gh aw upgrade leaves the implicit GH_AW_ACTION_FAILURE_ISSUE_EXPIRES_HOURS: "168" that gh aw compile patches to "0" #63028

Summary

gh aw upgrade and gh aw compile produce different lock files from the same source. In a repository without an expiry opt-in, compile writes GH_AW_ACTION_FAILURE_ISSUE_EXPIRES_HOURS: "0", while upgrade leaves the implicit "168" and generates no agentics-maintenance.yml to enforce it.

This is the same non-determinism reported in #57648, through a code path the fix in #57745 did not cover.

Reproduction

gh-aw v0.89.20, empty repository:

git init -b main && git commit --allow-empty -m init
gh aw init
mkdir -p .github/workflows
cat > .github/workflows/example.md <<'MD'
---
on:
  workflow_dispatch:
permissions:
  contents: read
engine: copilot
safe-outputs:
  add-comment:
---

# Example

Say hello.
MD

gh aw compile
grep EXPIRES_HOURS .github/workflows/example.lock.yml
#   GH_AW_ACTION_FAILURE_ISSUE_EXPIRES_HOURS: "0"

gh aw upgrade            # same result with --no-actions
grep EXPIRES_HOURS .github/workflows/example.lock.yml
#   GH_AW_ACTION_FAILURE_ISSUE_EXPIRES_HOURS: "168"
ls .github/workflows/agentics-maintenance.yml
#   No such file or directory

gh aw compile
grep EXPIRES_HOURS .github/workflows/example.lock.yml
#   GH_AW_ACTION_FAILURE_ISSUE_EXPIRES_HOURS: "0"

Cause

The implicit marker is corrected in two places, both gated on an empty CompileConfig.WorkflowDir:

• runPostProcessingForDirectory → generateMaintenanceWorkflowWrapper in pkg/cli/compile_pipeline.go
• runPostProcessing → workflow.DisableDefaultActionFailureExpiryMarkersIfUnenforced, added by Make targeted workflow compilation deterministic #57745

gh aw upgrade bypasses both:

1. Step 4 compiles through compileAllWorkflowFiles in pkg/cli/compile_file_operations.go, which calls compileSingleFile for each workflow and never runs post-processing.
2. The container-pin recompile calls recompileAllWorkflows in pkg/cli/update_command.go. That builds a CompileConfig with WorkflowDir set to the resolved workflows directory, so the WorkflowDir == "" gate skips maintenance generation and the marker patch.

Impact

• Running upgrade then compile flips the line every time, which causes diff churn in upgrade PRs.
• After upgrade, lock files advertise a 168-hour expiry that no scheduled close-expired-issues job enforces. That's the gap ADR-51425 set out to remove.

Setting maintenance.action_failure_issue_expires explicitly in aw.json makes both commands agree, which suggests the problem is limited to reconciling the implicit default.

Expected behaviour

gh aw upgrade produces the same lock files and maintenance workflow as gh aw compile for the same sources and repository configuration.

Possible fixes

• Route upgrade compilation through the same directory post-processing as gh aw compile.
• Or treat the default workflows directory like an empty WorkflowDir in both gates, and call the marker reconciliation from compileAllWorkflowFiles.

A regression test could run the upgrade compile path against a repository with no expiry opt-in and assert that each lock file contains "0" and that no maintenance workflow is generated.