, tag, or SHA)
@@ -167,6 +167,7 @@ function sparseCheckoutGithubFolder(owner, repo, ref, tempDir) {
 
 /**
  * Merge .github folder from source to destination, failing on conflicts
+ * Only copies files from specific subfolders: agents, skills, prompts, instructions, plugins
  * @param {string} sourcePath - Source .github folder path
  * @param {string} destPath - Destination .github folder path
  * @returns {{merged: number, conflicts: string[]}}
@@ -177,11 +178,23 @@ function mergeGithubFolder(sourcePath, destPath) {
   const conflicts = [];
   let mergedCount = 0;
 
+  // Only copy files from these specific subfolders
+  const allowedSubfolders = ["agents", "skills", "prompts", "instructions", "plugins"];
+
   // Get all files from source .github folder
   const sourceFiles = getAllFiles(sourcePath);
   coreObj.info(`Found ${sourceFiles.length} files in source .github folder`);
 
   for (const relativePath of sourceFiles) {
+    // Check if the file is in one of the allowed subfolders
+    const pathParts = relativePath.split(path.sep);
+    const topLevelFolder = pathParts[0];
+
+    if (!allowedSubfolders.includes(topLevelFolder)) {
+      coreObj.info(`Skipping file outside allowed subfolders: ${relativePath}`);
+      continue;
+    }
+
     const sourceFile = path.join(sourcePath, relativePath);
     const destFile = path.join(destPath, relativePath);
 
@@ -225,9 +238,11 @@ async function mergeRepositoryGithubFolder(owner, repo, ref, workspace) {
   coreObj.info(`Merging .github folder from ${owner}/${repo}@${ref} into workspace`);
 
   // Calculate the pre-checked-out folder path
-  // This matches the format generated by the compiler: /tmp/gh-aw/repo-imports/<owner>-<repo>-<sanitized-ref>
+  // This matches the format generated by the compiler: .github/aw/imports/<owner>-<repo>-<sanitized-ref>
+  // The path is relative to GITHUB_WORKSPACE, so we need to resolve it
   const sanitizedRef = ref.replace(/\//g, "-").replace(/:/g, "-").replace(/\\/g, "-");
-  const checkoutPath = `/tmp/gh-aw/repo-imports/${owner}-${repo}-${sanitizedRef}`;
+  const relativePath = `.github/aw/imports/${owner}-${repo}-${sanitizedRef}`;
+  const checkoutPath = path.join(workspace, relativePath);
 
   coreObj.info(`Looking for pre-checked-out repository at: ${checkoutPath}`);
 

pkg/workflow/compiler_yaml_main_job.go

@@ -56,7 +56,6 @@ func (c *Compiler) generateMainJobSteps(yaml *strings.Builder, data *WorkflowDat
 	if needsGithubMerge {
 		compilerYamlLog.Printf("Adding merge remote .github folder step")
 		yaml.WriteString("      - name: Merge remote .github folder\n")
-		yaml.WriteString("        if: ${{ always() }}\n")
 		fmt.Fprintf(yaml, "        uses: %s\n", GetActionPin("actions/github-script"))
 		yaml.WriteString("        env:\n")
 
@@ -505,8 +504,8 @@ func (c *Compiler) addCustomStepsWithRuntimeInsertion(yaml *strings.Builder, cus
 }
 
 // generateRepositoryImportCheckouts generates checkout steps for repository imports
-// Each repository is checked out into a temporary folder at /tmp/gh-aw/repo-imports/<owner>-<repo>-<sanitized-ref>
-// This allows the merge script to copy files from pre-checked-out folders instead of doing git operations
+// Each repository is checked out into a temporary folder at .github/aw/imports/<owner>-<repo>-<sanitized-ref>
+// relative to GITHUB_WORKSPACE. This allows the merge script to copy files from pre-checked-out folders instead of doing git operations
 func (c *Compiler) generateRepositoryImportCheckouts(yaml *strings.Builder, repositoryImports []string) {
 	for _, repoImport := range repositoryImports {
 		compilerYamlLog.Printf("Generating checkout step for repository import: %s", repoImport)
@@ -521,8 +520,9 @@ func (c *Compiler) generateRepositoryImportCheckouts(yaml *strings.Builder, repo
 
 		// Generate a sanitized directory name for the checkout
 		// Use a consistent format: owner-repo-ref
+		// NOTE: Path must be relative to GITHUB_WORKSPACE for actions/checkout@v6
 		sanitizedRef := sanitizeRefForPath(ref)
-		checkoutPath := fmt.Sprintf("/tmp/gh-aw/repo-imports/%s-%s-%s", owner, repo, sanitizedRef)
+		checkoutPath := fmt.Sprintf(".github/aw/imports/%s-%s-%s", owner, repo, sanitizedRef)
 
 		// Generate the checkout step
 		fmt.Fprintf(yaml, "      - name: Checkout repository import %s/%s@%s\n", owner, repo, ref)

pkg/workflow/repository_import_checkout_test.go

@@ -57,8 +57,8 @@ imports:
 		"Should specify repository in checkout step")
 	assert.Contains(t, lockContentStr, "ref: main",
 		"Should specify ref in checkout step")
-	assert.Contains(t, lockContentStr, "path: /tmp/gh-aw/repo-imports/github-test-repo-main",
-		"Should specify checkout path in temp directory")
+	assert.Contains(t, lockContentStr, "path: .github/aw/imports/github-test-repo-main",
+		"Should specify checkout path in .github/aw/imports directory")
 	assert.Contains(t, lockContentStr, "sparse-checkout:",
 		"Should use sparse-checkout")
 	assert.Contains(t, lockContentStr, ".github/",
@@ -118,13 +118,13 @@ imports:
 	// Verify checkout step for first repository import
 	assert.Contains(t, lockContentStr, "name: Checkout repository import github/repo1@main",
 		"Should contain checkout step for first repository import")
-	assert.Contains(t, lockContentStr, "path: /tmp/gh-aw/repo-imports/github-repo1-main",
+	assert.Contains(t, lockContentStr, "path: .github/aw/imports/github-repo1-main",
 		"Should use correct path for first import")
 
 	// Verify checkout step for second repository import
 	assert.Contains(t, lockContentStr, "name: Checkout repository import github/repo2@v1.0.0",
 		"Should contain checkout step for second repository import")
-	assert.Contains(t, lockContentStr, "path: /tmp/gh-aw/repo-imports/github-repo2-v1.0.0",
+	assert.Contains(t, lockContentStr, "path: .github/aw/imports/github-repo2-v1.0.0",
 		"Should use correct path for second import")
 
 	// Verify merge step includes both imports
@@ -169,7 +169,7 @@ imports:
 	lockContentStr := string(lockContent)
 
 	// Verify ref is sanitized in path (/ replaced with -)
-	assert.Contains(t, lockContentStr, "path: /tmp/gh-aw/repo-imports/github-test-repo-feature-my-branch",
+	assert.Contains(t, lockContentStr, "path: .github/aw/imports/github-test-repo-feature-my-branch",
 		"Should sanitize slashes in ref for path")
 	assert.Contains(t, lockContentStr, "ref: feature/my-branch",
 		"Should keep original ref in checkout step")