Bug: `workflow_install_note.md` ENOENT in safe_outputs when PR touches workflow files

[corygehr]

Summary

When an agentic workflow emits a create_pull_request safe-output that modifies files under .github/workflows/, the safe_outputs job crashes with:

ENOENT: no such file or directory, open '/home/runner/work/_temp/gh-aw/md/workflow_install_note.md'

The framework attempts to inject an "install note" into the PR body (or a follow-up comment) explaining that the PR contains workflow changes requiring compilation — but the template file is never deployed to the runner's temp directory.

Reproduction

1. Create an agentic workflow that emits a create_pull_request safe-output.
2. Have the agent include file changes under .github/workflows/ in the PR.
3. The safe_outputs job fails at "Process Safe Outputs" with the ENOENT error.

The failure cascades: if a subsequent add_comment safe-output also references the PR, it fails with the same error (the framework prepends a "code push failure note" that re-triggers the missing template read).

Observed behavior

• The agent job completes successfully — all reasoning and tool calls work fine.
• The safe_outputs job fails because the framework can't read the template.
• Both create_pull_request and any downstream add_comment that references the PR fail.
• The conclusion job logs the error under GH_AW_CODE_PUSH_FAILURE_ERRORS.

Expected behavior

The workflow_install_note.md template should be deployed alongside other framework assets during the pre_activation or activation phase — or the framework should gracefully skip the install note if the file is absent.

Environment

• gh-aw version: v0.74.7
• Runner: GitHub-hosted (ubuntu-latest)
• Workflow trigger: workflow_dispatch (slash command via centralized routing)

Workaround

None known. The only mitigation is to avoid having the agent create PRs that touch .github/workflows/ files — which defeats the purpose of workflows like Q&A or prompt-refinement that propose workflow improvements.

Impact

Any workflow that creates PRs containing .github/workflows/ file changes is broken. This affects use cases like:

• AI-assisted workflow optimization (Q&A agents proposing prompt improvements)
• Prompt refinement workflows that update .agent.md or .md workflow files
• Any agent that suggests configuration changes to workflow frontmatter

[yskopets]

🤖 This comment has been generated by Claude Code.

Observing the same failure after upgrading from v0.74.3 to v0.74.8.

Workflow: Plan Command (plan.lock.yml, compiled with gh-aw v0.74.8)
Trigger: discussion_comment event
Failing step: safe_outputs → Process Safe Outputs

All 5 create_issue safe outputs fail with:

ENOENT: no such file or directory, open '/home/runner/work/_temp/gh-aw/md/workflow_install_note.md'

The md/ directory under $RUNNER_TEMP/gh-aw/ is never created — gh-aw-actions/setup@v0.74.8 only populates the actions/ subdirectory. Rolling back to gh-aw-actions/setup@v0.74.3 avoids the failure.

---

Update: after bisecting the gh-aw-actions releases, the regression was introduced in v0.74.5 (not v0.74.8 specifically — it has been broken in every release from v0.74.5 through v0.74.8). v0.74.4 is the most recent clean version.

The culprit is messages_footer.cjs (not safe_output_handler_manager.cjs as I originally guessed). It was unchanged between v0.74.3 and v0.74.4, then changed in v0.74.5 to add:

const defaultInstallTemplatePath = path.join(__dirname, "../md/workflow_install_note.md");

The md/ directory with workflow_install_note.md does exist in the gh-aw-actions repo at setup/md/, but the safe_outputs job deploys only the js/ bundle — not the md/ templates alongside it — so the runtime lookup at $RUNNER_TEMP/gh-aw/md/workflow_install_note.md always fails.