trial: logical-repo rewrite duplicates existing checkout with mapping

[bryanchen-d]

This was generated by AI during triage.

Summary

gh aw trial --logical-repo blindly inserts a new with: mapping after every unquoted actions/checkout step. If a checkout already has with:, the generated trial workflow contains duplicate mapping keys and cannot compile.

Version

gh aw version v0.82.14

Minimal workflow

---
on:
  workflow_dispatch:

steps:
  - name: Checkout target
    uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
    with:
      repository: owner/public-repo
      ref: main
      persist-credentials: false
---

Test.

Command

gh aw trial ./workflow.md \
  --logical-repo owner/public-repo \
  --host-repo owner/private-trial \
  --yes

Actual result

Trial rewriting produces:

- name: Checkout target
  uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
  with:
    repository: owner/public-repo
  with:
    repository: owner/public-repo
    ref: main
    persist-credentials: false

Compilation then fails with:

error: mapping key "with" already defined

The same failure occurs for checkout steps in custom jobs such as a trusted conclusion job.

Expected result

The trial rewriter should parse the step and:

• update an existing with.repository value, or
• add with.repository to the existing mapping, or
• create a new with: mapping only when none exists.

It should preserve other checkout inputs such as ref, path, token, and persist-credentials.

Current workaround

Quoting the action value makes the regex miss the step:

uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"

This is semantically equivalent YAML, but it is an implementation-detail workaround rather than a reliable trial interface.

Context

Found while validating microsoft/vscode-engineering#3364 with a private trial host. The production workflow compiles normally; only trial rewriting fails.

[pelikhan]

@copilot trial should use a runtime manager to correctly handle any arbitrary set of checkouts