Fix BYOK smoke workflow COPILOT_MODEL fallback override in postprocessing (#2049)

* Initial plan

* fix: enforce non-empty COPILOT_MODEL fallback in BYOK smoke postprocess

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/de450c36-9674-4ba2-9fa8-4fbf7d96f0af

* Update scripts/ci/postprocess-smoke-workflows.test.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update scripts/ci/postprocess-smoke-workflows.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Potential fix for pull request finding 'CodeQL / Syntax error'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Potential fix for pull request finding 'CodeQL / Syntax error'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Landon Cox <landon.cox@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: 4 people

scripts/ci/postprocess-smoke-workflows.test.ts

@@ -245,6 +245,9 @@ const sessionStateDirInjectionRegex =
 const copySessionStateStepRegex =
   /^(\s+)- name: Copy Copilot session state files to logs\n\1  if: always\(\)\n\1  continue-on-error: true\n\1  run: bash "\$\{RUNNER_TEMP\}\/gh-aw\/actions\/copy_copilot_session_state\.sh"\n/m;
 
+const copilotModelEmptyFallbackRegex =
+  /(COPILOT_MODEL:\s*\$\{\{\s*vars\.GH_AW_MODEL_AGENT_COPILOT\s*\|\|\s*)''(\s*\}\})/g;
+
 function buildCopySessionStateStep(indent: string): string {
   const i = indent;
   const ri = `${i}    `;
@@ -355,3 +358,31 @@ describe('buildCopySessionStateStep', () => {
   });
 });
 
+describe('copilotModelEmptyFallbackRegex', () => {
+  const EXPECTED_COPILOT_MODEL_FALLBACK = 'claude-opus-4.6';
+
+  beforeEach(() => {
+    copilotModelEmptyFallbackRegex.lastIndex = 0;
+  });
+
+  it('should replace empty fallback with claude-opus-4.6 fallback', () => {
+    const input = "          COPILOT_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || '' }}\n";
+    const result = input.replace(
+      copilotModelEmptyFallbackRegex,
+      `$1'${EXPECTED_COPILOT_MODEL_FALLBACK}'$2`
+    );
+    expect(result).toBe(
+      `          COPILOT_MODEL: \${{ vars.GH_AW_MODEL_AGENT_COPILOT || '${EXPECTED_COPILOT_MODEL_FALLBACK}' }}\n`
+    );
+  });
+
+  it('should not modify already-correct fallback', () => {
+    const input =
+      "          COPILOT_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || 'claude-opus-4.6' }}\n";
+    const result = input.replace(
+      copilotModelEmptyFallbackRegex,
+      `$1'${EXPECTED_COPILOT_MODEL_FALLBACK}'$2`
+    );
+    expect(result).toBe(input);
+  });
+});

scripts/ci/postprocess-smoke-workflows.ts

@@ -94,6 +94,14 @@ const sessionStateDirInjectionRegex =
   /--audit-dir \/tmp\/gh-aw\/sandbox\/firewall\/audit(?! --session-state-dir)/g;
 const SESSION_STATE_DIR = '/tmp/gh-aw/sandbox/agent/session-state';
 
+// Work around gh-aw compiler bug (gh-aw#26565) where Copilot model fallback is
+// emitted as an empty string:
+//   COPILOT_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || '' }}
+// In BYOK smoke workflows, this overrides workflow-level COPILOT_MODEL when the
+// repo variable is unset, causing Copilot CLI startup failure.
+const copilotModelEmptyFallbackRegex =
+  /(COPILOT_MODEL:\s*\$\{\{\s*vars\.GH_AW_MODEL_AGENT_COPILOT\s*\|\|\s*)''(\s*\}\})/g;
+
 // Sentinel used to detect whether the "Copy Copilot session state" step has
 // already been replaced with the AWF-aware inline script.
 const copySessionStateSentinel = 'SESSION_STATE_SRC=';
@@ -445,6 +453,24 @@ for (const workflowPath of workflowPaths) {
     }
   }
 
+  // For smoke-copilot-byok: replace empty model fallbacks with the workflow-
+  // level COPILOT_MODEL env so the generated step inherits the shared default
+  // without hardcoding a duplicate model string here.
+  const isCopilotByokSmoke = workflowPath.includes('smoke-copilot-byok.lock.yml');
+  if (isCopilotByokSmoke) {
+    const emptyFallbackMatches = content.match(copilotModelEmptyFallbackRegex);
+    if (emptyFallbackMatches) {
+      content = content.replace(
+        copilotModelEmptyFallbackRegex,
+        '$1env.COPILOT_MODEL$2'
+      );
+      modified = true;
+      console.log(
+        `  Replaced ${emptyFallbackMatches.length} empty COPILOT_MODEL fallback(s) for BYOK smoke`
+      );
+    }
+  }
+
   // For smoke-services: inject GitHub Actions services block (Redis + PostgreSQL) into the
   // agent job and replace --enable-host-access with --allow-host-service-ports 6379,5432.
   // The gh-aw compiler does not natively support GitHub Actions `services:` in the