fix: emit filter:'' in agent checkout when sparse-checkout is enabled (#35947)

[dsyme]

Summary

Fixes a bug where agent jobs using sparse-checkout would silently fail due to actions/checkout enabling blobless clones when a filter value is not explicitly set. When sparse-checkout is active, blobless clones require persistent credentials for subsequent git fetch calls — credentials that are not available in agent job contexts. This PR emits filter: '' in generated checkout steps whenever sparse-checkout patterns are present, disabling blobless clone behaviour and restoring pull request findability.

Changes

pkg/workflow/checkout_step_generator.go — Bug Fix (high impact)

• Emits filter: '' in both the default and additional checkout step generators when sparse-checkout patterns are configured.
• Prevents actions/checkout from implicitly enabling blobless clones that would fail in agent contexts lacking persistent credentials.

pkg/workflow/checkout_manager_test.go — Tests (medium impact)

• Adds test cases asserting filter: '' is present in checkout steps when sparse-checkout is configured.
• Adds complementary test cases asserting no filter key is emitted when sparse-checkout is absent.
• Covers both default and additional checkout step paths.

docs/sparseness.md — Documentation (low impact, new file)

• New technical reference document explaining the interaction between sparse-checkout and blobless clones.
• Documents why filter: '' must be explicitly emitted for agent jobs when sparse-checkout is enabled.
• Covers the difference in behaviour between agent jobs and safe_outputs jobs.

Motivation

actions/checkout enables blobless clones by default when a sparse-checkout pattern list is provided. Blobless clones defer blob fetching and require that git credentials remain available beyond the initial checkout step. Agent jobs do not retain these credentials, causing subsequent git operations (including pull request discovery) to fail. Explicitly passing filter: '' suppresses the blobless clone and ensures a standard full-content sparse checkout that works without persistent credentials.

Testing

• Unit tests added in checkout_manager_test.go covering the presence and absence of filter: '' under sparse-checkout conditions.
• No breaking changes. No changes to public APIs or schema.

Generated by PR Description Updater for issue #35949 · sonnet46 1.1M · ◷

[Copilot]

Pull request overview

This PR updates the workflow YAML generation for agent-job checkouts to explicitly emit filter: '' in actions/checkout when sparse-checkout patterns are configured, preventing actions/checkout@v6 from implicitly enabling blobless/partial clones that break offline git operations in agent jobs.

Changes:

• Emit filter: '' for the default checkout when sparsePatterns is non-empty.
• Emit filter: '' for additional checkouts when sparsePatterns is non-empty.
• Add/extend unit tests to verify filter: is present only when sparse-checkout is configured.

Show a summary per file

File	Description
pkg/workflow/checkout_step_generator.go	Adds conditional filter: '' emission for default and additional checkouts when sparse-checkout is used.
pkg/workflow/checkout_manager_test.go	Adds assertions covering filter: '' presence/absence based on sparse-checkout configuration.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 2

[github-actions]

✅ smoke-ci: safeoutputs CLI comment + comment-memory run (26689009788)

Generated by 🧪 Smoke CI for issue #35949 · ◷