Fix dangling determine-automatic-lockdown step reference in static enclave sink-visibility policy

[Copilot]

When tools.github: false is combined with a static GitHub enclave and safe-outputs, the compiler emitted GH_AW_SINK_VISIBILITY: ${{ steps.determine-automatic-lockdown.outputs.visibility }} even though the determine-automatic-lockdown step was never generated (it only synthesized GitHub tool access for the enclave identity, not the primary agent). The dangling reference expanded to an empty string, which MCP Gateway rejects as an invalid sink-visibility value, blocking the agent and enclave from starting.

Root cause

collectMCPEnvironmentVariables gated GH_AW_SINK_VISIBILITY on a locally synthesized "GitHub tool enabled" map (toolsWithEnclaveGitHubIssues) used to render the enclave-scoped GitHub backend, instead of the authoritative githubLockdownDetectionStepEnabled(workflowData) predicate that actually controls whether the step is generated.

Changes

• Step generation (compiler_github_mcp_steps.go): githubLockdownDetectionStepEnabled now also returns true when staticEnclaveWriteSinkGuardPolicy(data) != nil, so the lockdown step is generated whenever a static enclave's write-sink policy needs the target visibility — even with the primary agent's GitHub tool disabled.
• Env var emission (mcp_environment.go): GH_AW_SINK_VISIBILITY and the primary GitHub guard-policy vars (GITHUB_MCP_GUARD_MIN_INTEGRITY/REPOS) are now gated on the same githubLockdownDetectionStepEnabled predicate, eliminating the drift between "step exists" and "step output referenced."
• Shared predicate (mcp_github_config.go): extracted githubBackendIsEnclaveOnly (static or dynamic enclave-only delegation) to a single helper, reused by both the env var logic and githubGuardPoliciesFromStep, so enclave-only backends consistently derive their guard/write-sink policy from the enclave declaration rather than step outputs.
• Regression coverage (enclave_github_proxy_test.go): added TestCompileStaticEnclaveOnlyGitHubDisabledSinkVisibility reproducing the exact reported frontmatter, plus a generic assertNoDanglingStepOutputReferences invariant that scans the compiled lock file for any steps.<id>.outputs.* reference and verifies the referenced step id was actually emitted — catching this class of bug generically, not just for this one field.

# now compiles without a dangling step reference
tools:
  github: false
enclaves:
  - repos:
      - repo: org/private-repo
        sensitivity: confidential
safe-outputs:
  add-comment:
    max: 1

• Fixes Static enclave write-sink references missing lockdown step when tools.github is false #60336

[Copilot]

🟡 Changes recommended

The new invariant can miss dangling references when a matching step ID exists in another job.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Fixes static enclave-only workflows that referenced a nonexistent lockdown step output.

Changes:

• Aligns lockdown-step generation with sink-visibility emission.
• Centralizes enclave-only backend detection.
• Adds regression coverage and a dangling-reference invariant.

File summaries

File	Description
pkg/workflow/compiler_github_mcp_steps.go	Generates the lockdown step when static enclave sink visibility requires it.
pkg/workflow/mcp_environment.go	Gates guard and visibility variables using shared predicates.
pkg/workflow/mcp_github_config.go	Adds shared enclave-only backend detection.
pkg/workflow/enclave_github_proxy_test.go	Adds regression tests and the workflow-reference invariant.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Balanced (auto)

Note

Copilot is running an experiment and ran this review at Balanced.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[lpcox]

@copilot address review feedback

[Copilot]

@copilot address review feedback

Addressed in 336af10: assertNoDanglingStepOutputReferences now validates steps.<id>.outputs.* references per job and requires step-field references to point to earlier steps in that same job. Targeted workflow tests and final validation passed.