Emit unquoted top-level on: in compiled .lock.yml workflows (#32357)

Copilot · web-flow · commit d21a90a78671 · 2026-05-15T06:08:18.000-07:00
diff --git a/pkg/workflow/compiler_events_test.go b/pkg/workflow/compiler_events_test.go
@@ -32,7 +32,7 @@ tools:
   github:
     allowed: [list_issues]
 ---`,
-			expectedOn: `"on": push`,
+			expectedOn: `on: push`,
 		},
 		{
 			name: "custom on workflow_dispatch",
@@ -43,7 +43,7 @@ tools:
   github:
     allowed: [list_issues]
 ---`,
-			expectedOn: `"on":
+			expectedOn: `on:
   workflow_dispatch:`,
 		},
 		{
@@ -58,7 +58,7 @@ tools:
   github:
     allowed: [list_issues]
 ---`,
-			expectedOn: `"on":
+			expectedOn: `on:
   pull_request:
     branches:
     - main
@@ -79,7 +79,7 @@ tools:
   github:
     allowed: [list_issues]
 ---`,
-			expectedOn: `"on":
+			expectedOn: `on:
   issues:
     types:
     - opened
@@ -276,7 +276,7 @@ tools:
     allowed: [list_issues]
 ---`,
 			filename:        "command-with-dispatch.md",
-			expectedOn:      "\"on\":\n  discussion:\n    types:\n    - created\n    - edited\n  discussion_comment:\n    types:\n    - created\n    - edited\n  issue_comment:\n    types:\n    - created\n    - edited\n  issues:\n    types:\n    - opened\n    - edited\n    - reopened\n  pull_request:\n    types:\n    - opened\n    - edited\n    - reopened\n  pull_request_review_comment:\n    types:\n    - created\n    - edited\n  workflow_dispatch:",
+			expectedOn:      "on:\n  discussion:\n    types:\n    - created\n    - edited\n  discussion_comment:\n    types:\n    - created\n    - edited\n  issue_comment:\n    types:\n    - created\n    - edited\n  issues:\n    types:\n    - opened\n    - edited\n    - reopened\n  pull_request:\n    types:\n    - opened\n    - edited\n    - reopened\n  pull_request_review_comment:\n    types:\n    - created\n    - edited\n  workflow_dispatch:",
 			expectedIf:      "github.event_name == 'issues'",
 			expectedCommand: "test-bot",
 			shouldError:     false,
@@ -294,7 +294,7 @@ tools:
     allowed: [list_issues]
 ---`,
 			filename:        "command-with-schedule.md",
-			expectedOn:      "\"on\":\n  discussion:\n    types:\n    - created\n    - edited\n  discussion_comment:\n    types:\n    - created\n    - edited\n  issue_comment:\n    types:\n    - created\n    - edited\n  issues:\n    types:\n    - opened\n    - edited\n    - reopened\n  pull_request:\n    types:\n    - opened\n    - edited\n    - reopened\n  pull_request_review_comment:\n    types:\n    - created\n    - edited\n  schedule:\n  - cron: \"0 9 * * 1\"",
+			expectedOn:      "on:\n  discussion:\n    types:\n    - created\n    - edited\n  discussion_comment:\n    types:\n    - created\n    - edited\n  issue_comment:\n    types:\n    - created\n    - edited\n  issues:\n    types:\n    - opened\n    - edited\n    - reopened\n  pull_request:\n    types:\n    - opened\n    - edited\n    - reopened\n  pull_request_review_comment:\n    types:\n    - created\n    - edited\n  schedule:\n  - cron: \"0 9 * * 1\"",
 			expectedIf:      "github.event_name == 'issues'",
 			expectedCommand: "schedule-bot",
 			shouldError:     false,
@@ -313,7 +313,7 @@ tools:
     allowed: [list_issues]
 ---`,
 			filename:        "command-with-multiple.md",
-			expectedOn:      "\"on\":\n  discussion:\n    types:\n    - created\n    - edited\n  discussion_comment:\n    types:\n    - created\n    - edited\n  issue_comment:\n    types:\n    - created\n    - edited\n  issues:\n    types:\n    - opened\n    - edited\n    - reopened\n  pull_request:\n    types:\n    - opened\n    - edited\n    - reopened\n  pull_request_review_comment:\n    types:\n    - created\n    - edited\n  push:\n    branches:\n    - main\n  workflow_dispatch:",
+			expectedOn:      "on:\n  discussion:\n    types:\n    - created\n    - edited\n  discussion_comment:\n    types:\n    - created\n    - edited\n  issue_comment:\n    types:\n    - created\n    - edited\n  issues:\n    types:\n    - opened\n    - edited\n    - reopened\n  pull_request:\n    types:\n    - opened\n    - edited\n    - reopened\n  pull_request_review_comment:\n    types:\n    - created\n    - edited\n  push:\n    branches:\n    - main\n  workflow_dispatch:",
 			expectedIf:      "github.event_name == 'issues'",
 			expectedCommand: "multi-bot",
 			shouldError:     false,
diff --git a/pkg/workflow/compiler_validation_test.go b/pkg/workflow/compiler_validation_test.go
@@ -5,6 +5,7 @@ package workflow
 import (
 	"os"
 	"path/filepath"
+	"regexp"
 	"strings"
 	"testing"
 
@@ -292,6 +293,16 @@ This is a test workflow.
 	if !strings.HasPrefix(firstContentLine, "name:") {
 		t.Errorf("First non-comment line should start with 'name:', but got: %s", firstContentLine)
 	}
+
+	quotedTopLevelOn := regexp.MustCompile(`(?m)^"on":(?:\s|$)`)
+	unquotedTopLevelOn := regexp.MustCompile(`(?m)^on:(?:\s|$)`)
+
+	if quotedTopLevelOn.MatchString(lockContent) {
+		t.Errorf("Expected top-level on key to be unquoted, but found quoted form in generated YAML:\n%s", lockContent)
+	}
+	if !unquotedTopLevelOn.MatchString(lockContent) {
+		t.Errorf("Expected generated YAML to contain unquoted top-level on key, but it did not:\n%s", lockContent)
+	}
 }
 
 func TestValidateWorkflowSchema(t *testing.T) {
diff --git a/pkg/workflow/compiler_yaml.go b/pkg/workflow/compiler_yaml.go
@@ -268,6 +268,7 @@ func (c *Compiler) generateWorkflowBody(yaml *strings.Builder, data *WorkflowDat
 	// can receive caller metadata (repo, run_id, actor, etc.) from dispatch_workflow.
 	// String-based injection preserves existing YAML comments and formatting.
 	onSection = injectAwContextIntoOnYAML(onSection)
+	onSection = UnquoteYAMLTopLevelKey(onSection, "on")
 	yaml.WriteString(onSection)
 	yaml.WriteString("\n\n")
 
diff --git a/pkg/workflow/slash_command_centralized_compile_test.go b/pkg/workflow/slash_command_centralized_compile_test.go
@@ -76,7 +76,7 @@ tools:
 	require.NoError(t, err)
 	compiled := string(lockContent)
 
-	require.Contains(t, compiled, "\"on\":\n  workflow_dispatch:")
+	require.Contains(t, compiled, "on:\n  workflow_dispatch:")
 	require.Contains(t, compiled, "workflow_dispatch:")
 	require.NotContains(t, compiled, "\n  issues:\n    types:")
 	require.Contains(t, compiled, "github.event_name == 'workflow_dispatch'")
diff --git a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden
@@ -1,5 +1,5 @@
 name: "basic-copilot-test"
-"on":
+on:
   workflow_dispatch:
     inputs:
       aw_context:
diff --git a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/claude-with-network.golden b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/claude-with-network.golden
@@ -1,5 +1,5 @@
 name: "claude-with-network-test"
-"on":
+on:
   workflow_dispatch:
 
 permissions: {}
diff --git a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden
@@ -1,5 +1,5 @@
 name: "Test Playwright CLI Mode"
-"on":
+on:
   workflow_dispatch:
     inputs:
       aw_context:
diff --git a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden
@@ -1,5 +1,5 @@
 name: "Smoke Copilot"
-"on":
+on:
   pull_request:
     # names: # Label filtering applied via job conditions
     # - smoke # Label filtering applied via job conditions
diff --git a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-test-tools.golden b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-test-tools.golden
@@ -1,5 +1,5 @@
 name: "Agent Container Smoke Test"
-"on":
+on:
   pull_request:
     # names: # Label filtering applied via job conditions
     # - smoke # Label filtering applied via job conditions
diff --git a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden
@@ -1,5 +1,5 @@
 name: "with-imports-test"
-"on":
+on:
   workflow_dispatch:
     inputs:
       aw_context:
diff --git a/pkg/workflow/testdata/wasm_golden/WasmBinary/basic-copilot.golden b/pkg/workflow/testdata/wasm_golden/WasmBinary/basic-copilot.golden
@@ -1,5 +1,5 @@
 name: "basic-copilot-test"
-"on":
+on:
   workflow_dispatch:
     inputs:
       aw_context:
diff --git a/pkg/workflow/testdata/wasm_golden/WasmBinary/with-imports.golden b/pkg/workflow/testdata/wasm_golden/WasmBinary/with-imports.golden
@@ -1,5 +1,5 @@
 name: "with-imports-test"
-"on":
+on:
   workflow_dispatch:
     inputs:
       aw_context:
diff --git a/pkg/workflow/yaml.go b/pkg/workflow/yaml.go
@@ -176,6 +176,34 @@ func UnquoteYAMLKey(yamlStr string, key string) string {
 	return re.ReplaceAllString(yamlStr, "${1}${2}"+key+":")
 }
 
+// UnquoteYAMLTopLevelKey removes quotes from a YAML key only when it appears
+// at the very start of the YAML content.
+//
+// This intentionally leaves nested quoted keys unchanged.
+// Example:
+//
+//	"on":
+//	  push:
+//
+// becomes:
+//
+//	on:
+//	  push:
+//
+// but:
+//
+//	parent:
+//	  "on":
+//
+// remains unchanged.
+func UnquoteYAMLTopLevelKey(yamlStr string, key string) string {
+	quotedPrefix := `"` + key + `":`
+	if strings.HasPrefix(yamlStr, quotedPrefix) {
+		return key + ":" + yamlStr[len(quotedPrefix):]
+	}
+	return yamlStr
+}
+
 // MarshalWithFieldOrder marshals a map to YAML with fields in a specific order.
 //
 // This function ensures deterministic field ordering in the generated YAML by using
diff --git a/pkg/workflow/yaml_test.go b/pkg/workflow/yaml_test.go
@@ -217,6 +217,52 @@ on:
 	}
 }
 
+func TestUnquoteYAMLTopLevelKey(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		key      string
+		expected string
+	}{
+		{
+			name: "unquotes top-level on key",
+			input: `"on":
+  workflow_dispatch:`,
+			key: "on",
+			expected: `on:
+  workflow_dispatch:`,
+		},
+		{
+			name: "does not unquote nested key",
+			input: `parent:
+  "on":
+    value: true`,
+			key: "on",
+			expected: `parent:
+  "on":
+    value: true`,
+		},
+		{
+			name: "no change when top-level key already unquoted",
+			input: `on:
+  push:`,
+			key: "on",
+			expected: `on:
+  push:`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := UnquoteYAMLTopLevelKey(tt.input, tt.key)
+			if result != tt.expected {
+				t.Errorf("UnquoteYAMLTopLevelKey() failed\nInput:\n%s\n\nExpected:\n%s\n\nGot:\n%s",
+					tt.input, tt.expected, result)
+			}
+		})
+	}
+}
+
 func TestMarshalWithFieldOrder(t *testing.T) {
 	tests := []struct {
 		name           string
