Fix TestStepOrderingValidation_SecretRedactionBeforeUploads: tighten Upload Safe Outputs assertion

[Copilot]

Summary

The integration test TestStepOrderingValidation_SecretRedactionBeforeUploads was failing because its assertion was too broad.

Root cause

The check:

if strings.Contains(contentStr, "name: Upload Safe Outputs") {

matched the intentional "- name: Upload Safe Outputs Items" step in the safe_outputs job (generated by buildSafeOutputItemsManifestUploadStep), which exists for a valid reason — it uploads the manifest as a separate artifact to avoid 409 conflicts.

Fix

Narrowed the assertion to use the exact old step name (with YAML list prefix and trailing newline), consistent with the identical check in agentic_output_test.go:

if strings.Contains(contentStr, "- name: Upload Safe Outputs\n") {

This only matches a step named exactly "Upload Safe Outputs" and does not match "Upload Safe Outputs Items" or "Upload Safe Outputs Assets".

Reference: https://github.com/github/gh-aw/actions/runs/24207061879/job/70665593242

[Copilot]

Pull request overview

This PR fixes a flaky/broken integration test by tightening a string assertion so it only matches the exact legacy step name "Upload Safe Outputs" (and not similarly-named valid steps like "Upload Safe Outputs Items").

Changes:

• Updated TestStepOrderingValidation_SecretRedactionBeforeUploads to check for the exact YAML step entry "- name: Upload Safe Outputs\n".
• Added explanatory comments documenting why the exact match is required (to avoid matching other valid upload steps).

Show a summary per file

File	Description
pkg/workflow/step_order_validation_integration_test.go	Narrows the “Upload Safe Outputs” absence assertion to an exact step-name match to prevent false positives.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 0