fix: propagate top-level environment: to the detection job

[Copilot]

When a workflow declares a top-level environment:, it was propagated to agent, conclusion, pre_activation, and safe_outputs — but silently skipped for detection. The detection job was consuming COPILOT_GITHUB_TOKEN outside the environment gate, bypassing protection rules on every compile.

Changes

• pkg/workflow/threat_detection.go — buildDetectionJob already had the fix in the current tree (environment := data.Environment), matching the same propagation pattern used by other secret-consuming jobs.

• pkg/workflow/environment_test.go — Added TestDetectionJobEnvironmentPropagation integration coverage that compiles workflows end-to-end and asserts:

  • top-level env propagated → detection inherits it
  • no env configured → detection has no environment: field

• pkg/workflow/threat_detection_job_combinations_integration_test.go + pkg/cli/workflows/test-copilot-threat-detection-environment.md — Added an integration workflow fixture test that compiles a real workflow file and verifies the generated detection job contains environment: production.

• pkg/workflow/environment_test.go — Refactored TestSafeOutputsEnvironmentPropagation to use the pre-existing extractJobSection helper from compiler_test_helpers_test.go, removing duplicated section-extraction logic.

[Copilot]

Pull request overview

Adds an end-to-end integration test to ensure the compiled workflow YAML propagates a top-level environment: to the detection job (and respects the safe-outputs.threat-detection.environment override), and refactors an existing environment propagation test to reuse the shared job-section extraction helper.

Changes:

• Refactor TestSafeOutputsEnvironmentPropagation to use extractJobSection, removing duplicated YAML slicing logic.
• Add TestDetectionJobEnvironmentPropagation covering environment propagation and precedence for the detection job across three scenarios.

Show a summary per file

File	Description
pkg/workflow/environment_test.go	Refactors safe_outputs env assertions to use extractJobSection and adds an integration test verifying detection job environment propagation + override precedence.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 0

[pelikhan]

@copilot add integration workflow test for this scenario

[Copilot]

@copilot add integration workflow test for this scenario

Added an integration workflow fixture test for this scenario in dbb1a79.

It now compiles pkg/cli/workflows/test-copilot-threat-detection-environment.md and asserts the compiled detection job inherits environment: production from top-level environment:.