Jobs in 4 workflows referenced needs.X.outputs.* in activation job prompt steps without X in activation's needs:, causing actionlint [expression] errors and incorrect prompt substitutions (empty values at activation time since the referenced jobs hadn't run yet).

Compiler fixes

• buildActivationJob: When a custom job (no explicit needs:) has outputs referenced in the markdown body, automatically add it to activationNeeds so it runs before activation
• buildCustomJobs: Skip auto-adding needs: activation to jobs whose outputs are referenced in the markdown body — they should run independently before activation
• buildMainJob: Also search data.CustomSteps (frontmatter steps: section) when computing direct dependencies for the agent job, not just the markdown body
• generateKnownNeedsExpressions: Don't emit the generic output env var for jobs that declare explicit outputs not including output (was causing actionlint to flag undefined properties on known output types)
• jobDependsOnActivation(): New helper to detect custom jobs that explicitly depend on activation
• getCustomJobsDependingOnPreActivation(): Now excludes jobs that also depend on activation, preventing them from being incorrectly added to activation's needs: (which would create a cycle)
• generatePrompt() / generatePromptInActivationJob(): Accept a beforeActivationJobs []string parameter and filter expression mappings so that outputs from post-activation jobs are not embedded in activation's step env vars — preventing actionlint errors when a custom job explicitly gates on activation completing
• filterExpressionsForActivation(): New helper that removes expression mappings referencing custom jobs that run after activation from the activation job's prompt generation steps

Before the fix, precompute auto-received needs: activation, so activation's prompt ran before precompute and substituted empty values. After:

# bot-detection.lock.yml — before
activation:
  # no needs: precompute
precompute:
  needs: activation   # auto-added, wrong direction

# after
activation:
  needs: precompute   # correct: precompute runs first
precompute:
  # no needs: runs independently

Source fix (release.md)

config and release jobs now depend on both pre_activation and activation, establishing the correct ordering: pre_activation → activation → config → release → agent. This ensures the activation gate (permission check) must pass before these jobs run, while the compiler correctly avoids adding them to activation's own needs: (which would create a cycle).

# release.md — before
config:
  needs: [activation]
release:
  needs: [activation, config]

# after
config:
  needs: [pre_activation, activation]
release:
  needs: [pre_activation, activation, config]

Tests

New tests covering all new and updated compiler functions:

• TestJobDependsOnActivation — 8 cases covering string, array, and invalid needs inputs for the new helper
• TestGetCustomJobsDependingOnPreActivationExcludesActivationDependents — 4 cases verifying jobs with both pre_activation and activation in needs are excluded from the pre-activation set (preventing circular dependencies)
• TestBuildCustomJobsDoesNotAutoAddActivationToOutputReferencedJobs — verifies the compiler skips auto-adding needs: activation when a job's outputs are referenced in the markdown body
• TestFilterExpressionsForActivation — 8 unit cases covering nil customJobs, empty mappings, keep/filter by beforeActivationJobs, non-custom-job needs.* expressions, non-needs.* expressions, and malformed expressions
• TestFilterExpressionsForActivationEndToEnd — integration test compiling a full workflow with precompute (before activation) and config (after activation), asserting activation depends on precompute but not config, and the substitution step only references precompute's outputs

• Fixes [plan] Fix missing needs: declarations in 4 workflow files (22 actionlint expression errors) #17669

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.