Add active engine version inventory and runner identifier to gh-aw-metadata

[Copilot]

gh-aw-metadata currently lacks engine runtime version context and runner identity, which limits downstream traceability. This change extends the frontmatter-derived metadata payload to include normalized engine versions and the agent image runner identifier (with structured runs-on values serialized).

• Metadata contract updates

  • Extend lock metadata with:
    • engine_versions: { "<engine>": "<version>" }
    • agent_image_runner: "<runner-id-or-serialized-runs-on>"
  • Wire new fields through generation + JSON serialization/deserialization paths.

• Engine version population

  • Record versions only for engines that are active in the current workflow:
    • the main workflow engine
    • the threat-detection engine when threat detection is enabled
  • Apply configured engine version overrides when explicitly set for active engines.
  • Include copilot-sdk version only when engine.copilot-sdk: true is enabled on an active Copilot engine.

• Runner identifier capture

  • Derive runner identity from frontmatter runs-on.
  • Preserve string values as-is.
  • Serialize array/object forms to stable JSON for metadata storage.

• Test coverage

  • Add targeted tests for:
    • metadata field persistence in lock generation
    • JSON round-trip for new metadata fields
    • engine version map behavior for active engines (defaults + overrides + copilot-sdk)
    • runner identifier serialization behavior

# lock header
# gh-aw-metadata: {
#   "schema_version":"v4",
#   "frontmatter_hash":"...",
#   "engine_versions":{
#     "copilot":"1.0.57",
#     "copilot-sdk":"1.0.0"
#   },
#   "agent_image_runner":"[\"self-hosted\",\"linux\"]"
# }

---

Updated branch via pr-sous-chef in run https://github.com/github/gh-aw/actions/runs/26971599086. Please rebuild the metadata payload and rerun checks.

Generated by 👨‍🍳 PR Sous Chef · gpt54mini 4.4M · ◷

---

pr-sous-chef updated the branch in https://github.com/github/gh-aw/actions/runs/26974695546

Generated by 👨‍🍳 PR Sous Chef · gpt54mini 5.9M · ◷

[pelikhan]

@copilot only log engine version that are "active" in the current AW

[pelikhan]

@copilot must still be a single line JSONL payload

[pelikhan]

@copilot check that gh-aw-manifest does not duplicate this info.m

[Copilot]

@copilot only log engine version that are "active" in the current AW

Updated in commit de67ab2. engine_versions now only includes engines active in the current workflow (main engine plus active threat-detection engine when applicable), with overrides preserved and copilot-sdk included only when active.

[Copilot]

@copilot check that gh-aw-manifest does not duplicate this info.m

Checked and enforced in f5b1749. Added a test that parses gh-aw-manifest and asserts it does not include engine_versions or agent_image_runner (metadata-only fields).

@copilot must still be a single line JSONL payload

Addressed in f5b1749. Added assertions that both gh-aw-metadata and gh-aw-manifest header payloads remain single-line JSON strings in compiled lock files.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[pelikhan]

@copilot Merge main and recompile

[github-actions]

Please rebase on main, rerun the metadata compile, and push the result.

Generated by 👨‍🍳 PR Sous Chef · gpt54mini 5.9M · ◷

[Copilot]

@copilot Merge main and recompile

Done in 5d864c1 (merge) and 5ce848e. Merged origin/main, resolved the single conflict in contribution-check.lock.yml, built, and recompiled all 240 workflow lock files successfully.