From 2251aa2ba32906d92f0ef8ad6aad7fd89fbc5b80 Mon Sep 17 00:00:00 2001
From: Don Syme <dsyme@github.com>
Date: Sat, 31 Jan 2026 01:22:42 +0000
Subject: [PATCH 1/3] completely revert attempt to suppress preactivation

---
 .github/aw/actions-lock.json                  |   4 +-
 .../agent-performance-analyzer.lock.yml       |   2 +-
 .../workflows/agent-persona-explorer.lock.yml |   2 +-
 .github/workflows/ai-moderator.lock.yml       |   3 +-
 .github/workflows/archie.lock.yml             |  11 +-
 .github/workflows/auto-triage-issues.lock.yml |   2 +-
 .github/workflows/brave.lock.yml              |   4 +-
 .../breaking-change-checker.lock.yml          |   2 +-
 .github/workflows/changeset.lock.yml          |   8 +-
 .github/workflows/ci-doctor.lock.yml          |   9 +-
 .github/workflows/ci.yml                      |   5 +-
 .github/workflows/cloclo.lock.yml             |  21 +-
 .../workflows/code-scanning-fixer.lock.yml    |   2 +-
 .github/workflows/code-simplifier.lock.yml    |   2 +-
 .github/workflows/craft.lock.yml              |   3 +-
 .github/workflows/daily-file-diet.lock.yml    |   2 +-
 .../workflows/daily-issues-report.lock.yml    |   2 +-
 .../daily-observability-report.lock.yml       |   2 +-
 .../daily-safe-output-optimizer.lock.yml      |   2 +-
 .github/workflows/daily-team-status.lock.yml  |   2 +-
 .../daily-testify-uber-super-expert.lock.yml  |   2 +-
 .github/workflows/dependabot-bundler.lock.yml |   2 +-
 .github/workflows/dependabot-burner.lock.yml  |   2 +-
 .github/workflows/dev-hawk.lock.yml           |   6 +-
 .../example-custom-error-patterns.lock.yml    |   2 +-
 .github/workflows/firewall-escape.lock.yml    |   3 +-
 .github/workflows/grumpy-reviewer.lock.yml    |   6 +-
 .github/workflows/issue-classifier.lock.yml   |   2 +-
 .github/workflows/issue-monster.lock.yml      |   4 +-
 .github/workflows/mergefest.lock.yml          |   4 +-
 .github/workflows/metrics-collector.lock.yml  |   2 +-
 .github/workflows/pdf-summary.lock.yml        |   9 +-
 .github/workflows/plan.lock.yml               |   5 +-
 .github/workflows/poem-bot.lock.yml           |   5 +-
 .../workflows/pr-nitpick-reviewer.lock.yml    |  17 +-
 .github/workflows/q.lock.yml                  |  17 +-
 .github/workflows/release.lock.yml            |   8 +-
 .github/workflows/scout.lock.yml              |  25 +-
 .github/workflows/security-fix-pr.lock.yml    |   2 +-
 .github/workflows/security-guard.lock.yml     |   5 +-
 .github/workflows/security-review.lock.yml    |   3 +-
 .../workflows/slide-deck-maintainer.lock.yml  |   2 +-
 .github/workflows/smoke-claude.lock.yml       |   3 +-
 .github/workflows/smoke-codex.lock.yml        |   3 +-
 .github/workflows/smoke-copilot.lock.yml      |   3 +-
 .github/workflows/smoke-opencode.lock.yml     |   3 +-
 .github/workflows/smoke-test-tools.lock.yml   |   3 +-
 .github/workflows/test-yaml-import.lock.yml   |   2 +-
 .github/workflows/tidy.lock.yml               |   5 +-
 .../workflows/ubuntu-image-analyzer.lock.yml  |   2 +-
 .github/workflows/unbloat-docs.lock.yml       |   6 +-
 .github/workflows/workflow-generator.lock.yml |   4 +-
 .../workflow-health-manager.lock.yml          |   2 +-
 pkg/workflow/action_pins_integration_test.go  |  51 ++
 pkg/workflow/command_precision_test.go        |  11 +-
 pkg/workflow/compiler_activation_jobs.go      |  59 +--
 pkg/workflow/compiler_types.go                |  70 ++-
 pkg/workflow/custom_job_condition_test.go     |   2 +-
 pkg/workflow/data/action_pins.json            |   4 +-
 pkg/workflow/expression_builder.go            |  94 ----
 pkg/workflow/expressions_test.go              |  36 --
 pkg/workflow/pre_activation_skip_test.go      | 452 ------------------
 pkg/workflow/stop_time_check_job_test.go      |   6 +-
 63 files changed, 204 insertions(+), 840 deletions(-)
 delete mode 100644 pkg/workflow/pre_activation_skip_test.go

diff --git a/.github/aw/actions-lock.json b/.github/aw/actions-lock.json
index edbd2e8785b..e67dd0387d1 100644
--- a/.github/aw/actions-lock.json
+++ b/.github/aw/actions-lock.json
@@ -123,7 +123,7 @@
     "anchore/sbom-action@v0": {
       "repo": "anchore/sbom-action",
       "version": "v0",
-      "sha": "62ad5284b8ced813296287a0b63906cb364b73ee"
+      "sha": "deef08a0db64bfad603422135db61477b16cef56"
     },
     "anchore/sbom-action@v0.20.10": {
       "repo": "anchore/sbom-action",
@@ -158,7 +158,7 @@
     "docker/login-action@v3": {
       "repo": "docker/login-action",
       "version": "v3",
-      "sha": "5e57cd118135c172c3672efd75eb46360885c0ef"
+      "sha": "c94ce9fb468520275223c153574b00df6fe4bcc9"
     },
     "docker/metadata-action@v5": {
       "repo": "docker/metadata-action",
diff --git a/.github/workflows/agent-performance-analyzer.lock.yml b/.github/workflows/agent-performance-analyzer.lock.yml
index 55c76c16518..3a3bcf91e70 100644
--- a/.github/workflows/agent-performance-analyzer.lock.yml
+++ b/.github/workflows/agent-performance-analyzer.lock.yml
@@ -44,7 +44,7 @@ run-name: "Agent Performance Analyzer - Meta-Orchestrator"
 jobs:
   activation:
     needs: pre_activation
-    if: (needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')
+    if: needs.pre_activation.outputs.activated == 'true'
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/agent-persona-explorer.lock.yml b/.github/workflows/agent-persona-explorer.lock.yml
index 15690ce1203..2779dc88728 100644
--- a/.github/workflows/agent-persona-explorer.lock.yml
+++ b/.github/workflows/agent-persona-explorer.lock.yml
@@ -44,7 +44,7 @@ run-name: "Agent Persona Explorer"
 jobs:
   activation:
     needs: pre_activation
-    if: (needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')
+    if: needs.pre_activation.outputs.activated == 'true'
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/ai-moderator.lock.yml b/.github/workflows/ai-moderator.lock.yml
index 93ff1b71d39..70993313028 100644
--- a/.github/workflows/ai-moderator.lock.yml
+++ b/.github/workflows/ai-moderator.lock.yml
@@ -52,8 +52,7 @@ jobs:
       - check_external_user
       - pre_activation
     if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      ((github.event_name == 'workflow_dispatch') || (needs.check_external_user.outputs.should_skip != 'true'))
+      (needs.pre_activation.outputs.activated == 'true') && ((github.event_name == 'workflow_dispatch') || (needs.check_external_user.outputs.should_skip != 'true'))
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/archie.lock.yml b/.github/workflows/archie.lock.yml
index a55f1e9770b..394120a444d 100644
--- a/.github/workflows/archie.lock.yml
+++ b/.github/workflows/archie.lock.yml
@@ -51,13 +51,10 @@ jobs:
   activation:
     needs: pre_activation
     if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      ((github.event_name == 'issues') && (contains(github.event.issue.body, '/archie')) || (github.event_name == 'issue_comment') &&
-      ((contains(github.event.comment.body, '/archie')) && (github.event.issue.pull_request == null)) ||
-      (github.event_name == 'issue_comment') &&
-      ((contains(github.event.comment.body, '/archie')) && (github.event.issue.pull_request != null)) ||
-      (github.event_name == 'pull_request') &&
-      (contains(github.event.pull_request.body, '/archie')))
+      (needs.pre_activation.outputs.activated == 'true') && ((github.event_name == 'issues') && (contains(github.event.issue.body, '/archie')) ||
+      (github.event_name == 'issue_comment') && ((contains(github.event.comment.body, '/archie')) && (github.event.issue.pull_request == null)) ||
+      (github.event_name == 'issue_comment') && ((contains(github.event.comment.body, '/archie')) && (github.event.issue.pull_request != null)) ||
+      (github.event_name == 'pull_request') && (contains(github.event.pull_request.body, '/archie')))
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/auto-triage-issues.lock.yml b/.github/workflows/auto-triage-issues.lock.yml
index e6a19d96682..d360f5fec6d 100644
--- a/.github/workflows/auto-triage-issues.lock.yml
+++ b/.github/workflows/auto-triage-issues.lock.yml
@@ -48,7 +48,7 @@ run-name: "Auto-Triage Issues"
 jobs:
   activation:
     needs: pre_activation
-    if: (needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')
+    if: needs.pre_activation.outputs.activated == 'true'
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/brave.lock.yml b/.github/workflows/brave.lock.yml
index 7097d35480d..ed5d159a180 100644
--- a/.github/workflows/brave.lock.yml
+++ b/.github/workflows/brave.lock.yml
@@ -45,8 +45,8 @@ jobs:
   activation:
     needs: pre_activation
     if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      ((github.event_name == 'issue_comment') && ((contains(github.event.comment.body, '/brave')) && (github.event.issue.pull_request == null)))
+      (needs.pre_activation.outputs.activated == 'true') && ((github.event_name == 'issue_comment') && ((contains(github.event.comment.body, '/brave')) &&
+      (github.event.issue.pull_request == null)))
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/breaking-change-checker.lock.yml b/.github/workflows/breaking-change-checker.lock.yml
index af97ababb6b..22f1fe2f71b 100644
--- a/.github/workflows/breaking-change-checker.lock.yml
+++ b/.github/workflows/breaking-change-checker.lock.yml
@@ -40,7 +40,7 @@ run-name: "Breaking Change Checker"
 jobs:
   activation:
     needs: pre_activation
-    if: (needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')
+    if: needs.pre_activation.outputs.activated == 'true'
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/changeset.lock.yml b/.github/workflows/changeset.lock.yml
index 897740a09c1..72e8e5ada39 100644
--- a/.github/workflows/changeset.lock.yml
+++ b/.github/workflows/changeset.lock.yml
@@ -51,10 +51,10 @@ jobs:
   activation:
     needs: pre_activation
     if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      (((github.event.pull_request.base.ref == github.event.repository.default_branch) && ((github.event_name != 'pull_request') ||
-      (github.event.pull_request.head.repo.id == github.repository_id))) && ((github.event_name != 'pull_request') ||
-      ((github.event.action != 'labeled') || (github.event.label.name == 'changeset' || github.event.label.name == 'smoke'))))
+      (needs.pre_activation.outputs.activated == 'true') && (((github.event.pull_request.base.ref == github.event.repository.default_branch) &&
+      ((github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id))) &&
+      ((github.event_name != 'pull_request') || ((github.event.action != 'labeled') || (github.event.label.name == 'changeset' ||
+      github.event.label.name == 'smoke'))))
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/ci-doctor.lock.yml b/.github/workflows/ci-doctor.lock.yml
index 5655fbd5c39..8e8011b7dc8 100644
--- a/.github/workflows/ci-doctor.lock.yml
+++ b/.github/workflows/ci-doctor.lock.yml
@@ -25,7 +25,7 @@
 #
 # frontmatter-hash: 60a024446f9b09a310b0a78c3d5e00b4e4e489733862acc2c788bc525ec1ebc6
 #
-# Effective stop-time: 2026-03-01 15:52:28
+# Effective stop-time: 2026-02-09 04:24:18
 
 name: "CI Failure Doctor"
 "on":
@@ -50,9 +50,8 @@ jobs:
     needs: pre_activation
     # zizmor: ignore[dangerous-triggers] - workflow_run trigger is secured with role and fork validation
     if: >
-      (((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      (github.event.workflow_run.conclusion == 'failure')) && ((github.event_name != 'workflow_run') ||
-      ((github.event.workflow_run.repository.id == github.repository_id) &&
+      ((needs.pre_activation.outputs.activated == 'true') && (github.event.workflow_run.conclusion == 'failure')) &&
+      ((github.event_name != 'workflow_run') || ((github.event.workflow_run.repository.id == github.repository_id) &&
       (!(github.event.workflow_run.repository.fork))))
     runs-on: ubuntu-slim
     permissions:
@@ -1118,7 +1117,7 @@ jobs:
         id: check_stop_time
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          GH_AW_STOP_TIME: 2026-03-01 15:52:28
+          GH_AW_STOP_TIME: 2026-02-09 04:24:18
           GH_AW_WORKFLOW_NAME: "CI Failure Doctor"
         with:
           script: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 21e9f7ff8a7..3cc414a3cc5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -134,6 +134,9 @@ jobs:
           - name: "Workflow Cache"
             packages: "./pkg/workflow"
             pattern: "^TestCache|TestCacheDependencies|TestCacheKey|TestValidateCache"
+          - name: "Workflow Actions Pin Validation"
+            packages: "./pkg/workflow"
+            pattern: "^TestActionPinSHAsMatchVersionTags"
           - name: "Workflow Actions & Containers"
             packages: "./pkg/workflow"
             pattern: "^TestAction[^P]|Container"
@@ -166,7 +169,7 @@ jobs:
           - name: "Workflow Misc Part 2"  # Remaining workflow tests
             packages: "./pkg/workflow"
             pattern: ""
-            skip_pattern: "TestCompile|TestWorkflow|TestGenerate|TestParse|TestMCP|TestTool|TestSkill|TestPlaywright|TestFirewall|TestValidat|TestLock|TestError|TestWarning|SafeOutputs|CreatePullRequest|OutputLabel|HasSafeOutputs|GitHub|Git|PushToPullRequest|BuildFromAllowed|Render|Bundle|Script|WritePromptText|^TestCache|TestCacheDependencies|TestCacheKey|TestValidateCache|^TestAction[^P]|Container|Dependabot|Security|PII|TestPermissions|TestPackageExtractor|TestCollectPackagesFromWorkflow|TestAgent|TestCopilot|TestCustom|TestEngine|TestModel|TestNetwork|TestOpenAI|TestProvider|String|Sanitize|Normalize|Trim|Clean|Format|Runtime|Setup|Install|Download|Version|Binary"
+            skip_pattern: "TestCompile|TestWorkflow|TestGenerate|TestParse|TestMCP|TestTool|TestSkill|TestPlaywright|TestFirewall|TestValidat|TestLock|TestError|TestWarning|SafeOutputs|CreatePullRequest|OutputLabel|HasSafeOutputs|GitHub|Git|PushToPullRequest|BuildFromAllowed|Render|Bundle|Script|WritePromptText|^TestCache|TestCacheDependencies|TestCacheKey|TestValidateCache|^TestActionPinSHAsMatchVersionTags|^TestAction[^P]|Container|Dependabot|Security|PII|TestPermissions|TestPackageExtractor|TestCollectPackagesFromWorkflow|TestAgent|TestCopilot|TestCustom|TestEngine|TestModel|TestNetwork|TestOpenAI|TestProvider|String|Sanitize|Normalize|Trim|Clean|Format|Runtime|Setup|Install|Download|Version|Binary"
     concurrency:
       group: ci-${{ github.ref }}-integration-${{ matrix.test-group.name }}
       cancel-in-progress: true
diff --git a/.github/workflows/cloclo.lock.yml b/.github/workflows/cloclo.lock.yml
index f4882af4f78..feceddad537 100644
--- a/.github/workflows/cloclo.lock.yml
+++ b/.github/workflows/cloclo.lock.yml
@@ -68,18 +68,15 @@ jobs:
   activation:
     needs: pre_activation
     if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      ((((github.event_name == 'issues' || github.event_name == 'issue_comment' || github.event_name == 'pull_request' ||
-      github.event_name == 'pull_request_review_comment' || github.event_name == 'discussion' || github.event_name == 'discussion_comment') &&
-      ((github.event_name == 'issues') && (contains(github.event.issue.body, '/cloclo')) || (github.event_name == 'issue_comment') &&
-      ((contains(github.event.comment.body, '/cloclo')) && (github.event.issue.pull_request == null)) ||
-      (github.event_name == 'issue_comment') &&
-      ((contains(github.event.comment.body, '/cloclo')) && (github.event.issue.pull_request != null)) ||
-      (github.event_name == 'pull_request_review_comment') &&
-      (contains(github.event.comment.body, '/cloclo')) || (github.event_name == 'pull_request') &&
-      (contains(github.event.pull_request.body, '/cloclo')) ||
-      (github.event_name == 'discussion') && (contains(github.event.discussion.body, '/cloclo')) ||
-      (github.event_name == 'discussion_comment') &&
+      (needs.pre_activation.outputs.activated == 'true') && ((((github.event_name == 'issues' || github.event_name == 'issue_comment' ||
+      github.event_name == 'pull_request' || github.event_name == 'pull_request_review_comment' || github.event_name == 'discussion' ||
+      github.event_name == 'discussion_comment') && ((github.event_name == 'issues') && (contains(github.event.issue.body, '/cloclo')) ||
+      (github.event_name == 'issue_comment') && ((contains(github.event.comment.body, '/cloclo')) && (github.event.issue.pull_request == null)) ||
+      (github.event_name == 'issue_comment') && ((contains(github.event.comment.body, '/cloclo')) && (github.event.issue.pull_request != null)) ||
+      (github.event_name == 'pull_request_review_comment') && (contains(github.event.comment.body, '/cloclo')) ||
+      (github.event_name == 'pull_request') && (contains(github.event.pull_request.body, '/cloclo')) ||
+      (github.event_name == 'discussion') &&
+      (contains(github.event.discussion.body, '/cloclo')) || (github.event_name == 'discussion_comment') &&
       (contains(github.event.comment.body, '/cloclo')))) || (!(github.event_name == 'issues' || github.event_name == 'issue_comment' ||
       github.event_name == 'pull_request' || github.event_name == 'pull_request_review_comment' || github.event_name == 'discussion' ||
       github.event_name == 'discussion_comment'))) && ((github.event_name != 'issues') || ((github.event.action != 'labeled') ||
diff --git a/.github/workflows/code-scanning-fixer.lock.yml b/.github/workflows/code-scanning-fixer.lock.yml
index 48d72075ca6..bb3dbfae9c4 100644
--- a/.github/workflows/code-scanning-fixer.lock.yml
+++ b/.github/workflows/code-scanning-fixer.lock.yml
@@ -38,7 +38,7 @@ run-name: "Code Scanning Fixer"
 jobs:
   activation:
     needs: pre_activation
-    if: (needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')
+    if: needs.pre_activation.outputs.activated == 'true'
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/code-simplifier.lock.yml b/.github/workflows/code-simplifier.lock.yml
index ba595bfe40a..75b6b283d55 100644
--- a/.github/workflows/code-simplifier.lock.yml
+++ b/.github/workflows/code-simplifier.lock.yml
@@ -45,7 +45,7 @@ run-name: "Code Simplifier"
 jobs:
   activation:
     needs: pre_activation
-    if: (needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')
+    if: needs.pre_activation.outputs.activated == 'true'
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/craft.lock.yml b/.github/workflows/craft.lock.yml
index f5ef68c7e8d..5bb1d1c9a67 100644
--- a/.github/workflows/craft.lock.yml
+++ b/.github/workflows/craft.lock.yml
@@ -42,8 +42,7 @@ jobs:
   activation:
     needs: pre_activation
     if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      ((github.event_name == 'issues') && (contains(github.event.issue.body, '/craft')))
+      (needs.pre_activation.outputs.activated == 'true') && ((github.event_name == 'issues') && (contains(github.event.issue.body, '/craft')))
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/daily-file-diet.lock.yml b/.github/workflows/daily-file-diet.lock.yml
index 72fbfd7c8e2..718cf1d86fb 100644
--- a/.github/workflows/daily-file-diet.lock.yml
+++ b/.github/workflows/daily-file-diet.lock.yml
@@ -45,7 +45,7 @@ run-name: "Daily File Diet"
 jobs:
   activation:
     needs: pre_activation
-    if: (needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')
+    if: needs.pre_activation.outputs.activated == 'true'
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/daily-issues-report.lock.yml b/.github/workflows/daily-issues-report.lock.yml
index bf65fe23628..ffd36ff906a 100644
--- a/.github/workflows/daily-issues-report.lock.yml
+++ b/.github/workflows/daily-issues-report.lock.yml
@@ -48,7 +48,7 @@ run-name: "Daily Issues Report Generator"
 jobs:
   activation:
     needs: pre_activation
-    if: (needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')
+    if: needs.pre_activation.outputs.activated == 'true'
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/daily-observability-report.lock.yml b/.github/workflows/daily-observability-report.lock.yml
index 4cdf8cce34e..9b2a696dce8 100644
--- a/.github/workflows/daily-observability-report.lock.yml
+++ b/.github/workflows/daily-observability-report.lock.yml
@@ -44,7 +44,7 @@ run-name: "Daily Observability Report for AWF Firewall and MCP Gateway"
 jobs:
   activation:
     needs: pre_activation
-    if: (needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')
+    if: needs.pre_activation.outputs.activated == 'true'
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/daily-safe-output-optimizer.lock.yml b/.github/workflows/daily-safe-output-optimizer.lock.yml
index 657729b5dda..2abb9079080 100644
--- a/.github/workflows/daily-safe-output-optimizer.lock.yml
+++ b/.github/workflows/daily-safe-output-optimizer.lock.yml
@@ -47,7 +47,7 @@ run-name: "Daily Safe Output Tool Optimizer"
 jobs:
   activation:
     needs: pre_activation
-    if: (needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')
+    if: needs.pre_activation.outputs.activated == 'true'
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/daily-team-status.lock.yml b/.github/workflows/daily-team-status.lock.yml
index d97febf4c51..1d8c199e931 100644
--- a/.github/workflows/daily-team-status.lock.yml
+++ b/.github/workflows/daily-team-status.lock.yml
@@ -51,7 +51,7 @@ run-name: "Daily Team Status"
 jobs:
   activation:
     needs: pre_activation
-    if: (needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')
+    if: needs.pre_activation.outputs.activated == 'true'
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/daily-testify-uber-super-expert.lock.yml b/.github/workflows/daily-testify-uber-super-expert.lock.yml
index 535432cddec..9671aadf410 100644
--- a/.github/workflows/daily-testify-uber-super-expert.lock.yml
+++ b/.github/workflows/daily-testify-uber-super-expert.lock.yml
@@ -46,7 +46,7 @@ run-name: "Daily Testify Uber Super Expert"
 jobs:
   activation:
     needs: pre_activation
-    if: (needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')
+    if: needs.pre_activation.outputs.activated == 'true'
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/dependabot-bundler.lock.yml b/.github/workflows/dependabot-bundler.lock.yml
index 974a7d06486..0f553840061 100644
--- a/.github/workflows/dependabot-bundler.lock.yml
+++ b/.github/workflows/dependabot-bundler.lock.yml
@@ -38,7 +38,7 @@ run-name: "Dependabot Bundler"
 jobs:
   activation:
     needs: pre_activation
-    if: (needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')
+    if: needs.pre_activation.outputs.activated == 'true'
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/dependabot-burner.lock.yml b/.github/workflows/dependabot-burner.lock.yml
index 025fdc3f9c7..484ea071e6a 100644
--- a/.github/workflows/dependabot-burner.lock.yml
+++ b/.github/workflows/dependabot-burner.lock.yml
@@ -45,7 +45,7 @@ run-name: "Dependabot Burner"
 jobs:
   activation:
     needs: pre_activation
-    if: (needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')
+    if: needs.pre_activation.outputs.activated == 'true'
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/dev-hawk.lock.yml b/.github/workflows/dev-hawk.lock.yml
index 00873f95b55..5f9dc35d8b3 100644
--- a/.github/workflows/dev-hawk.lock.yml
+++ b/.github/workflows/dev-hawk.lock.yml
@@ -50,9 +50,9 @@ jobs:
     needs: pre_activation
     # zizmor: ignore[dangerous-triggers] - workflow_run trigger is secured with role and fork validation
     if: >
-      (((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      (github.event.workflow_run.event == 'workflow_dispatch')) && ((github.event_name != 'workflow_run') ||
-      ((github.event.workflow_run.repository.id == github.repository_id) && (!(github.event.workflow_run.repository.fork))))
+      ((needs.pre_activation.outputs.activated == 'true') && (github.event.workflow_run.event == 'workflow_dispatch')) &&
+      ((github.event_name != 'workflow_run') || ((github.event.workflow_run.repository.id == github.repository_id) &&
+      (!(github.event.workflow_run.repository.fork))))
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/example-custom-error-patterns.lock.yml b/.github/workflows/example-custom-error-patterns.lock.yml
index 2230baaea5d..4b82f73e677 100644
--- a/.github/workflows/example-custom-error-patterns.lock.yml
+++ b/.github/workflows/example-custom-error-patterns.lock.yml
@@ -38,7 +38,7 @@ run-name: "Example: Custom Error Patterns"
 jobs:
   activation:
     needs: pre_activation
-    if: (needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')
+    if: needs.pre_activation.outputs.activated == 'true'
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/firewall-escape.lock.yml b/.github/workflows/firewall-escape.lock.yml
index 4343b6d4c24..119939ac27f 100644
--- a/.github/workflows/firewall-escape.lock.yml
+++ b/.github/workflows/firewall-escape.lock.yml
@@ -47,8 +47,7 @@ jobs:
   activation:
     needs: pre_activation
     if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      (((github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id)) &&
+      (needs.pre_activation.outputs.activated == 'true') && (((github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id)) &&
       ((github.event_name != 'pull_request') || ((github.event.action != 'labeled') || (github.event.label.name == 'firewall-escape-test'))))
     runs-on: ubuntu-slim
     permissions:
diff --git a/.github/workflows/grumpy-reviewer.lock.yml b/.github/workflows/grumpy-reviewer.lock.yml
index ffa1982a167..1d8784d2476 100644
--- a/.github/workflows/grumpy-reviewer.lock.yml
+++ b/.github/workflows/grumpy-reviewer.lock.yml
@@ -45,9 +45,9 @@ jobs:
   activation:
     needs: pre_activation
     if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      ((github.event_name == 'issue_comment') && ((contains(github.event.comment.body, '/grumpy')) && (github.event.issue.pull_request != null)) ||
-      (github.event_name == 'pull_request_review_comment') && (contains(github.event.comment.body, '/grumpy')))
+      (needs.pre_activation.outputs.activated == 'true') && ((github.event_name == 'issue_comment') && ((contains(github.event.comment.body, '/grumpy')) &&
+      (github.event.issue.pull_request != null)) || (github.event_name == 'pull_request_review_comment') &&
+      (contains(github.event.comment.body, '/grumpy')))
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/issue-classifier.lock.yml b/.github/workflows/issue-classifier.lock.yml
index 36e36aae66c..6c388506051 100644
--- a/.github/workflows/issue-classifier.lock.yml
+++ b/.github/workflows/issue-classifier.lock.yml
@@ -43,7 +43,7 @@ run-name: "Issue Classifier"
 jobs:
   activation:
     needs: pre_activation
-    if: (needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')
+    if: needs.pre_activation.outputs.activated == 'true'
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/issue-monster.lock.yml b/.github/workflows/issue-monster.lock.yml
index 474cfe7bd22..f60032c41dd 100644
--- a/.github/workflows/issue-monster.lock.yml
+++ b/.github/workflows/issue-monster.lock.yml
@@ -46,9 +46,7 @@ jobs:
     needs:
       - pre_activation
       - search_issues
-    if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      (needs.search_issues.outputs.has_issues == 'true')
+    if: (needs.pre_activation.outputs.activated == 'true') && (needs.search_issues.outputs.has_issues == 'true')
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/mergefest.lock.yml b/.github/workflows/mergefest.lock.yml
index 272bb1daaa7..fe136245f64 100644
--- a/.github/workflows/mergefest.lock.yml
+++ b/.github/workflows/mergefest.lock.yml
@@ -41,8 +41,8 @@ jobs:
   activation:
     needs: pre_activation
     if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      ((github.event_name == 'issue_comment') && ((contains(github.event.comment.body, '/mergefest')) && (github.event.issue.pull_request != null)))
+      (needs.pre_activation.outputs.activated == 'true') && ((github.event_name == 'issue_comment') && ((contains(github.event.comment.body, '/mergefest')) &&
+      (github.event.issue.pull_request != null)))
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/metrics-collector.lock.yml b/.github/workflows/metrics-collector.lock.yml
index 148fe0dea4c..5bacf1624f0 100644
--- a/.github/workflows/metrics-collector.lock.yml
+++ b/.github/workflows/metrics-collector.lock.yml
@@ -40,7 +40,7 @@ run-name: "Metrics Collector - Infrastructure Agent"
 jobs:
   activation:
     needs: pre_activation
-    if: (needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')
+    if: needs.pre_activation.outputs.activated == 'true'
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/pdf-summary.lock.yml b/.github/workflows/pdf-summary.lock.yml
index 6337cafc91e..65f27283456 100644
--- a/.github/workflows/pdf-summary.lock.yml
+++ b/.github/workflows/pdf-summary.lock.yml
@@ -61,11 +61,10 @@ jobs:
   activation:
     needs: pre_activation
     if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      (((github.event_name == 'issue_comment' || github.event_name == 'issues') && ((github.event_name == 'issues') &&
-      (contains(github.event.issue.body, '/summarize')) || (github.event_name == 'issue_comment') &&
-      ((contains(github.event.comment.body, '/summarize')) &&
-      (github.event.issue.pull_request == null)))) || (!(github.event_name == 'issue_comment' || github.event_name == 'issues')))
+      (needs.pre_activation.outputs.activated == 'true') && (((github.event_name == 'issue_comment' || github.event_name == 'issues') &&
+      ((github.event_name == 'issues') && (contains(github.event.issue.body, '/summarize')) || (github.event_name == 'issue_comment') &&
+      ((contains(github.event.comment.body, '/summarize')) && (github.event.issue.pull_request == null)))) ||
+      (!(github.event_name == 'issue_comment' || github.event_name == 'issues')))
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/plan.lock.yml b/.github/workflows/plan.lock.yml
index bd9f35ca87b..7190ac084ef 100644
--- a/.github/workflows/plan.lock.yml
+++ b/.github/workflows/plan.lock.yml
@@ -45,9 +45,8 @@ jobs:
   activation:
     needs: pre_activation
     if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      ((github.event_name == 'issue_comment') && ((contains(github.event.comment.body, '/plan')) && (github.event.issue.pull_request == null)) ||
-      (github.event_name == 'discussion_comment') && (contains(github.event.comment.body, '/plan')))
+      (needs.pre_activation.outputs.activated == 'true') && ((github.event_name == 'issue_comment') && ((contains(github.event.comment.body, '/plan')) &&
+      (github.event.issue.pull_request == null)) || (github.event_name == 'discussion_comment') && (contains(github.event.comment.body, '/plan')))
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/poem-bot.lock.yml b/.github/workflows/poem-bot.lock.yml
index 5162cfd9b15..699d478e4ac 100644
--- a/.github/workflows/poem-bot.lock.yml
+++ b/.github/workflows/poem-bot.lock.yml
@@ -52,9 +52,8 @@ jobs:
   activation:
     needs: pre_activation
     if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      (((github.event_name == 'issues') && ((github.event_name == 'issues') && (contains(github.event.issue.body, '/poem-bot')))) ||
-      (!(github.event_name == 'issues')))
+      (needs.pre_activation.outputs.activated == 'true') && (((github.event_name == 'issues') && ((github.event_name == 'issues') &&
+      (contains(github.event.issue.body, '/poem-bot')))) || (!(github.event_name == 'issues')))
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/pr-nitpick-reviewer.lock.yml b/.github/workflows/pr-nitpick-reviewer.lock.yml
index 6a873152143..c46e50d5951 100644
--- a/.github/workflows/pr-nitpick-reviewer.lock.yml
+++ b/.github/workflows/pr-nitpick-reviewer.lock.yml
@@ -67,16 +67,13 @@ jobs:
   activation:
     needs: pre_activation
     if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      ((github.event_name == 'issues') && (contains(github.event.issue.body, '/nit')) || (github.event_name == 'issue_comment') &&
-      ((contains(github.event.comment.body, '/nit')) && (github.event.issue.pull_request == null)) ||
-      (github.event_name == 'issue_comment') &&
-      ((contains(github.event.comment.body, '/nit')) && (github.event.issue.pull_request != null)) ||
-      (github.event_name == 'pull_request_review_comment') &&
-      (contains(github.event.comment.body, '/nit')) || (github.event_name == 'pull_request') &&
-      (contains(github.event.pull_request.body, '/nit')) ||
-      (github.event_name == 'discussion') && (contains(github.event.discussion.body, '/nit')) ||
-      (github.event_name == 'discussion_comment') &&
+      (needs.pre_activation.outputs.activated == 'true') && ((github.event_name == 'issues') && (contains(github.event.issue.body, '/nit')) ||
+      (github.event_name == 'issue_comment') && ((contains(github.event.comment.body, '/nit')) && (github.event.issue.pull_request == null)) ||
+      (github.event_name == 'issue_comment') && ((contains(github.event.comment.body, '/nit')) && (github.event.issue.pull_request != null)) ||
+      (github.event_name == 'pull_request_review_comment') && (contains(github.event.comment.body, '/nit')) ||
+      (github.event_name == 'pull_request') && (contains(github.event.pull_request.body, '/nit')) ||
+      (github.event_name == 'discussion') &&
+      (contains(github.event.discussion.body, '/nit')) || (github.event_name == 'discussion_comment') &&
       (contains(github.event.comment.body, '/nit')))
     runs-on: ubuntu-slim
     permissions:
diff --git a/.github/workflows/q.lock.yml b/.github/workflows/q.lock.yml
index cee0e3a0d65..856b86aea7a 100644
--- a/.github/workflows/q.lock.yml
+++ b/.github/workflows/q.lock.yml
@@ -67,16 +67,13 @@ jobs:
   activation:
     needs: pre_activation
     if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      ((github.event_name == 'issues') && (contains(github.event.issue.body, '/q')) || (github.event_name == 'issue_comment') &&
-      ((contains(github.event.comment.body, '/q')) && (github.event.issue.pull_request == null)) ||
-      (github.event_name == 'issue_comment') &&
-      ((contains(github.event.comment.body, '/q')) && (github.event.issue.pull_request != null)) ||
-      (github.event_name == 'pull_request_review_comment') &&
-      (contains(github.event.comment.body, '/q')) || (github.event_name == 'pull_request') &&
-      (contains(github.event.pull_request.body, '/q')) ||
-      (github.event_name == 'discussion') && (contains(github.event.discussion.body, '/q')) ||
-      (github.event_name == 'discussion_comment') &&
+      (needs.pre_activation.outputs.activated == 'true') && ((github.event_name == 'issues') && (contains(github.event.issue.body, '/q')) ||
+      (github.event_name == 'issue_comment') && ((contains(github.event.comment.body, '/q')) && (github.event.issue.pull_request == null)) ||
+      (github.event_name == 'issue_comment') && ((contains(github.event.comment.body, '/q')) && (github.event.issue.pull_request != null)) ||
+      (github.event_name == 'pull_request_review_comment') && (contains(github.event.comment.body, '/q')) ||
+      (github.event_name == 'pull_request') && (contains(github.event.pull_request.body, '/q')) ||
+      (github.event_name == 'discussion') &&
+      (contains(github.event.discussion.body, '/q')) || (github.event_name == 'discussion_comment') &&
       (contains(github.event.comment.body, '/q')))
     runs-on: ubuntu-slim
     permissions:
diff --git a/.github/workflows/release.lock.yml b/.github/workflows/release.lock.yml
index 80f633fa032..3930ed02144 100644
--- a/.github/workflows/release.lock.yml
+++ b/.github/workflows/release.lock.yml
@@ -46,7 +46,7 @@ run-name: "Release"
 jobs:
   activation:
     needs: pre_activation
-    if: (needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')
+    if: needs.pre_activation.outputs.activated == 'true'
     runs-on: ubuntu-slim
     permissions:
       contents: read
@@ -1218,13 +1218,13 @@ jobs:
       - name: Download Go modules
         run: go mod download
       - name: Generate SBOM (SPDX format)
-        uses: anchore/sbom-action@62ad5284b8ced813296287a0b63906cb364b73ee # v0
+        uses: anchore/sbom-action@deef08a0db64bfad603422135db61477b16cef56 # v0
         with:
           artifact-name: sbom.spdx.json
           format: spdx-json
           output-file: sbom.spdx.json
       - name: Generate SBOM (CycloneDX format)
-        uses: anchore/sbom-action@62ad5284b8ced813296287a0b63906cb364b73ee # v0
+        uses: anchore/sbom-action@deef08a0db64bfad603422135db61477b16cef56 # v0
         with:
           artifact-name: sbom.cdx.json
           format: cyclonedx-json
@@ -1258,7 +1258,7 @@ jobs:
       - name: Setup Docker Buildx
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           password: ${{ secrets.GITHUB_TOKEN }}
           registry: ghcr.io
diff --git a/.github/workflows/scout.lock.yml b/.github/workflows/scout.lock.yml
index 0ae4e67563d..dcd0b036413 100644
--- a/.github/workflows/scout.lock.yml
+++ b/.github/workflows/scout.lock.yml
@@ -78,21 +78,18 @@ jobs:
   activation:
     needs: pre_activation
     if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      (((github.event_name == 'issues' || github.event_name == 'issue_comment' || github.event_name == 'pull_request' ||
-      github.event_name == 'pull_request_review_comment' || github.event_name == 'discussion' || github.event_name == 'discussion_comment') &&
-      ((github.event_name == 'issues') && (contains(github.event.issue.body, '/scout')) || (github.event_name == 'issue_comment') &&
-      ((contains(github.event.comment.body, '/scout')) && (github.event.issue.pull_request == null)) ||
-      (github.event_name == 'issue_comment') &&
-      ((contains(github.event.comment.body, '/scout')) && (github.event.issue.pull_request != null)) ||
-      (github.event_name == 'pull_request_review_comment') &&
-      (contains(github.event.comment.body, '/scout')) || (github.event_name == 'pull_request') &&
-      (contains(github.event.pull_request.body, '/scout')) ||
-      (github.event_name == 'discussion') && (contains(github.event.discussion.body, '/scout')) ||
-      (github.event_name == 'discussion_comment') &&
-      (contains(github.event.comment.body, '/scout')))) || (!(github.event_name == 'issues' || github.event_name == 'issue_comment' ||
+      (needs.pre_activation.outputs.activated == 'true') && (((github.event_name == 'issues' || github.event_name == 'issue_comment' ||
       github.event_name == 'pull_request' || github.event_name == 'pull_request_review_comment' || github.event_name == 'discussion' ||
-      github.event_name == 'discussion_comment')))
+      github.event_name == 'discussion_comment') && ((github.event_name == 'issues') && (contains(github.event.issue.body, '/scout')) ||
+      (github.event_name == 'issue_comment') && ((contains(github.event.comment.body, '/scout')) && (github.event.issue.pull_request == null)) ||
+      (github.event_name == 'issue_comment') && ((contains(github.event.comment.body, '/scout')) && (github.event.issue.pull_request != null)) ||
+      (github.event_name == 'pull_request_review_comment') && (contains(github.event.comment.body, '/scout')) ||
+      (github.event_name == 'pull_request') && (contains(github.event.pull_request.body, '/scout')) ||
+      (github.event_name == 'discussion') &&
+      (contains(github.event.discussion.body, '/scout')) || (github.event_name == 'discussion_comment') &&
+      (contains(github.event.comment.body, '/scout')))) ||
+      (!(github.event_name == 'issues' || github.event_name == 'issue_comment' || github.event_name == 'pull_request' ||
+      github.event_name == 'pull_request_review_comment' || github.event_name == 'discussion' || github.event_name == 'discussion_comment')))
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/security-fix-pr.lock.yml b/.github/workflows/security-fix-pr.lock.yml
index 34a1523f41b..fd22ad5dff7 100644
--- a/.github/workflows/security-fix-pr.lock.yml
+++ b/.github/workflows/security-fix-pr.lock.yml
@@ -43,7 +43,7 @@ run-name: "Security Fix PR"
 jobs:
   activation:
     needs: pre_activation
-    if: (needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')
+    if: needs.pre_activation.outputs.activated == 'true'
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/security-guard.lock.yml b/.github/workflows/security-guard.lock.yml
index df52c641218..09f88722680 100644
--- a/.github/workflows/security-guard.lock.yml
+++ b/.github/workflows/security-guard.lock.yml
@@ -42,9 +42,8 @@ jobs:
   activation:
     needs: pre_activation
     if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      (((github.event_name != 'pull_request') || (github.event.pull_request.draft == false)) && ((github.event_name != 'pull_request') ||
-      (github.event.pull_request.head.repo.id == github.repository_id)))
+      (needs.pre_activation.outputs.activated == 'true') && (((github.event_name != 'pull_request') || (github.event.pull_request.draft == false)) &&
+      ((github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id)))
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/security-review.lock.yml b/.github/workflows/security-review.lock.yml
index 47d46a87768..89e6ee2699d 100644
--- a/.github/workflows/security-review.lock.yml
+++ b/.github/workflows/security-review.lock.yml
@@ -45,8 +45,7 @@ jobs:
   activation:
     needs: pre_activation
     if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      ((github.event_name == 'issue_comment') && ((contains(github.event.comment.body, '/security-review')) &&
+      (needs.pre_activation.outputs.activated == 'true') && ((github.event_name == 'issue_comment') && ((contains(github.event.comment.body, '/security-review')) &&
       (github.event.issue.pull_request != null)) || (github.event_name == 'pull_request_review_comment') &&
       (contains(github.event.comment.body, '/security-review')))
     runs-on: ubuntu-slim
diff --git a/.github/workflows/slide-deck-maintainer.lock.yml b/.github/workflows/slide-deck-maintainer.lock.yml
index e1b37ca6f42..ea909c1fe83 100644
--- a/.github/workflows/slide-deck-maintainer.lock.yml
+++ b/.github/workflows/slide-deck-maintainer.lock.yml
@@ -45,7 +45,7 @@ run-name: "Slide Deck Maintainer"
 jobs:
   activation:
     needs: pre_activation
-    if: (needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')
+    if: needs.pre_activation.outputs.activated == 'true'
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml
index f50a1344852..6f8e8583695 100644
--- a/.github/workflows/smoke-claude.lock.yml
+++ b/.github/workflows/smoke-claude.lock.yml
@@ -56,8 +56,7 @@ jobs:
   activation:
     needs: pre_activation
     if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      (((github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id)) &&
+      (needs.pre_activation.outputs.activated == 'true') && (((github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id)) &&
       ((github.event_name != 'pull_request') || ((github.event.action != 'labeled') || (github.event.label.name == 'smoke'))))
     runs-on: ubuntu-slim
     permissions:
diff --git a/.github/workflows/smoke-codex.lock.yml b/.github/workflows/smoke-codex.lock.yml
index a7fedb87432..1f33bcf0dfb 100644
--- a/.github/workflows/smoke-codex.lock.yml
+++ b/.github/workflows/smoke-codex.lock.yml
@@ -53,8 +53,7 @@ jobs:
   activation:
     needs: pre_activation
     if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      (((github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id)) &&
+      (needs.pre_activation.outputs.activated == 'true') && (((github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id)) &&
       ((github.event_name != 'pull_request') || ((github.event.action != 'labeled') || (github.event.label.name == 'smoke'))))
     runs-on: ubuntu-slim
     permissions:
diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml
index 8b4c86d1cb7..dfb7d81d18a 100644
--- a/.github/workflows/smoke-copilot.lock.yml
+++ b/.github/workflows/smoke-copilot.lock.yml
@@ -52,8 +52,7 @@ jobs:
   activation:
     needs: pre_activation
     if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      (((github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id)) &&
+      (needs.pre_activation.outputs.activated == 'true') && (((github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id)) &&
       ((github.event_name != 'pull_request') || ((github.event.action != 'labeled') || (github.event.label.name == 'smoke'))))
     runs-on: ubuntu-slim
     permissions:
diff --git a/.github/workflows/smoke-opencode.lock.yml b/.github/workflows/smoke-opencode.lock.yml
index 35fa8adf8be..fe7b6e64965 100644
--- a/.github/workflows/smoke-opencode.lock.yml
+++ b/.github/workflows/smoke-opencode.lock.yml
@@ -52,8 +52,7 @@ jobs:
   activation:
     needs: pre_activation
     if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      (((github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id)) &&
+      (needs.pre_activation.outputs.activated == 'true') && (((github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id)) &&
       ((github.event_name != 'pull_request') || ((github.event.action != 'labeled') || (github.event.label.name == 'smoke'))))
     runs-on: ubuntu-slim
     permissions:
diff --git a/.github/workflows/smoke-test-tools.lock.yml b/.github/workflows/smoke-test-tools.lock.yml
index d05893e0632..d80b6545d35 100644
--- a/.github/workflows/smoke-test-tools.lock.yml
+++ b/.github/workflows/smoke-test-tools.lock.yml
@@ -47,8 +47,7 @@ jobs:
   activation:
     needs: pre_activation
     if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      (((github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id)) &&
+      (needs.pre_activation.outputs.activated == 'true') && (((github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id)) &&
       ((github.event_name != 'pull_request') || ((github.event.action != 'labeled') || (github.event.label.name == 'smoke'))))
     runs-on: ubuntu-slim
     permissions:
diff --git a/.github/workflows/test-yaml-import.lock.yml b/.github/workflows/test-yaml-import.lock.yml
index 2c957cbb4db..a55705bc251 100644
--- a/.github/workflows/test-yaml-import.lock.yml
+++ b/.github/workflows/test-yaml-import.lock.yml
@@ -39,7 +39,7 @@ run-name: "Test YAML Import"
 jobs:
   activation:
     needs: pre_activation
-    if: (needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')
+    if: needs.pre_activation.outputs.activated == 'true'
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/tidy.lock.yml b/.github/workflows/tidy.lock.yml
index 57f96dcedb6..58b6fc15e39 100644
--- a/.github/workflows/tidy.lock.yml
+++ b/.github/workflows/tidy.lock.yml
@@ -53,9 +53,8 @@ jobs:
   activation:
     needs: pre_activation
     if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      (((github.event_name == 'issue_comment') && ((github.event_name == 'issue_comment') && ((contains(github.event.comment.body, '/tidy')) &&
-      (github.event.issue.pull_request != null)))) || (!(github.event_name == 'issue_comment')))
+      (needs.pre_activation.outputs.activated == 'true') && (((github.event_name == 'issue_comment') && ((github.event_name == 'issue_comment') &&
+      ((contains(github.event.comment.body, '/tidy')) && (github.event.issue.pull_request != null)))) || (!(github.event_name == 'issue_comment')))
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/ubuntu-image-analyzer.lock.yml b/.github/workflows/ubuntu-image-analyzer.lock.yml
index 14b0686d049..62df373c839 100644
--- a/.github/workflows/ubuntu-image-analyzer.lock.yml
+++ b/.github/workflows/ubuntu-image-analyzer.lock.yml
@@ -41,7 +41,7 @@ run-name: "Ubuntu Actions Image Analyzer"
 jobs:
   activation:
     needs: pre_activation
-    if: (needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')
+    if: needs.pre_activation.outputs.activated == 'true'
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/unbloat-docs.lock.yml b/.github/workflows/unbloat-docs.lock.yml
index a34b6667d62..0f7081d6e31 100644
--- a/.github/workflows/unbloat-docs.lock.yml
+++ b/.github/workflows/unbloat-docs.lock.yml
@@ -49,9 +49,9 @@ jobs:
   activation:
     needs: pre_activation
     if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      (((github.event_name == 'issue_comment') && ((github.event_name == 'issue_comment') && ((contains(github.event.comment.body, '/unbloat')) &&
-      (github.event.issue.pull_request != null)))) || (!(github.event_name == 'issue_comment')))
+      (needs.pre_activation.outputs.activated == 'true') && (((github.event_name == 'issue_comment') && ((github.event_name == 'issue_comment') &&
+      ((contains(github.event.comment.body, '/unbloat')) && (github.event.issue.pull_request != null)))) ||
+      (!(github.event_name == 'issue_comment')))
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/workflow-generator.lock.yml b/.github/workflows/workflow-generator.lock.yml
index ce8319d273c..8653aa17084 100644
--- a/.github/workflows/workflow-generator.lock.yml
+++ b/.github/workflows/workflow-generator.lock.yml
@@ -40,9 +40,7 @@ run-name: "Workflow Generator"
 jobs:
   activation:
     needs: pre_activation
-    if: >
-      ((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) &&
-      (startsWith(github.event.issue.title, '[Workflow]'))
+    if: (needs.pre_activation.outputs.activated == 'true') && (startsWith(github.event.issue.title, '[Workflow]'))
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/workflow-health-manager.lock.yml b/.github/workflows/workflow-health-manager.lock.yml
index df62db8f88c..57ddf579263 100644
--- a/.github/workflows/workflow-health-manager.lock.yml
+++ b/.github/workflows/workflow-health-manager.lock.yml
@@ -44,7 +44,7 @@ run-name: "Workflow Health Manager - Meta-Orchestrator"
 jobs:
   activation:
     needs: pre_activation
-    if: (needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')
+    if: needs.pre_activation.outputs.activated == 'true'
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/pkg/workflow/action_pins_integration_test.go b/pkg/workflow/action_pins_integration_test.go
index 9f2357a181d..338ae9a4ab1 100644
--- a/pkg/workflow/action_pins_integration_test.go
+++ b/pkg/workflow/action_pins_integration_test.go
@@ -3,9 +3,60 @@
 package workflow
 
 import (
+	"os/exec"
 	"strings"
+	"testing"
 )
 
+// TestActionPinSHAsMatchVersionTags verifies that the SHAs in actionPins actually correspond to their version tags
+// by querying the GitHub repositories using git ls-remote
+func TestActionPinSHAsMatchVersionTags(t *testing.T) {
+	actionPins := getActionPins()
+	// Test all action pins in parallel for faster execution
+	for _, pin := range actionPins {
+		pin := pin // Capture for parallel execution
+		t.Run(pin.Repo, func(t *testing.T) {
+			t.Parallel() // Run subtests in parallel
+
+			// Extract the repository URL from the repo field
+			// For actions like "actions/checkout", the URL is https://github.com/actions/checkout.git
+			// For actions like "github/codeql-action/upload-sarif", we need the base repo
+			repoURL := getGitHubRepoURLIntegration(pin.Repo)
+
+			// Use git ls-remote to get the SHA for the version tag
+			cmd := exec.Command("git", "ls-remote", repoURL, "refs/tags/"+pin.Version)
+			output, err := cmd.Output()
+			if err != nil {
+				t.Logf("Warning: Could not verify %s@%s - git ls-remote failed: %v", pin.Repo, pin.Version, err)
+				t.Logf("This may be expected for actions that don't follow standard tagging or private repos")
+				return // Skip verification but don't fail the test
+			}
+
+			outputStr := strings.TrimSpace(string(output))
+			if outputStr == "" {
+				t.Logf("Warning: No tag found for %s@%s", pin.Repo, pin.Version)
+				return // Skip verification but don't fail the test
+			}
+
+			// Extract SHA from git ls-remote output (format: "SHA\trefs/tags/version")
+			parts := strings.Fields(outputStr)
+			if len(parts) < 1 {
+				t.Errorf("Unexpected git ls-remote output format for %s@%s: %s", pin.Repo, pin.Version, outputStr)
+				return
+			}
+
+			actualSHA := parts[0]
+
+			// Verify the SHA matches
+			if actualSHA != pin.SHA {
+				t.Errorf("SHA mismatch for %s@%s:\n  Expected: %s\n  Got:      %s",
+					pin.Repo, pin.Version, pin.SHA, actualSHA)
+				t.Logf("To fix, update the SHA in action_pins.go to: %s", actualSHA)
+			}
+		})
+	}
+}
+
 // getGitHubRepoURLIntegration converts a repo path to a GitHub URL
 // For "actions/checkout" -> "https://github.com/actions/checkout.git"
 // For "github/codeql-action/upload-sarif" -> "https://github.com/github/codeql-action.git"
diff --git a/pkg/workflow/command_precision_test.go b/pkg/workflow/command_precision_test.go
index e2e83c3e06b..4b697d890e3 100644
--- a/pkg/workflow/command_precision_test.go
+++ b/pkg/workflow/command_precision_test.go
@@ -202,23 +202,18 @@ This test validates that command conditions check the correct body field for eac
 				t.Fatalf("Failed to read lock file: %v", err)
 			}
 
-			// Normalize whitespace for pattern matching - YAML formatting can split
-			// expressions across multiple lines, so we collapse all whitespace
-			// (including newlines) into single spaces for reliable matching
-			normalizedContent := strings.Join(strings.Fields(string(lockContent)), " ")
+			lockContentStr := string(lockContent)
 
 			// Check for expected patterns in the entire workflow
 			for _, expectedPattern := range tt.shouldContain {
-				normalizedPattern := strings.Join(strings.Fields(expectedPattern), " ")
-				if !strings.Contains(normalizedContent, normalizedPattern) {
+				if !strings.Contains(lockContentStr, expectedPattern) {
 					t.Errorf("Expected to find pattern '%s' in generated workflow", expectedPattern)
 				}
 			}
 
 			// Check for unexpected patterns
 			for _, unexpectedPattern := range tt.shouldNotContain {
-				normalizedUnexpected := strings.Join(strings.Fields(unexpectedPattern), " ")
-				if strings.Contains(normalizedContent, normalizedUnexpected) {
+				if strings.Contains(lockContentStr, unexpectedPattern) {
 					t.Errorf("Did not expect to find pattern '%s' in generated workflow", unexpectedPattern)
 				}
 			}
diff --git a/pkg/workflow/compiler_activation_jobs.go b/pkg/workflow/compiler_activation_jobs.go
index 15ab28b95cf..028422fe25b 100644
--- a/pkg/workflow/compiler_activation_jobs.go
+++ b/pkg/workflow/compiler_activation_jobs.go
@@ -12,16 +12,6 @@ import (
 
 var compilerActivationJobsLog = logger.New("workflow:compiler_activation_jobs")
 
-// containsRole checks if a role is present in the roles list (case-insensitive)
-func containsRole(roles []string, role string) bool {
-	for _, r := range roles {
-		if strings.EqualFold(r, role) {
-			return true
-		}
-	}
-	return false
-}
-
 // buildPreActivationJob creates a unified pre-activation job that combines membership checks and stop-time validation.
 // This job exposes a single "activated" output that indicates whether the workflow should proceed.
 func (c *Compiler) buildPreActivationJob(data *WorkflowData, needsPermissionCheck bool) (*Job, error) {
@@ -271,44 +261,6 @@ func (c *Compiler) buildPreActivationJob(data *WorkflowData, needsPermissionChec
 		jobIfCondition = data.If
 	}
 
-	// OPTIMIZATION: Skip pre_activation job entirely for safe events
-	// BUT only if there are no checks that MUST run regardless of event type:
-	// - stop-time: deadline enforcement applies to all events
-	// - skip-if-match: query-based skip applies to all events
-	// - skip-if-no-match: query-based skip applies to all events
-	// - custom steps: user-defined steps may have important logic
-	//
-	// Safe events that can skip pre_activation:
-	// - schedule: Triggered by cron, runs as the repository, not user-initiated
-	// - merge_group: Triggered by GitHub's merge queue system, requires branch protection
-	// - workflow_dispatch: Can skip IF roles include "write" (which the default roles do)
-	//   because check_membership.cjs already short-circuits for workflow_dispatch when write is allowed
-	//
-	// When pre_activation is skipped, downstream jobs check for needs.pre_activation.result == 'skipped'
-	canSkipForSafeEvents := c.skipPreActivationWithIfOptimization &&
-		data.StopTime == "" &&
-		data.SkipIfMatch == nil &&
-		data.SkipIfNoMatch == nil &&
-		len(customSteps) == 0
-
-	if canSkipForSafeEvents {
-		// Check if workflow_dispatch can also be skipped (when roles include "write")
-		rolesIncludeWrite := containsRole(data.Roles, "write") || containsRole(data.Roles, "all")
-		skipCondition := BuildPreActivationSkipCondition(rolesIncludeWrite)
-		safeEventSkipCondition := skipCondition.Render()
-
-		if jobIfCondition != "" {
-			// Combine existing condition with safe event check
-			jobIfCondition = fmt.Sprintf("(%s) && (%s)", safeEventSkipCondition, jobIfCondition)
-		} else {
-			jobIfCondition = safeEventSkipCondition
-		}
-		compilerActivationJobsLog.Printf("Pre-activation job can be skipped for safe events (rolesIncludeWrite=%v)", rolesIncludeWrite)
-	} else {
-		compilerActivationJobsLog.Printf("Pre-activation job cannot be skipped for safe events: hasStopTime=%v, hasSkipIfMatch=%v, hasSkipIfNoMatch=%v, hasCustomSteps=%v",
-			data.StopTime != "", data.SkipIfMatch != nil, data.SkipIfNoMatch != nil, len(customSteps) > 0)
-	}
-
 	job := &Job{
 		Name:        string(constants.PreActivationJobName),
 		If:          jobIfCondition,
@@ -565,19 +517,10 @@ func (c *Compiler) buildActivationJob(data *WorkflowData, preActivationJobCreate
 		// Also depend on custom jobs that run after pre_activation but before activation
 		activationNeeds = append(activationNeeds, customJobsBeforeActivation...)
 
-		// Build activation condition:
-		// - If pre_activation was skipped (safe event like schedule/merge_group), proceed
-		// - Otherwise, check that pre_activation.outputs.activated == 'true'
-		preActivationSkipped := BuildEquals(
-			BuildPropertyAccess(fmt.Sprintf("needs.%s.result", string(constants.PreActivationJobName))),
-			BuildStringLiteral("skipped"),
-		)
-		preActivationActivated := BuildEquals(
+		activatedExpr := BuildEquals(
 			BuildPropertyAccess(fmt.Sprintf("needs.%s.outputs.%s", string(constants.PreActivationJobName), constants.ActivatedOutput)),
 			BuildStringLiteral("true"),
 		)
-		// (pre_activation was skipped) OR (pre_activation.outputs.activated == 'true')
-		activatedExpr := BuildOr(preActivationSkipped, preActivationActivated)
 
 		// If there are custom jobs before activation and the if condition references them,
 		// include that condition in the activation job's if clause
diff --git a/pkg/workflow/compiler_types.go b/pkg/workflow/compiler_types.go
index 9e06c706074..755c30bddbc 100644
--- a/pkg/workflow/compiler_types.go
+++ b/pkg/workflow/compiler_types.go
@@ -72,13 +72,6 @@ func WithRepositorySlug(slug string) CompilerOption {
 	return func(c *Compiler) { c.repositorySlug = slug }
 }
 
-// WithSkipPreActivationWithIfOptimization enables the optimization that adds
-// an "if" condition to the pre_activation job to skip it for safe events (schedule, merge_group, etc.)
-// This is disabled by default. Enable it only when specifically testing this optimization.
-func WithSkipPreActivationWithIfOptimization(enable bool) CompilerOption {
-	return func(c *Compiler) { c.skipPreActivationWithIfOptimization = enable }
-}
-
 // FileTracker interface for tracking files created during compilation
 type FileTracker interface {
 	TrackCreated(filePath string)
@@ -101,38 +94,37 @@ func GetDefaultVersion() string {
 
 // Compiler handles converting markdown workflows to GitHub Actions YAML
 type Compiler struct {
-	verbose                             bool
-	quiet                               bool // If true, suppress success messages (for interactive mode)
-	engineOverride                      string
-	customOutput                        string              // If set, output will be written to this path instead of default location
-	version                             string              // Version of the extension
-	skipValidation                      bool                // If true, skip schema validation
-	noEmit                              bool                // If true, validate without generating lock files
-	strictMode                          bool                // If true, enforce strict validation requirements
-	trialMode                           bool                // If true, suppress safe outputs for trial mode execution
-	trialLogicalRepoSlug                string              // If set in trial mode, the logical repository to checkout
-	refreshStopTime                     bool                // If true, regenerate stop-after times instead of preserving existing ones
-	forceRefreshActionPins              bool                // If true, clear action cache and resolve all actions from GitHub API
-	failFast                            bool                // If true, stop at first validation error instead of collecting all errors
-	actionCacheCleared                  bool                // Tracks if action cache has already been cleared (for forceRefreshActionPins)
-	markdownPath                        string              // Path to the markdown file being compiled (for context in dynamic tool generation)
-	actionMode                          ActionMode          // Mode for generating JavaScript steps (inline vs custom actions)
-	actionTag                           string              // Override action SHA or tag for actions/setup (when set, overrides actionMode to release)
-	jobManager                          *JobManager         // Manages jobs and dependencies
-	engineRegistry                      *EngineRegistry     // Registry of available agentic engines
-	fileTracker                         FileTracker         // Optional file tracker for tracking created files
-	warningCount                        int                 // Number of warnings encountered during compilation
-	stepOrderTracker                    *StepOrderTracker   // Tracks step ordering for validation
-	actionCache                         *ActionCache        // Shared cache for action pin resolutions across all workflows
-	actionResolver                      *ActionResolver     // Shared resolver for action pins across all workflows
-	actionPinWarnings                   map[string]bool     // Shared cache of already-warned action pin failures (key: "repo@version")
-	importCache                         *parser.ImportCache // Shared cache for imported workflow files
-	workflowIdentifier                  string              // Identifier for the current workflow being compiled (for schedule scattering)
-	scheduleWarnings                    []string            // Accumulated schedule warnings for this compiler instance
-	repositorySlug                      string              // Repository slug (owner/repo) used as seed for scattering
-	artifactManager                     *ArtifactManager    // Tracks artifact uploads/downloads for validation
-	scheduleFriendlyFormats             map[int]string      // Maps schedule item index to friendly format string for current workflow
-	skipPreActivationWithIfOptimization bool                // If true, add if condition to pre_activation job to skip for safe events
+	verbose                 bool
+	quiet                   bool // If true, suppress success messages (for interactive mode)
+	engineOverride          string
+	customOutput            string              // If set, output will be written to this path instead of default location
+	version                 string              // Version of the extension
+	skipValidation          bool                // If true, skip schema validation
+	noEmit                  bool                // If true, validate without generating lock files
+	strictMode              bool                // If true, enforce strict validation requirements
+	trialMode               bool                // If true, suppress safe outputs for trial mode execution
+	trialLogicalRepoSlug    string              // If set in trial mode, the logical repository to checkout
+	refreshStopTime         bool                // If true, regenerate stop-after times instead of preserving existing ones
+	forceRefreshActionPins  bool                // If true, clear action cache and resolve all actions from GitHub API
+	failFast                bool                // If true, stop at first validation error instead of collecting all errors
+	actionCacheCleared      bool                // Tracks if action cache has already been cleared (for forceRefreshActionPins)
+	markdownPath            string              // Path to the markdown file being compiled (for context in dynamic tool generation)
+	actionMode              ActionMode          // Mode for generating JavaScript steps (inline vs custom actions)
+	actionTag               string              // Override action SHA or tag for actions/setup (when set, overrides actionMode to release)
+	jobManager              *JobManager         // Manages jobs and dependencies
+	engineRegistry          *EngineRegistry     // Registry of available agentic engines
+	fileTracker             FileTracker         // Optional file tracker for tracking created files
+	warningCount            int                 // Number of warnings encountered during compilation
+	stepOrderTracker        *StepOrderTracker   // Tracks step ordering for validation
+	actionCache             *ActionCache        // Shared cache for action pin resolutions across all workflows
+	actionResolver          *ActionResolver     // Shared resolver for action pins across all workflows
+	actionPinWarnings       map[string]bool     // Shared cache of already-warned action pin failures (key: "repo@version")
+	importCache             *parser.ImportCache // Shared cache for imported workflow files
+	workflowIdentifier      string              // Identifier for the current workflow being compiled (for schedule scattering)
+	scheduleWarnings        []string            // Accumulated schedule warnings for this compiler instance
+	repositorySlug          string              // Repository slug (owner/repo) used as seed for scattering
+	artifactManager         *ArtifactManager    // Tracks artifact uploads/downloads for validation
+	scheduleFriendlyFormats map[int]string      // Maps schedule item index to friendly format string for current workflow
 }
 
 // NewCompiler creates a new workflow compiler with functional options.
diff --git a/pkg/workflow/custom_job_condition_test.go b/pkg/workflow/custom_job_condition_test.go
index d668620661a..c0ef60051e0 100644
--- a/pkg/workflow/custom_job_condition_test.go
+++ b/pkg/workflow/custom_job_condition_test.go
@@ -51,7 +51,7 @@ func TestReferencesCustomJobOutputs(t *testing.T) {
 		},
 		{
 			name:       "complex condition with custom job",
-			condition:  "((needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')) && (needs.ast_grep.outputs.found_patterns == 'true')",
+			condition:  "(needs.pre_activation.outputs.activated == 'true') && (needs.ast_grep.outputs.found_patterns == 'true')",
 			customJobs: map[string]any{"ast_grep": nil},
 			expected:   true,
 		},
diff --git a/pkg/workflow/data/action_pins.json b/pkg/workflow/data/action_pins.json
index edbd2e8785b..e67dd0387d1 100644
--- a/pkg/workflow/data/action_pins.json
+++ b/pkg/workflow/data/action_pins.json
@@ -123,7 +123,7 @@
     "anchore/sbom-action@v0": {
       "repo": "anchore/sbom-action",
       "version": "v0",
-      "sha": "62ad5284b8ced813296287a0b63906cb364b73ee"
+      "sha": "deef08a0db64bfad603422135db61477b16cef56"
     },
     "anchore/sbom-action@v0.20.10": {
       "repo": "anchore/sbom-action",
@@ -158,7 +158,7 @@
     "docker/login-action@v3": {
       "repo": "docker/login-action",
       "version": "v3",
-      "sha": "5e57cd118135c172c3672efd75eb46360885c0ef"
+      "sha": "c94ce9fb468520275223c153574b00df6fe4bcc9"
     },
     "docker/metadata-action@v5": {
       "repo": "docker/metadata-action",
diff --git a/pkg/workflow/expression_builder.go b/pkg/workflow/expression_builder.go
index 74dfa497e36..845a3d45f2b 100644
--- a/pkg/workflow/expression_builder.go
+++ b/pkg/workflow/expression_builder.go
@@ -253,100 +253,6 @@ func BuildEventTypeEquals(eventType string) *ComparisonNode {
 	)
 }
 
-// SafePreActivationEvents lists events that don't require pre-activation checks
-// These events are trusted and don't need permission validation:
-// - schedule: Triggered by cron, runs as the repository, not user-initiated
-// - merge_group: Triggered by GitHub's merge queue system, requires branch protection
-var SafePreActivationEvents = []string{"schedule", "merge_group"}
-
-// BuildIsSafePreActivationEvent creates a condition that returns true for events
-// that don't require pre-activation checks (schedule, merge_group).
-// These events are safe because they are not user-initiated and run with repo context.
-func BuildIsSafePreActivationEvent() ConditionNode {
-	expressionBuilderLog.Print("Building safe pre-activation event condition")
-	var terms []ConditionNode
-	for _, event := range SafePreActivationEvents {
-		terms = append(terms, BuildEventTypeEquals(event))
-	}
-	return &DisjunctionNode{Terms: terms}
-}
-
-// BuildIsNotSafePreActivationEvent creates a condition that returns true for events
-// that DO require pre-activation checks (i.e., NOT schedule, NOT merge_group).
-// This is used to skip pre-activation steps for safe events.
-func BuildIsNotSafePreActivationEvent() ConditionNode {
-	expressionBuilderLog.Print("Building NOT safe pre-activation event condition")
-	// Build: github.event_name != 'schedule' && github.event_name != 'merge_group'
-	var terms []ConditionNode
-	for _, event := range SafePreActivationEvents {
-		terms = append(terms, BuildComparison(
-			BuildPropertyAccess("github.event_name"),
-			"!=",
-			BuildStringLiteral(event),
-		))
-	}
-
-	// Combine with AND - all conditions must be true (event is not any of the safe events)
-	if len(terms) == 0 {
-		// No safe events defined, always return true
-		return BuildBooleanLiteral(true)
-	}
-	if len(terms) == 1 {
-		return terms[0]
-	}
-	result := terms[0]
-	for i := 1; i < len(terms); i++ {
-		result = BuildAnd(result, terms[i])
-	}
-	return result
-}
-
-// BuildPreActivationSkipCondition creates a condition for when to skip the pre_activation job.
-// This returns a condition that is TRUE when pre_activation should NOT run (i.e., safe to skip).
-//
-// The condition varies based on whether roles include "write":
-//   - If roles include "write": skip for schedule, merge_group, AND workflow_dispatch
-//     (because check_membership.cjs short-circuits for workflow_dispatch when write is allowed)
-//   - If roles don't include "write": skip only for schedule and merge_group
-//     (workflow_dispatch still needs permission check)
-//
-// Returns a condition that evaluates to FALSE for events that should skip pre_activation.
-func BuildPreActivationSkipCondition(rolesIncludeWrite bool) ConditionNode {
-	expressionBuilderLog.Printf("Building pre-activation skip condition (rolesIncludeWrite=%v)", rolesIncludeWrite)
-
-	// Events that always skip: schedule, merge_group
-	safeEvents := []string{"schedule", "merge_group"}
-
-	// If roles include "write", workflow_dispatch can also skip
-	if rolesIncludeWrite {
-		safeEvents = append(safeEvents, "workflow_dispatch")
-	}
-
-	// Build: github.event_name != 'event1' && github.event_name != 'event2' && ...
-	// This returns TRUE when the event is NOT safe (i.e., pre_activation should run)
-	var terms []ConditionNode
-	for _, event := range safeEvents {
-		terms = append(terms, BuildComparison(
-			BuildPropertyAccess("github.event_name"),
-			"!=",
-			BuildStringLiteral(event),
-		))
-	}
-
-	// Combine with AND - all conditions must be true (event is not any of the safe events)
-	if len(terms) == 0 {
-		return BuildBooleanLiteral(true)
-	}
-	if len(terms) == 1 {
-		return terms[0]
-	}
-	result := terms[0]
-	for i := 1; i < len(terms); i++ {
-		result = BuildAnd(result, terms[i])
-	}
-	return result
-}
-
 // BuildRefStartsWith creates a condition to check if github.ref starts with a prefix
 func BuildRefStartsWith(prefix string) *FunctionCallNode {
 	return BuildFunctionCall("startsWith",
diff --git a/pkg/workflow/expressions_test.go b/pkg/workflow/expressions_test.go
index 5b368c09c95..55758a32040 100644
--- a/pkg/workflow/expressions_test.go
+++ b/pkg/workflow/expressions_test.go
@@ -173,42 +173,6 @@ func TestBuildReactionCondition(t *testing.T) {
 	}
 }
 
-func TestBuildIsSafePreActivationEvent(t *testing.T) {
-	result := BuildIsSafePreActivationEvent()
-	rendered := result.Render()
-
-	// Should be a disjunction of schedule and merge_group event checks
-	expectedSubstrings := []string{
-		"github.event_name == 'schedule'",
-		"github.event_name == 'merge_group'",
-		"||",
-	}
-
-	for _, substr := range expectedSubstrings {
-		if !strings.Contains(rendered, substr) {
-			t.Errorf("Expected rendered condition to contain '%s', but got: %s", substr, rendered)
-		}
-	}
-}
-
-func TestBuildIsNotSafePreActivationEvent(t *testing.T) {
-	result := BuildIsNotSafePreActivationEvent()
-	rendered := result.Render()
-
-	// Should be a conjunction of NOT schedule AND NOT merge_group
-	expectedSubstrings := []string{
-		"github.event_name != 'schedule'",
-		"github.event_name != 'merge_group'",
-		"&&",
-	}
-
-	for _, substr := range expectedSubstrings {
-		if !strings.Contains(rendered, substr) {
-			t.Errorf("Expected rendered condition to contain '%s', but got: %s", substr, rendered)
-		}
-	}
-}
-
 func TestFunctionCallNode_Render(t *testing.T) {
 	tests := []struct {
 		name     string
diff --git a/pkg/workflow/pre_activation_skip_test.go b/pkg/workflow/pre_activation_skip_test.go
deleted file mode 100644
index a0640efea9a..00000000000
--- a/pkg/workflow/pre_activation_skip_test.go
+++ /dev/null
@@ -1,452 +0,0 @@
-//go:build !integration
-
-package workflow
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/githubnext/gh-aw/pkg/constants"
-	"github.com/githubnext/gh-aw/pkg/stringutil"
-	"github.com/githubnext/gh-aw/pkg/testutil"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestPreActivationSkipForScheduleEvents verifies that the pre_activation job is skipped
-// for safe events (schedule, merge_group) and that downstream jobs handle this correctly.
-// NOTE: This test enables the pre_activation skip optimization which is disabled by default.
-func TestPreActivationSkipForScheduleEvents(t *testing.T) {
-	tmpDir := testutil.TempDir(t, "pre-activation-skip-test")
-	// Enable the pre_activation skip optimization for this test since we're specifically testing this behavior
-	compiler := NewCompiler(WithSkipPreActivationWithIfOptimization(true))
-
-	t.Run("schedule_only_workflow_has_no_pre_activation", func(t *testing.T) {
-		// Schedule-only workflows don't need a pre_activation job at all
-		// because schedule is in SafeWorkflowEvents - no permission check needed
-		workflowContent := `---
-on:
-  schedule:
-    - cron: "0 8 * * *"
-engine: codex
----
-
-# Daily Schedule Workflow
-
-This workflow runs on a daily schedule.
-`
-		workflowFile := filepath.Join(tmpDir, "schedule-only-workflow.md")
-		require.NoError(t, os.WriteFile(workflowFile, []byte(workflowContent), 0644))
-
-		err := compiler.CompileWorkflow(workflowFile)
-		require.NoError(t, err, "Should compile workflow")
-
-		lockFile := stringutil.MarkdownToLockFile(workflowFile)
-		lockContent, err := os.ReadFile(lockFile)
-		require.NoError(t, err, "Should read lock file")
-		lockContentStr := string(lockContent)
-
-		// Schedule-only workflows should NOT have a pre_activation job
-		// because schedule is already considered a safe event
-		preActivationSection := extractJobSectionForSkipTest(lockContentStr, string(constants.PreActivationJobName))
-		assert.Empty(t, preActivationSection, "Schedule-only workflow should NOT have pre_activation job")
-	})
-
-	t.Run("schedule_and_issue_workflow_has_pre_activation_with_skip_condition", func(t *testing.T) {
-		// Workflows with both schedule and issue triggers need pre_activation
-		// but should skip it for schedule events
-		workflowContent := `---
-on:
-  schedule:
-    - cron: "0 8 * * *"
-  issues:
-    types: [opened]
-engine: codex
----
-
-# Mixed trigger workflow
-
-This workflow runs on schedule and when issues are opened.
-`
-		workflowFile := filepath.Join(tmpDir, "schedule-and-issue-workflow.md")
-		require.NoError(t, os.WriteFile(workflowFile, []byte(workflowContent), 0644))
-
-		err := compiler.CompileWorkflow(workflowFile)
-		require.NoError(t, err, "Should compile workflow")
-
-		lockFile := stringutil.MarkdownToLockFile(workflowFile)
-		lockContent, err := os.ReadFile(lockFile)
-		require.NoError(t, err, "Should read lock file")
-		lockContentStr := string(lockContent)
-
-		// This workflow should have pre_activation because of the issues trigger
-		preActivationSection := extractJobSectionForSkipTest(lockContentStr, string(constants.PreActivationJobName))
-		require.NotEmpty(t, preActivationSection, "Should have pre_activation job")
-
-		// The pre_activation job should have an if condition that skips for schedule
-		assert.Contains(t, preActivationSection, "github.event_name != 'schedule'",
-			"pre_activation should have condition to skip for schedule events")
-		assert.Contains(t, preActivationSection, "github.event_name != 'merge_group'",
-			"pre_activation should have condition to skip for merge_group events")
-
-		// Verify activation job handles skipped pre_activation
-		activationSection := extractJobSectionForSkipTest(lockContentStr, string(constants.ActivationJobName))
-		require.NotEmpty(t, activationSection, "Should have activation job")
-		assert.Contains(t, activationSection, "needs.pre_activation.result == 'skipped'",
-			"activation should check if pre_activation was skipped")
-		assert.Contains(t, activationSection, "needs.pre_activation.outputs.activated == 'true'",
-			"activation should also check activated output for non-safe events")
-	})
-
-	t.Run("issue_workflow_does_not_skip_pre_activation", func(t *testing.T) {
-		// Issue-triggered workflows should NOT skip pre_activation since
-		// they require permission checks
-		workflowContent := `---
-on:
-  issues:
-    types: [opened]
-engine: codex
----
-
-# Issue Workflow
-
-This workflow runs when issues are opened.
-`
-		workflowFile := filepath.Join(tmpDir, "issue-workflow.md")
-		require.NoError(t, os.WriteFile(workflowFile, []byte(workflowContent), 0644))
-
-		err := compiler.CompileWorkflow(workflowFile)
-		require.NoError(t, err, "Should compile workflow")
-
-		lockFile := stringutil.MarkdownToLockFile(workflowFile)
-		lockContent, err := os.ReadFile(lockFile)
-		require.NoError(t, err, "Should read lock file")
-		lockContentStr := string(lockContent)
-
-		// Verify pre_activation exists and has skip condition
-		// (the skip condition is always present, but for issues it won't trigger)
-		preActivationSection := extractJobSectionForSkipTest(lockContentStr, string(constants.PreActivationJobName))
-		require.NotEmpty(t, preActivationSection, "Should have pre_activation job")
-
-		// For issue-only workflows, the skip condition still exists but won't match
-		// because github.event_name will be 'issues', not 'schedule' or 'merge_group'
-		assert.Contains(t, preActivationSection, "github.event_name != 'schedule'",
-			"pre_activation should have schedule skip condition")
-	})
-
-	t.Run("merge_group_workflow_skips_pre_activation", func(t *testing.T) {
-		workflowContent := `---
-on:
-  merge_group:
-    types: [checks_requested]
-engine: codex
----
-
-# Merge Queue Workflow
-
-This workflow runs in the merge queue.
-`
-		workflowFile := filepath.Join(tmpDir, "merge-group-workflow.md")
-		require.NoError(t, os.WriteFile(workflowFile, []byte(workflowContent), 0644))
-
-		err := compiler.CompileWorkflow(workflowFile)
-		require.NoError(t, err, "Should compile workflow")
-
-		lockFile := stringutil.MarkdownToLockFile(workflowFile)
-		lockContent, err := os.ReadFile(lockFile)
-		require.NoError(t, err, "Should read lock file")
-		lockContentStr := string(lockContent)
-
-		// Verify pre_activation has skip condition for merge_group
-		preActivationSection := extractJobSectionForSkipTest(lockContentStr, string(constants.PreActivationJobName))
-		require.NotEmpty(t, preActivationSection, "Should have pre_activation job")
-		assert.Contains(t, preActivationSection, "github.event_name != 'merge_group'",
-			"pre_activation should skip for merge_group events")
-	})
-
-	t.Run("workflow_dispatch_with_default_roles_skips_pre_activation", func(t *testing.T) {
-		// Workflows with workflow_dispatch and default roles (which include "write")
-		// should skip pre_activation because check_membership.cjs short-circuits
-		// for workflow_dispatch when write is in the allowed roles
-		workflowContent := `---
-on:
-  workflow_dispatch:
-  issues:
-    types: [opened]
-engine: codex
----
-
-# Workflow Dispatch with Default Roles
-
-This workflow uses default roles which include "write".
-`
-		workflowFile := filepath.Join(tmpDir, "workflow-dispatch-default-roles.md")
-		require.NoError(t, os.WriteFile(workflowFile, []byte(workflowContent), 0644))
-
-		err := compiler.CompileWorkflow(workflowFile)
-		require.NoError(t, err, "Should compile workflow")
-
-		lockFile := stringutil.MarkdownToLockFile(workflowFile)
-		lockContent, err := os.ReadFile(lockFile)
-		require.NoError(t, err, "Should read lock file")
-		lockContentStr := string(lockContent)
-
-		// Verify pre_activation has skip condition for workflow_dispatch
-		preActivationSection := extractJobSectionForSkipTest(lockContentStr, string(constants.PreActivationJobName))
-		require.NotEmpty(t, preActivationSection, "Should have pre_activation job")
-		assert.Contains(t, preActivationSection, "github.event_name != 'workflow_dispatch'",
-			"pre_activation should skip for workflow_dispatch when roles include write")
-		assert.Contains(t, preActivationSection, "github.event_name != 'schedule'",
-			"pre_activation should also skip for schedule events")
-	})
-
-	t.Run("workflow_dispatch_with_custom_roles_without_write_does_not_skip", func(t *testing.T) {
-		// Workflows with workflow_dispatch and custom roles that DON'T include "write"
-		// should NOT skip pre_activation for workflow_dispatch because permission check is needed
-		workflowContent := `---
-on:
-  workflow_dispatch:
-  issues:
-    types: [opened]
-roles: [admin]
-engine: codex
----
-
-# Workflow Dispatch with Admin-Only Roles
-
-This workflow only allows admins, not write access.
-`
-		workflowFile := filepath.Join(tmpDir, "workflow-dispatch-admin-only.md")
-		require.NoError(t, os.WriteFile(workflowFile, []byte(workflowContent), 0644))
-
-		err := compiler.CompileWorkflow(workflowFile)
-		require.NoError(t, err, "Should compile workflow")
-
-		lockFile := stringutil.MarkdownToLockFile(workflowFile)
-		lockContent, err := os.ReadFile(lockFile)
-		require.NoError(t, err, "Should read lock file")
-		lockContentStr := string(lockContent)
-
-		// Verify pre_activation does NOT have skip condition for workflow_dispatch
-		preActivationSection := extractJobSectionForSkipTest(lockContentStr, string(constants.PreActivationJobName))
-		require.NotEmpty(t, preActivationSection, "Should have pre_activation job")
-		assert.NotContains(t, preActivationSection, "github.event_name != 'workflow_dispatch'",
-			"pre_activation should NOT skip for workflow_dispatch when roles don't include write")
-		// But should still skip for schedule and merge_group
-		assert.Contains(t, preActivationSection, "github.event_name != 'schedule'",
-			"pre_activation should still skip for schedule events")
-		assert.Contains(t, preActivationSection, "github.event_name != 'merge_group'",
-			"pre_activation should still skip for merge_group events")
-	})
-
-	t.Run("workflow_dispatch_with_roles_all_has_no_pre_activation", func(t *testing.T) {
-		// Workflows with roles: all don't need permission checks at all
-		// so they don't get a pre_activation job (when there's no stop-time etc.)
-		workflowContent := `---
-on:
-  workflow_dispatch:
-  issues:
-    types: [opened]
-roles: all
-engine: codex
----
-
-# Workflow Dispatch with Roles All
-
-This workflow allows all users.
-`
-		workflowFile := filepath.Join(tmpDir, "workflow-dispatch-roles-all.md")
-		require.NoError(t, os.WriteFile(workflowFile, []byte(workflowContent), 0644))
-
-		err := compiler.CompileWorkflow(workflowFile)
-		require.NoError(t, err, "Should compile workflow")
-
-		lockFile := stringutil.MarkdownToLockFile(workflowFile)
-		lockContent, err := os.ReadFile(lockFile)
-		require.NoError(t, err, "Should read lock file")
-		lockContentStr := string(lockContent)
-
-		// With roles: all, no permission check is needed at all
-		// So there should be NO pre_activation job
-		preActivationSection := extractJobSectionForSkipTest(lockContentStr, string(constants.PreActivationJobName))
-		assert.Empty(t, preActivationSection,
-			"Workflow with roles: all should NOT have pre_activation job (no permission check needed)")
-	})
-
-	t.Run("workflow_with_stop_time_does_not_skip_pre_activation", func(t *testing.T) {
-		// Workflows with stop-after should ALWAYS run pre_activation
-		// even for schedule events, because the stop-time check must run
-		workflowContent := `---
-on:
-  schedule:
-    - cron: "0 8 * * *"
-  issues:
-    types: [opened]
-  stop-after: "+48h"
-engine: codex
----
-
-# Workflow with Stop Time
-
-This workflow has a deadline and must check stop-time for all events.
-`
-		workflowFile := filepath.Join(tmpDir, "workflow-with-stop-time.md")
-		require.NoError(t, os.WriteFile(workflowFile, []byte(workflowContent), 0644))
-
-		err := compiler.CompileWorkflow(workflowFile)
-		require.NoError(t, err, "Should compile workflow")
-
-		lockFile := stringutil.MarkdownToLockFile(workflowFile)
-		lockContent, err := os.ReadFile(lockFile)
-		require.NoError(t, err, "Should read lock file")
-		lockContentStr := string(lockContent)
-
-		// Verify pre_activation exists
-		preActivationSection := extractJobSectionForSkipTest(lockContentStr, string(constants.PreActivationJobName))
-		require.NotEmpty(t, preActivationSection, "Should have pre_activation job")
-
-		// The pre_activation job should NOT have skip conditions for schedule
-		// because the stop-time check must always run
-		assert.NotContains(t, preActivationSection, "github.event_name != 'schedule'",
-			"pre_activation should NOT skip for schedule when stop-after is configured")
-
-		// Verify that stop-time check step exists
-		assert.Contains(t, preActivationSection, "check_stop_time",
-			"pre_activation should have stop-time check step")
-	})
-
-	t.Run("workflow_with_skip_if_match_does_not_skip_pre_activation", func(t *testing.T) {
-		// Workflows with skip-if-match should ALWAYS run pre_activation
-		// even for schedule events, because the query check must run
-		workflowContent := `---
-on:
-  schedule:
-    - cron: "0 8 * * *"
-  issues:
-    types: [opened]
-  skip-if-match: "is:issue is:open label:skip-automation"
-engine: codex
----
-
-# Workflow with Skip-If-Match
-
-This workflow skips if certain issues exist.
-`
-		workflowFile := filepath.Join(tmpDir, "workflow-with-skip-if-match.md")
-		require.NoError(t, os.WriteFile(workflowFile, []byte(workflowContent), 0644))
-
-		err := compiler.CompileWorkflow(workflowFile)
-		require.NoError(t, err, "Should compile workflow")
-
-		lockFile := stringutil.MarkdownToLockFile(workflowFile)
-		lockContent, err := os.ReadFile(lockFile)
-		require.NoError(t, err, "Should read lock file")
-		lockContentStr := string(lockContent)
-
-		// Verify pre_activation exists
-		preActivationSection := extractJobSectionForSkipTest(lockContentStr, string(constants.PreActivationJobName))
-		require.NotEmpty(t, preActivationSection, "Should have pre_activation job")
-
-		// The pre_activation job should NOT have skip conditions for schedule
-		// because the skip-if-match check must always run
-		assert.NotContains(t, preActivationSection, "github.event_name != 'schedule'",
-			"pre_activation should NOT skip for schedule when skip-if-match is configured")
-
-		// Verify that skip-if-match check step exists
-		assert.Contains(t, preActivationSection, "check_skip_if_match",
-			"pre_activation should have skip-if-match check step")
-	})
-
-	t.Run("workflow_with_skip_if_no_match_does_not_skip_pre_activation", func(t *testing.T) {
-		// Workflows with skip-if-no-match should ALWAYS run pre_activation
-		// even for schedule events, because the query check must run
-		workflowContent := `---
-on:
-  schedule:
-    - cron: "0 8 * * *"
-  issues:
-    types: [opened]
-  skip-if-no-match: "is:issue is:open label:needs-automation"
-engine: codex
----
-
-# Workflow with Skip-If-No-Match
-
-This workflow only runs if certain issues exist.
-`
-		workflowFile := filepath.Join(tmpDir, "workflow-with-skip-if-no-match.md")
-		require.NoError(t, os.WriteFile(workflowFile, []byte(workflowContent), 0644))
-
-		err := compiler.CompileWorkflow(workflowFile)
-		require.NoError(t, err, "Should compile workflow")
-
-		lockFile := stringutil.MarkdownToLockFile(workflowFile)
-		lockContent, err := os.ReadFile(lockFile)
-		require.NoError(t, err, "Should read lock file")
-		lockContentStr := string(lockContent)
-
-		// Verify pre_activation exists
-		preActivationSection := extractJobSectionForSkipTest(lockContentStr, string(constants.PreActivationJobName))
-		require.NotEmpty(t, preActivationSection, "Should have pre_activation job")
-
-		// The pre_activation job should NOT have skip conditions for schedule
-		// because the skip-if-no-match check must always run
-		assert.NotContains(t, preActivationSection, "github.event_name != 'schedule'",
-			"pre_activation should NOT skip for schedule when skip-if-no-match is configured")
-
-		// Verify that skip-if-no-match check step exists
-		assert.Contains(t, preActivationSection, "check_skip_if_no_match",
-			"pre_activation should have skip-if-no-match check step")
-	})
-}
-
-// TestSafePreActivationEventsListConsistency verifies that the safe events list
-// in expression_builder.go matches what check_membership.cjs considers safe.
-func TestSafePreActivationEventsListConsistency(t *testing.T) {
-	// The safe events should match those defined in check_membership.cjs
-	// This test ensures we don't accidentally diverge
-	expectedSafeEvents := []string{"schedule", "merge_group"}
-
-	assert.Equal(t, expectedSafeEvents, SafePreActivationEvents,
-		"SafePreActivationEvents should match the safe events in check_membership.cjs")
-}
-
-// extractJobSectionForSkipTest extracts a job section from YAML content
-// Named differently to avoid conflict with extractJobSection in compiler_test_helpers.go
-func extractJobSectionForSkipTest(content string, jobName string) string {
-	lines := strings.Split(content, "\n")
-	var result strings.Builder
-	inJob := false
-	indent := 0
-
-	for _, line := range lines {
-		trimmed := strings.TrimLeft(line, " ")
-		currentIndent := len(line) - len(trimmed)
-
-		if !inJob {
-			// Look for the job start
-			if strings.HasPrefix(trimmed, jobName+":") {
-				inJob = true
-				indent = currentIndent
-				result.WriteString(line + "\n")
-			}
-		} else {
-			// We're inside the job
-			if trimmed == "" {
-				// Empty line, include it
-				result.WriteString(line + "\n")
-				continue
-			}
-
-			if currentIndent <= indent && !strings.HasPrefix(trimmed, "#") {
-				// We've reached a new job at the same or lower indentation
-				break
-			}
-			result.WriteString(line + "\n")
-		}
-	}
-
-	return result.String()
-}
diff --git a/pkg/workflow/stop_time_check_job_test.go b/pkg/workflow/stop_time_check_job_test.go
index cb463c5e067..9683b749600 100644
--- a/pkg/workflow/stop_time_check_job_test.go
+++ b/pkg/workflow/stop_time_check_job_test.go
@@ -194,11 +194,7 @@ This workflow requires membership checks.
 			t.Error("Expected activation job to depend on pre_activation job")
 		}
 
-		// Verify activation job checks activated output (with skipped fallback for safe events)
-		// New format: (needs.pre_activation.result == 'skipped') || (needs.pre_activation.outputs.activated == 'true')
-		if !strings.Contains(activationSection, "needs.pre_activation.result == 'skipped'") {
-			t.Error("Expected activation job to check if pre_activation was skipped (for safe events)")
-		}
+		// Verify activation job checks activated output
 		if !strings.Contains(activationSection, "needs.pre_activation.outputs.activated == 'true'") {
 			t.Error("Expected activation job to check pre_activation.outputs.activated")
 		}

From 03eed579426ae6decc127934abe9ac340813d5a6 Mon Sep 17 00:00:00 2001
From: Don Syme <dsyme@github.com>
Date: Sat, 31 Jan 2026 01:25:09 +0000
Subject: [PATCH 2/3] keep removal of test

---
 .github/workflows/ci.yml                     |  5 +-
 pkg/workflow/action_pins_integration_test.go | 51 --------------------
 2 files changed, 1 insertion(+), 55 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3cc414a3cc5..21e9f7ff8a7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -134,9 +134,6 @@ jobs:
           - name: "Workflow Cache"
             packages: "./pkg/workflow"
             pattern: "^TestCache|TestCacheDependencies|TestCacheKey|TestValidateCache"
-          - name: "Workflow Actions Pin Validation"
-            packages: "./pkg/workflow"
-            pattern: "^TestActionPinSHAsMatchVersionTags"
           - name: "Workflow Actions & Containers"
             packages: "./pkg/workflow"
             pattern: "^TestAction[^P]|Container"
@@ -169,7 +166,7 @@ jobs:
           - name: "Workflow Misc Part 2"  # Remaining workflow tests
             packages: "./pkg/workflow"
             pattern: ""
-            skip_pattern: "TestCompile|TestWorkflow|TestGenerate|TestParse|TestMCP|TestTool|TestSkill|TestPlaywright|TestFirewall|TestValidat|TestLock|TestError|TestWarning|SafeOutputs|CreatePullRequest|OutputLabel|HasSafeOutputs|GitHub|Git|PushToPullRequest|BuildFromAllowed|Render|Bundle|Script|WritePromptText|^TestCache|TestCacheDependencies|TestCacheKey|TestValidateCache|^TestActionPinSHAsMatchVersionTags|^TestAction[^P]|Container|Dependabot|Security|PII|TestPermissions|TestPackageExtractor|TestCollectPackagesFromWorkflow|TestAgent|TestCopilot|TestCustom|TestEngine|TestModel|TestNetwork|TestOpenAI|TestProvider|String|Sanitize|Normalize|Trim|Clean|Format|Runtime|Setup|Install|Download|Version|Binary"
+            skip_pattern: "TestCompile|TestWorkflow|TestGenerate|TestParse|TestMCP|TestTool|TestSkill|TestPlaywright|TestFirewall|TestValidat|TestLock|TestError|TestWarning|SafeOutputs|CreatePullRequest|OutputLabel|HasSafeOutputs|GitHub|Git|PushToPullRequest|BuildFromAllowed|Render|Bundle|Script|WritePromptText|^TestCache|TestCacheDependencies|TestCacheKey|TestValidateCache|^TestAction[^P]|Container|Dependabot|Security|PII|TestPermissions|TestPackageExtractor|TestCollectPackagesFromWorkflow|TestAgent|TestCopilot|TestCustom|TestEngine|TestModel|TestNetwork|TestOpenAI|TestProvider|String|Sanitize|Normalize|Trim|Clean|Format|Runtime|Setup|Install|Download|Version|Binary"
     concurrency:
       group: ci-${{ github.ref }}-integration-${{ matrix.test-group.name }}
       cancel-in-progress: true
diff --git a/pkg/workflow/action_pins_integration_test.go b/pkg/workflow/action_pins_integration_test.go
index 338ae9a4ab1..9f2357a181d 100644
--- a/pkg/workflow/action_pins_integration_test.go
+++ b/pkg/workflow/action_pins_integration_test.go
@@ -3,60 +3,9 @@
 package workflow
 
 import (
-	"os/exec"
 	"strings"
-	"testing"
 )
 
-// TestActionPinSHAsMatchVersionTags verifies that the SHAs in actionPins actually correspond to their version tags
-// by querying the GitHub repositories using git ls-remote
-func TestActionPinSHAsMatchVersionTags(t *testing.T) {
-	actionPins := getActionPins()
-	// Test all action pins in parallel for faster execution
-	for _, pin := range actionPins {
-		pin := pin // Capture for parallel execution
-		t.Run(pin.Repo, func(t *testing.T) {
-			t.Parallel() // Run subtests in parallel
-
-			// Extract the repository URL from the repo field
-			// For actions like "actions/checkout", the URL is https://github.com/actions/checkout.git
-			// For actions like "github/codeql-action/upload-sarif", we need the base repo
-			repoURL := getGitHubRepoURLIntegration(pin.Repo)
-
-			// Use git ls-remote to get the SHA for the version tag
-			cmd := exec.Command("git", "ls-remote", repoURL, "refs/tags/"+pin.Version)
-			output, err := cmd.Output()
-			if err != nil {
-				t.Logf("Warning: Could not verify %s@%s - git ls-remote failed: %v", pin.Repo, pin.Version, err)
-				t.Logf("This may be expected for actions that don't follow standard tagging or private repos")
-				return // Skip verification but don't fail the test
-			}
-
-			outputStr := strings.TrimSpace(string(output))
-			if outputStr == "" {
-				t.Logf("Warning: No tag found for %s@%s", pin.Repo, pin.Version)
-				return // Skip verification but don't fail the test
-			}
-
-			// Extract SHA from git ls-remote output (format: "SHA\trefs/tags/version")
-			parts := strings.Fields(outputStr)
-			if len(parts) < 1 {
-				t.Errorf("Unexpected git ls-remote output format for %s@%s: %s", pin.Repo, pin.Version, outputStr)
-				return
-			}
-
-			actualSHA := parts[0]
-
-			// Verify the SHA matches
-			if actualSHA != pin.SHA {
-				t.Errorf("SHA mismatch for %s@%s:\n  Expected: %s\n  Got:      %s",
-					pin.Repo, pin.Version, pin.SHA, actualSHA)
-				t.Logf("To fix, update the SHA in action_pins.go to: %s", actualSHA)
-			}
-		})
-	}
-}
-
 // getGitHubRepoURLIntegration converts a repo path to a GitHub URL
 // For "actions/checkout" -> "https://github.com/actions/checkout.git"
 // For "github/codeql-action/upload-sarif" -> "https://github.com/github/codeql-action.git"

From 276669fe0a1e29c988a4e0823da1a76ba8587bd8 Mon Sep 17 00:00:00 2001
From: Don Syme <dsyme@github.com>
Date: Sat, 31 Jan 2026 01:31:36 +0000
Subject: [PATCH 3/3] fix fmt

---
 actions/setup/js/create_pull_request.cjs | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/actions/setup/js/create_pull_request.cjs b/actions/setup/js/create_pull_request.cjs
index ce35dd07a72..8685d7e01b8 100644
--- a/actions/setup/js/create_pull_request.cjs
+++ b/actions/setup/js/create_pull_request.cjs
@@ -82,9 +82,7 @@ async function main(config = {}) {
   }
 
   // Extract triggering issue number from context (for auto-linking PRs to issues)
-  const triggeringIssueNumber = context.payload?.issue?.number && !context.payload?.issue?.pull_request
-    ? context.payload.issue.number
-    : undefined;
+  const triggeringIssueNumber = context.payload?.issue?.number && !context.payload?.issue?.pull_request ? context.payload.issue.number : undefined;
 
   // Check if we're in staged mode
   const isStaged = process.env.GH_AW_SAFE_OUTPUTS_STAGED === "true";
