ci: pin gh-aw v0.86.2 and add strict compile gate (all four workflows)

[bradygaster]

Problem

PRs #1873 and #1874 merged while test checks were failing because:

1. The gh-aw compiler version was unpinned — gh extension install github/gh-aw with no --pin flag means different runs may use different compiler versions, making results non-deterministic.
2. There was no dedicated CI job that exclusively compiles the four workflow sources. Compile validation lived inside the 15-minute npm test suite, making it impractical to mark as a lightweight required check.
3. Ruleset 12703724 (main) had enforcement: disabled and no required status checks, so PRs could merge regardless of check status.

What this PR does

One file changed: .github/workflows/squad-ci.yml

1. Pins gh-aw to v0.86.2 in the existing test job's "Install gh-aw extension" step. Same version pinned in the new compile job — both jobs see identical compiler behaviour.

2. Adds gh-aw-compile job (name: gh-aw strict compile) that runs unconditionally on every PR and push:

   • Installs gh-aw v0.86.2 (pinned)
   • Mirrors workflows/ → <tmpdir>/.github/workflows/ + git init (same layout as real consumer repos)
   • Compiles squad, squad-implement-worker, squad-review, squad-deps-worker with --strict --approve --no-check-update
   • Verifies all four .lock.yml files were emitted (a compiler that exits 0 without writing output is a silent-success gap — treated as failure)
   • Failures accumulate rather than short-circuit — all four results visible in one run
   • Writes compile + lock-file status to $GITHUB_STEP_SUMMARY

No changeset required — only CI configuration changed, no package source files touched.

DoD checklist

• CI pins an explicit gh-aw compiler version deterministically (--pin v0.86.2)
• A required-capable job compiles all four workflows with strict validation
• Gate cannot report success if any compile fails or any lock file is absent (fail-closed)
• Job runs unconditionally so it can be added as a required status check
• No changeset needed (CI-only change)

External action required (cannot be enforced from repo code)

To close the merge-with-failed-checks gap permanently, after merging:

1. Go to https://github.com/bradygaster/squad/settings/rules/12703724 (ruleset "main", id 12703724)
2. Set enforcement → Active
3. Under Conditions, add branch patterns: refs/heads/dev AND refs/heads/main
4. Under Rules → Required status checks, add:
   • Squad CI / gh-aw strict compile
   • Squad CI / test

GitHub rulesets are external configuration — they cannot be committed to the repo. The exact ruleset ID, URL, and required check names are documented in the workflow comment at line 680–689 of squad-ci.yml.

Does not overlap

• Preserve Squad CLI version in compiled action workflows #1884 version-fallback implementation
• Allow dependency additions without bypassing protected-file safety #1748 dependency routing

[github-actions]

🟢 Impact Analysis — PR #1886

Risk tier: 🟢 LOW

📊 Summary

Metric	Count
Files changed	1
Files added	0
Files modified	1
Files deleted	0
Modules touched	1

🎯 Risk Factors

• 1 files changed (≤5 → LOW)
• 1 module(s) touched (≤1 → LOW)

📦 Modules Affected

ci-workflows (1 file)

• .github/workflows/squad-ci.yml

---

This report is generated automatically for every PR. See #733 for details.

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit d8158cc

PR Scope: 🔧 Infrastructure

⚠️ 2 item(s) to address before review

Status	Check	Details
✅	Single commit	1 commit — clean history
✅	Not in draft	Ready for review
✅	Branch up to date	Up to date with dev
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	No source files changed — changeset not required
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	No Copilot review threads
❌	CI passing	12 check(s) still running

Files Changed (1 file, +85 −1)

File	+/−
.github/workflows/squad-ci.yml	+85 −1

Total: +85 −1

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

[github-actions]

🏗️ Architectural Review

⚠️ Architectural review: 1 info.

Severity	Category	Finding	Files
ℹ️ info	template-sync	Template files changed in .github/workflows/ but not in other template locations. If these templates should stay in sync, consider updating the others too.	Changed: .github/workflows/, Unchanged: templates/, .squad-templates/, packages/squad-cli/templates/

---

Automated architectural review — informational only.

[Copilot]

🟢 Approval recommended

The changes are narrowly scoped to CI, deterministically pin the compiler version, and the new strict compile gate appears fail-closed and aligned with existing repo compile-layout expectations.

Pull request overview

This PR makes the repository’s GitHub Actions workflow compilation deterministic and “required-check friendly” by pinning the gh-aw compiler version and adding a dedicated strict compile gate that runs on every PR and push.

Changes:

• Pin gh-aw extension installation to v0.86.2 in the existing test job.
• Add a new gh-aw-compile job that compiles all four workflow sources with --strict and fails closed if any compile fails or any expected .lock.yml output is missing.
• Emit a clear per-workflow/pass-fail + lock-file status report into $GITHUB_STEP_SUMMARY.

File summaries

File	Description
.github/workflows/squad-ci.yml	Pins gh-aw to v0.86.2 and adds an unconditional “gh-aw strict compile” job that compiles and verifies lock-file emission for all four workflow sources.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.