Fix import manifest ordering: preserve topological sort from parser

[Copilot]

The workflow manifest was sorting imported files alphabetically, breaking topological ordering required for correct dependency resolution. The parser already computes topological order (dependencies before dependents) via Kahn's algorithm - alphabetical re-sorting invalidated this.

Changes

• pkg/workflow/compiler_yaml.go: Removed alphabetical sort of ImportedFiles, preserved parser's topological order. Retained alphabetical sort for IncludedFiles (no dependency constraints).

• pkg/workflow/compiler_yaml_test.go: Updated TestManifestHeaderOrderingDeterministic expectations - imports preserve input order (already topological), includes remain alphabetically sorted.

• Workflow recompilation: ci-coach.lock.yml updated to reflect correct topological ordering where jqschema.md appears before ci-data-analysis.md (which depends on it).

Example

For an import graph where A→{C,D}, B→E, C→F:

# Correct topological order (preserved from parser):
#   Imports:
#     - file-d.md      # root
#     - file-e.md      # root  
#     - file-f.md      # root
#     - file-c.md      # depends on F
#     - file-a.md      # depends on C,D

# Incorrect alphabetical order (was breaking tests):
#   Imports:
#     - file-a.md      # ERROR: A before its dependencies C,D
#     - file-c.md
#     - file-d.md

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
  • Triggering command: /usr/bin/gh gh repo view --json owner,name --jq .owner.login + "/" + .name ache/go/1.25.0/x-test.short=true (http block)
  • Triggering command: /usr/bin/gh gh repo view --json owner,name --jq .owner.login + "/" + .name .cfg (http block)
• https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
  • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha runs/20260216-162206-11446/test-1401951292/.github/workflows (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha runs/20260216-162419-15803/test-3004746240/.github/workflows git 812517/b382/vet.cfg --git-dir 64/pkg/tool/linurev-parse /usr/bin/git git ls-f�� --exclude-standard --others /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet -v 64/pkg/tool/linurev-parse 0/x64/bin/node /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v3
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha 2206-11446/test-2071239358/.github/workflows /tmp/go-build4137996805/b168/vet.cfg 64/pkg/tool/linux_amd64/vet (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha vaScript1785551031/001/test-empty-frontmatter.md git ache/node/24.13.0/x64/bin/bash --show-toplevel 13+pelikhan@userrev-parse /opt/hostedtoolc--show-toplevel git rev-�� st-2338438790/.github/workflows node bin/sh /tmp/TestHashCongit x_amd64/vet /opt/hostedtoolc--show-toplevel git (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v4
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha SameOutput1693416122/001/stability-test.md (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha --show-current /home/REDACTED/work/gh-aw/gh-aw/pkg/parser/import_topological_test.go /usr/bin/git with-tools.md .cfg 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linuremote.origin.url /usr/bin/git ent.js .cfg 64/pkg/tool/linu--show-toplevel git (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v5
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha d/gh-aw/main.go ache/go/1.25.0/x64/src/internal/fuzz/counters_supported.go 64/pkg/tool/linux_amd64/vet (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha bility_SameInputSameOutput1693416122/001/stability-test.md /sys/fs/cgroup /usr/bin/git (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel 64/pkg/tool/linuconfig /usr/bin/git (http block)
• https://api.github.com/repos/actions/github-script/git/ref/tags/v7
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v7 --jq .object.sha (http block)
• https://api.github.com/repos/actions/github-script/git/ref/tags/v8
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha go1.25.0 -c=4 -nolocalimports -importcfg /tmp/go-build2630673778/b386/importcfg -pack /tmp/go-build2630673778/b386/_testmain.go (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha go1.25.0 -c=4 -nolocalimports -importcfg /tmp/go-build2630673778/b392/importcfg -pack /tmp/go-build2630673778/b392/_testmain.go (http block)
• https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha tsup (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel git /usr/bin/bash --show-toplevel 64/pkg/tool/linurev-parse /usr/bin/git bash --no�� --noprofile git ache/node/24.13.0/x64/bin/node --show-toplevel 64/pkg/tool/linurev-parse /usr/bin/git bash (http block)
• https://api.github.com/repos/actions/setup-go/git/ref/tags/v6
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v6 --jq .object.sha (http block)
• https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha tsup (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha /ref/tags/v8 0673778/b423/workflow.test /usr/local/bin/bash t0 64/pkg/tool/linurev-parse (http block)
• https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq .object.sha (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
  • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 piler_file_size_test.go .cfg (http block)
  • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 ache/go/1.25.0/x64/pkg/tool/linucurrent (local changes) x_amd64/vet 0673778/b395/matgit (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
  • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 copilot/canonicalize-header-ordering .cfg (http block)
  • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 --jq /usr/bin/sed 0673778/b391/_pkgit (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
  • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 copilot/canonicalize-header-ordering ode (http block)
  • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 0673778/b386/fileutil.test /usr/bin/bash t0 (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
  • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 copilot/canonicalize-header-ordering x_amd64/vet (http block)
  • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 ache/go/1.25.0/x64/pkg/tool/linucurrent (local changes) x_amd64/vet 0673778/b394/_pk/opt/hostedtoolcache/node/24.13.0/x64/bin/node (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
  • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 copilot/canonicalize-header-ordering .cfg (http block)
  • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 sh x_amd64/vet pkT4SpCS9 resolved$ /usr/bin/git x_amd64/vet /opt�� -maxdepth 4 /usr/bin/ls d -name bin ls (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
  • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 copilot/canonicalize-header-ordegithub.com/github/gh-aw/pkg/fileutil x_amd64/link (http block)
  • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 sh x_amd64/link cp dist/index.jsgit (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
  • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 copilot/canonicamain x_amd64/compile (http block)
  • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile x_amd64/vet 0673778/b392/_pkgit (http block)
• https://api.github.com/repos/github/gh-aw/actions/workflows
  • Triggering command: /usr/bin/gh gh workflow list --json name,state,path (http block)
  • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 (http block)
  • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 (http block)
• https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha 2071239358/.github/workflows 7996805/b168/vet.cfg x_amd64/vet ImportedFiles pkg/workflow/comrev-parse (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha 31/001/test-empty-frontmatter.md 0673778/b355/importcfg 0/x64/bin/bash k/gh-aw/gh-aw/ingit s.noreply.githubrev-parse ache/node/24.13.--show-toplevel git-upload-pack orig�� ithub/workflows /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/compile /usr/bin/git sistency_GoAndJa/usr/bin/git -trimpath ache/go/1.25.0/x-v git (http block)
• https://api.github.com/repos/nonexistent/repo/actions/runs/12345
  • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion (http block)
  • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion 2206-11446/test-git (http block)
• https://api.github.com/repos/owner/repo/actions/workflows
  • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo x_amd64/vet (http block)
  • Triggering command: /usr/bin/gh gh workflow list --repo owner/repo --json name,path,state ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
  • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo /usr/bin/git ithub/workflows 7996805/b229/vet--norc x_amd64/compile git rev-�� --show-toplevel 1PHYmzD8NqSa /usr/bin/git 84,96p pkg/workflow/comadd 8c44461e25df53d4. git (http block)
• https://api.github.com/repos/test-owner/test-repo/actions/secrets
  • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name (http block)
  • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet /usr/bin/git b/workflows 7996805/b173/vet--norc ache/go/1.25.0/x--noprofile git rev-�� --show-toplevel ache/go/1.25.0/xorigin /usr/bin/git 7996805/b001/_pkgit (http block)
• https://api.github.com/user
  • Triggering command: /usr/bin/gh gh api user --jq .login (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login se 7996805/b053/vet.cfg docker-compose (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login se 7996805/b067/vet.cfg ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Reference: https://github.com/github/gh-aw/actions/runs/22069912363/job/63771647299#step:9:1

Fix tests

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.