In the detection job, these newly injected local build steps run npm ci / npm run build but the job never checks out the repository, so package.json/tsconfig.json/src won’t exist in $GITHUB_WORKSPACE and the build will fail. Add an actions/checkout (and ensure it checks out the same ref/PR branch as the agent job) before the Node/npm steps, or change the postprocess logic so only jobs with a checkout get the local-build replacement.

Dropping the matches.length !== 1 guard means this will blindly replace every matching install step, even in jobs that don’t have a repo checkout / Node toolchain. In this PR it results in smoke-codex.lock.yml’s detection job getting npm ci/npm run build without any actions/checkout. Consider reintroducing validation per-match (e.g., ensure the surrounding job contains a checkout step) and/or teach buildLocalInstallSteps injection to also add a checkout step when needed, so the postprocess script can’t generate broken workflows.

See below for a potential fix:

    if (matches.length === 1) {
      content = content.replace(
        installStepRegexGlobal,
        (_match, indent: string) => buildLocalInstallSteps(indent)
      );
      modified = true;
      console.log(`  Replaced ${matches.length} awf install step(s) with local build`);
    } else {
      console.warn(
        `  Skipping awf install step replacement: expected exactly 1 match, found ${matches.length}`
      );
    }