fix: honor default GH host for pin fallback guard

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Author: Copilot

pkg/workflow/compiler_types.go

@@ -644,6 +644,11 @@ func (d *WorkflowData) PinContext() *actionpins.PinContext {
 	if ghHost := os.Getenv("GH_HOST"); ghHost != "" && ghHost != "github.com" {
 		pinCtx.SkipHardcodedFallback = true
 	}
+	// Also disable fallback when a non-github.qkg1.top default host has been set
+	// programmatically (for example from auto-detected git remotes).
+	if defaultHost := getDefaultGHHost(); defaultHost != "" && defaultHost != "github.com" {
+		pinCtx.SkipHardcodedFallback = true
+	}
 	return pinCtx
 }
 

pkg/workflow/compiler_types_test.go

@@ -11,6 +11,11 @@ import (
 )
 
 func TestWorkflowData_PinContext_SkipHardcodedFallback(t *testing.T) {
+	originalDefaultHost := getDefaultGHHost()
+	t.Cleanup(func() {
+		SetDefaultGHHost(originalDefaultHost)
+	})
+
 	t.Run("sets SkipHardcodedFallback when GH_HOST is a non-github.qkg1.top host", func(t *testing.T) {
 		t.Setenv("GH_HOST", "myorg.ghe.com")
 
@@ -33,6 +38,7 @@ func TestWorkflowData_PinContext_SkipHardcodedFallback(t *testing.T) {
 
 	t.Run("does not set SkipHardcodedFallback when GH_HOST is not set", func(t *testing.T) {
 		require.NoError(t, os.Unsetenv("GH_HOST"))
+		SetDefaultGHHost("")
 
 		d := &WorkflowData{}
 		ctx := d.PinContext()
@@ -41,6 +47,28 @@ func TestWorkflowData_PinContext_SkipHardcodedFallback(t *testing.T) {
 		assert.False(t, ctx.SkipHardcodedFallback, "Expected SkipHardcodedFallback to be false when GH_HOST is not set")
 	})
 
+	t.Run("sets SkipHardcodedFallback when default GH host is a non-github.qkg1.top host", func(t *testing.T) {
+		require.NoError(t, os.Unsetenv("GH_HOST"))
+		SetDefaultGHHost("myorg.ghe.com")
+
+		d := &WorkflowData{}
+		ctx := d.PinContext()
+
+		require.NotNil(t, ctx)
+		assert.True(t, ctx.SkipHardcodedFallback, "Expected SkipHardcodedFallback to be true when default GH host is a GHE host")
+	})
+
+	t.Run("does not set SkipHardcodedFallback when default GH host is github.com", func(t *testing.T) {
+		require.NoError(t, os.Unsetenv("GH_HOST"))
+		SetDefaultGHHost("github.com")
+
+		d := &WorkflowData{}
+		ctx := d.PinContext()
+
+		require.NotNil(t, ctx)
+		assert.False(t, ctx.SkipHardcodedFallback, "Expected SkipHardcodedFallback to be false when default GH host is github.com")
+	})
+
 	t.Run("returns nil for nil WorkflowData", func(t *testing.T) {
 		var d *WorkflowData
 		ctx := d.PinContext()