[automated] Add deterministic CI validation for agentic workflows

[radical]

Is there an existing issue for this?

• I have searched the existing issues

Is your feature request related to a problem? Please describe the problem.

Agentic workflow source and generated lock files are not guaranteed to receive deterministic compilation and lint validation in pull requests. The repository has focused Infrastructure.Tests contracts, but a PR that changes only .github/workflows/*.md and .github/workflows/*.lock.yml can match the top-level CI skip patterns before those tests run.

There is currently no required CI job that recompiles affected agentic workflows, proves the committed lock files match their Markdown sources, and runs the gh-aw schema and shell linters.

Describe the solution you'd like

Add a dedicated GitHub Actions validation workflow triggered when an agentic workflow Markdown source or generated lock file changes:

paths:
  - '.github/workflows/**/*.md'
  - '.github/workflows/**/*.lock.yml'

The job should install the repository-pinned gh-aw CLI and run deterministic validation such as:

gh aw compile \
  --validate \
  --actionlint \
  --shellcheck \
  --no-check-update

git --no-pager diff --exit-code -- \
  '.github/workflows/*.lock.yml' \
  '.github/workflows/agentics-maintenance*.yml'

It should also run the focused repository contracts:

dotnet test \
  --project tests/Infrastructure.Tests/Infrastructure.Tests.csproj \
  --no-launch-profile -- \
  --filter-class "*.AgenticWorkflowTests" \
  --filter-not-trait "quarantined=true" \
  --filter-not-trait "outerloop=true"

This would fail the PR when:

• a Markdown source does not compile;
• a committed lock file is stale;
• the generated workflow fails GitHub Actions schema validation;
• generated shell steps fail shellcheck;
• the generated workflow fails actionlint;
• repository-specific agentic workflow contracts regress.

Additional context

This job would provide deterministic source-to-lock validation. It would not replace runtime validation for unique action usage shapes such as GitHub App permissions, OIDC, privileged events, or other external service boundaries.

[joperezr]

🤖 Aspire triage pass — 2026-09-24 21:28 UTC

Area: area-engineering-systems
Kind: feature-request
Repro: none
Affected version(s): repository CI; version-independent (latest stable: 13.5.4)
Severity: S4 — preventative CI validation improvement with no demonstrated customer-facing product failure

Urgency: ⚪ backlog — no milestone
Reason: concrete repository-maintenance proposal, but not important or actionable enough for the 13.6 product release train

Suggested owner(s): David Pine (@IEvangelist) (score 33), backup Jose Perez Rodriguez (@joperezr) (score 11)
Evidence:

• IEvangelist merged Fix PR documentation workflow inputs and completion #20293, Modernize agentic workflows with gh-aw v0.88.7 #20209, and Fix docs safe-output base fallback #19465 touching agentic workflow sources or locks in area-engineering-systems (last 90d)
• joperezr merged Add daily main to release/14.0 synchronization #20039 touching agentic workflow validation surfaces in area-engineering-systems
• joperezr closed ASPIRE010: add a forward link in the warning and publish a doc explaining AspireUseCliBundle #19368, Agent Code Review not working on non team member PRs #16724, and Internal build broken on release/aspire-internal-notify-validation #17938 as completed in area-engineering-systems

Confidence: medium
Needs human?: no