From e4cd0d0a0a0decff446e2e5341e9941870551183 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 1 Feb 2026 11:49:11 +0000
Subject: [PATCH 1/6] Initial plan


From 9b77792d2274e7d6e38c360c121bad73a3d06194 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 1 Feb 2026 11:55:42 +0000
Subject: [PATCH 2/6] Add frontmatter hash display to
 check_workflow_timestamp_api.cjs

- Extract hash from lock file using extractHashFromLockFile
- Recompute hash from .md source file using computeFrontmatterHash
- Display both hashes in action output with comparison
- Show warning if hashes don't match
- All existing tests pass
- JavaScript code formatted with prettier

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .../setup/js/check_workflow_timestamp_api.cjs | 64 +++++++++++++++++++
 1 file changed, 64 insertions(+)

diff --git a/actions/setup/js/check_workflow_timestamp_api.cjs b/actions/setup/js/check_workflow_timestamp_api.cjs
index ef21207ea57..13624fb686a 100644
--- a/actions/setup/js/check_workflow_timestamp_api.cjs
+++ b/actions/setup/js/check_workflow_timestamp_api.cjs
@@ -8,6 +8,9 @@
  */
 
 const { getErrorMessage } = require("./error_helpers.cjs");
+const { computeFrontmatterHash, extractHashFromLockFile } = require("./frontmatter_hash.cjs");
+const fs = require("fs");
+const path = require("path");
 
 async function main() {
   const workflowFile = process.env.GH_AW_WORKFLOW_FILE;
@@ -85,6 +88,9 @@ async function main() {
   core.info(`  Source last commit: ${workflowDate.toISOString()} (${workflowCommit.sha.substring(0, 7)})`);
   core.info(`  Lock last commit: ${lockDate.toISOString()} (${lockCommit.sha.substring(0, 7)})`);
 
+  // Display frontmatter hashes
+  await displayFrontmatterHashes(workflowMdPath, lockFilePath);
+
   // Check if workflow file is newer than lock file
   if (workflowDate > lockDate) {
     const warningMessage = `Lock file '${lockFilePath}' is outdated! The workflow file '${workflowMdPath}' has been modified more recently. Run 'gh aw compile' to regenerate the lock file.`;
@@ -117,4 +123,62 @@ async function main() {
   }
 }
 
+/**
+ * Display frontmatter hashes from lock file and recomputed from source
+ * @param {string} workflowMdPath - Path to the source .md file
+ * @param {string} lockFilePath - Path to the compiled .lock.yml file
+ */
+async function displayFrontmatterHashes(workflowMdPath, lockFilePath) {
+  try {
+    core.info("Checking frontmatter hashes:");
+
+    // Extract hash from lock file
+    let lockFileHash = "";
+    try {
+      const lockContent = fs.readFileSync(lockFilePath, "utf8");
+      lockFileHash = extractHashFromLockFile(lockContent);
+    } catch (error) {
+      const errorMessage = getErrorMessage(error);
+      core.info(`  Could not read lock file: ${errorMessage}`);
+      return;
+    }
+
+    // Recompute hash from .md file
+    let recomputedHash = "";
+    try {
+      // Get the absolute path to the workflow file
+      const workspacePath = process.env.GITHUB_WORKSPACE || process.cwd();
+      const absoluteMdPath = path.join(workspacePath, workflowMdPath);
+
+      if (fs.existsSync(absoluteMdPath)) {
+        recomputedHash = await computeFrontmatterHash(absoluteMdPath);
+      } else {
+        core.info(`  Source file not found: ${workflowMdPath}`);
+        return;
+      }
+    } catch (error) {
+      const errorMessage = getErrorMessage(error);
+      core.info(`  Could not compute hash from source: ${errorMessage}`);
+      return;
+    }
+
+    // Display both hashes
+    core.info(`  Lock file hash:  ${lockFileHash || "(not found)"}`);
+    core.info(`  Recomputed hash: ${recomputedHash}`);
+
+    // Check if hashes match
+    if (lockFileHash && recomputedHash) {
+      if (lockFileHash === recomputedHash) {
+        core.info("  ✅ Frontmatter hashes match");
+      } else {
+        core.warning(`  ⚠️  Frontmatter hashes DO NOT match - frontmatter may have changed`);
+      }
+    }
+  } catch (error) {
+    // Don't fail the step if hash checking fails, just log it
+    const errorMessage = getErrorMessage(error);
+    core.info(`Could not check frontmatter hashes: ${errorMessage}`);
+  }
+}
+
 module.exports = { main };

From b4d5b0185ca5188ef5f0e4aef97f96e54a7970e8 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 1 Feb 2026 11:58:40 +0000
Subject: [PATCH 3/6] Use JavaScript implementation for hash computation

- Use JavaScript frontmatter hash implementation for consistency
- Add note about potential differences between Go and JS implementations
- Display helps identify either frontmatter changes or implementation differences
- All tests pass

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 actions/setup/js/check_workflow_timestamp_api.cjs | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/actions/setup/js/check_workflow_timestamp_api.cjs b/actions/setup/js/check_workflow_timestamp_api.cjs
index 13624fb686a..829d7553c7c 100644
--- a/actions/setup/js/check_workflow_timestamp_api.cjs
+++ b/actions/setup/js/check_workflow_timestamp_api.cjs
@@ -144,6 +144,10 @@ async function displayFrontmatterHashes(workflowMdPath, lockFilePath) {
     }
 
     // Recompute hash from .md file
+    // Note: Uses JavaScript implementation which may differ from Go implementation
+    // If hashes don't match, this could indicate either:
+    // 1. Frontmatter has changed since compilation
+    // 2. Difference between Go and JavaScript implementations
     let recomputedHash = "";
     try {
       // Get the absolute path to the workflow file

From f93b867fff716d8fea17caee5ff48adfb759bf47 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 1 Feb 2026 12:08:17 +0000
Subject: [PATCH 4/6] Replace timestamp-based validation with frontmatter hash
 comparison

- Remove GitHub API timestamp comparison logic
- Use frontmatter hash matching as the only validation method
- Fail step when hashes don't match (instead of just warning)
- Display both hashes in output for debugging
- Simplified validation flow: extract hash from lock file, recompute from source, compare

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .../setup/js/check_workflow_timestamp_api.cjs | 193 ++++++------------
 1 file changed, 58 insertions(+), 135 deletions(-)

diff --git a/actions/setup/js/check_workflow_timestamp_api.cjs b/actions/setup/js/check_workflow_timestamp_api.cjs
index 829d7553c7c..8993311cc51 100644
--- a/actions/setup/js/check_workflow_timestamp_api.cjs
+++ b/actions/setup/js/check_workflow_timestamp_api.cjs
@@ -2,9 +2,9 @@
 /// <reference types="@actions/github-script" />
 
 /**
- * Check workflow file timestamps using GitHub API to detect outdated lock files
- * This script compares the last commit time of the source .md file
- * with the compiled .lock.yml file and warns if recompilation is needed
+ * Check workflow frontmatter hashes to detect outdated lock files
+ * This script compares the frontmatter hash from the lock file with
+ * a recomputed hash from the source .md file to detect configuration drift
  */
 
 const { getErrorMessage } = require("./error_helpers.cjs");
@@ -25,163 +25,86 @@ async function main() {
   const workflowMdPath = `.github/workflows/${workflowBasename}.md`;
   const lockFilePath = `.github/workflows/${workflowFile}`;
 
-  core.info(`Checking workflow timestamps using GitHub API:`);
+  core.info(`Checking workflow frontmatter hashes:`);
   core.info(`  Source: ${workflowMdPath}`);
   core.info(`  Lock file: ${lockFilePath}`);
 
   const { owner, repo } = context.repo;
-  const ref = context.sha;
-
-  // Helper function to get the last commit for a file
-  async function getLastCommitForFile(path) {
-    try {
-      const response = await github.rest.repos.listCommits({
-        owner,
-        repo,
-        path,
-        per_page: 1,
-        sha: ref,
-      });
-
-      if (response.data && response.data.length > 0) {
-        const commit = response.data[0];
-        const committerDate = commit.commit.committer?.date;
-        if (!committerDate) {
-          return null;
-        }
-        return {
-          sha: commit.sha,
-          date: committerDate,
-          message: commit.commit.message,
-        };
-      }
-      return null;
-    } catch (error) {
-      const errorMessage = getErrorMessage(error);
-      core.info(`Could not fetch commit for ${path}: ${errorMessage}`);
-      return null;
-    }
-  }
-
-  // Fetch last commits for both files
-  const workflowCommit = await getLastCommitForFile(workflowMdPath);
-  const lockCommit = await getLastCommitForFile(lockFilePath);
 
-  // Handle cases where files don't exist
-  if (!workflowCommit) {
-    core.info(`Source file does not exist: ${workflowMdPath}`);
-  }
+  // Check frontmatter hashes and fail if they don't match
+  await checkFrontmatterHashes(workflowMdPath, lockFilePath, owner, repo);
+}
 
-  if (!lockCommit) {
-    core.info(`Lock file does not exist: ${lockFilePath}`);
+/**
+ * Check frontmatter hashes from lock file and recomputed from source
+ * Fails the step if hashes don't match
+ * @param {string} workflowMdPath - Path to the source .md file
+ * @param {string} lockFilePath - Path to the compiled .lock.yml file
+ * @param {string} owner - Repository owner
+ * @param {string} repo - Repository name
+ */
+async function checkFrontmatterHashes(workflowMdPath, lockFilePath, owner, repo) {
+  // Extract hash from lock file
+  let lockFileHash = "";
+  try {
+    const lockContent = fs.readFileSync(lockFilePath, "utf8");
+    lockFileHash = extractHashFromLockFile(lockContent);
+  } catch (error) {
+    const errorMessage = getErrorMessage(error);
+    core.setFailed(`Could not read lock file: ${errorMessage}`);
+    return;
   }
 
-  if (!workflowCommit || !lockCommit) {
-    core.info("Skipping timestamp check - one or both files not found");
+  if (!lockFileHash) {
+    core.setFailed(`Lock file '${lockFilePath}' does not contain a frontmatter hash comment.`);
     return;
   }
 
-  // Parse dates for comparison
-  const workflowDate = new Date(workflowCommit.date);
-  const lockDate = new Date(lockCommit.date);
+  // Recompute hash from .md file
+  let recomputedHash = "";
+  try {
+    // Get the absolute path to the workflow file
+    const workspacePath = process.env.GITHUB_WORKSPACE || process.cwd();
+    const absoluteMdPath = path.join(workspacePath, workflowMdPath);
 
-  core.info(`  Source last commit: ${workflowDate.toISOString()} (${workflowCommit.sha.substring(0, 7)})`);
-  core.info(`  Lock last commit: ${lockDate.toISOString()} (${lockCommit.sha.substring(0, 7)})`);
+    if (!fs.existsSync(absoluteMdPath)) {
+      core.setFailed(`Source file not found: ${workflowMdPath}`);
+      return;
+    }
 
-  // Display frontmatter hashes
-  await displayFrontmatterHashes(workflowMdPath, lockFilePath);
+    recomputedHash = await computeFrontmatterHash(absoluteMdPath);
+  } catch (error) {
+    const errorMessage = getErrorMessage(error);
+    core.setFailed(`Could not compute hash from source: ${errorMessage}`);
+    return;
+  }
 
-  // Check if workflow file is newer than lock file
-  if (workflowDate > lockDate) {
-    const warningMessage = `Lock file '${lockFilePath}' is outdated! The workflow file '${workflowMdPath}' has been modified more recently. Run 'gh aw compile' to regenerate the lock file.`;
+  // Display both hashes
+  core.info(`  Lock file hash:  ${lockFileHash}`);
+  core.info(`  Recomputed hash: ${recomputedHash}`);
 
-    // Format timestamps and commits for display
-    const workflowTimestamp = workflowDate.toISOString();
-    const lockTimestamp = lockDate.toISOString();
+  // Check if hashes match
+  if (lockFileHash === recomputedHash) {
+    core.info("✅ Frontmatter hashes match - lock file is up to date");
+  } else {
+    const errorMessage = `Lock file '${lockFilePath}' is outdated! The frontmatter hash does not match the source file '${workflowMdPath}'. Run 'gh aw compile' to regenerate the lock file.`;
 
     // Add summary to GitHub Step Summary
     let summary = core.summary
-      .addRaw("### ⚠️ Workflow Lock File Warning\n\n")
-      .addRaw("**WARNING**: Lock file is outdated and needs to be regenerated.\n\n")
+      .addRaw("### ⚠️ Workflow Lock File Outdated\n\n")
+      .addRaw("**ERROR**: Lock file frontmatter hash does not match the source file.\n\n")
       .addRaw("**Files:**\n")
       .addRaw(`- Source: \`${workflowMdPath}\`\n`)
-      .addRaw(`  - Last commit: ${workflowTimestamp}\n`)
-      .addRaw(`  - Commit SHA: [\`${workflowCommit.sha.substring(0, 7)}\`](https://github.com/${owner}/${repo}/commit/${workflowCommit.sha})\n`)
-      .addRaw(`- Lock: \`${lockFilePath}\`\n`)
-      .addRaw(`  - Last commit: ${lockTimestamp}\n`)
-      .addRaw(`  - Commit SHA: [\`${lockCommit.sha.substring(0, 7)}\`](https://github.com/${owner}/${repo}/commit/${lockCommit.sha})\n\n`)
+      .addRaw(`- Lock: \`${lockFilePath}\`\n\n`)
+      .addRaw("**Hashes:**\n")
+      .addRaw(`- Lock file hash: \`${lockFileHash}\`\n`)
+      .addRaw(`- Recomputed hash: \`${recomputedHash}\`\n\n`)
       .addRaw("**Action Required:** Run `gh aw compile` to regenerate the lock file.\n\n");
 
     await summary.write();
 
     // Fail the step to prevent workflow from running with outdated configuration
-    core.setFailed(warningMessage);
-  } else if (workflowCommit.sha === lockCommit.sha) {
-    core.info("✅ Lock file is up to date (same commit)");
-  } else {
-    core.info("✅ Lock file is up to date");
-  }
-}
-
-/**
- * Display frontmatter hashes from lock file and recomputed from source
- * @param {string} workflowMdPath - Path to the source .md file
- * @param {string} lockFilePath - Path to the compiled .lock.yml file
- */
-async function displayFrontmatterHashes(workflowMdPath, lockFilePath) {
-  try {
-    core.info("Checking frontmatter hashes:");
-
-    // Extract hash from lock file
-    let lockFileHash = "";
-    try {
-      const lockContent = fs.readFileSync(lockFilePath, "utf8");
-      lockFileHash = extractHashFromLockFile(lockContent);
-    } catch (error) {
-      const errorMessage = getErrorMessage(error);
-      core.info(`  Could not read lock file: ${errorMessage}`);
-      return;
-    }
-
-    // Recompute hash from .md file
-    // Note: Uses JavaScript implementation which may differ from Go implementation
-    // If hashes don't match, this could indicate either:
-    // 1. Frontmatter has changed since compilation
-    // 2. Difference between Go and JavaScript implementations
-    let recomputedHash = "";
-    try {
-      // Get the absolute path to the workflow file
-      const workspacePath = process.env.GITHUB_WORKSPACE || process.cwd();
-      const absoluteMdPath = path.join(workspacePath, workflowMdPath);
-
-      if (fs.existsSync(absoluteMdPath)) {
-        recomputedHash = await computeFrontmatterHash(absoluteMdPath);
-      } else {
-        core.info(`  Source file not found: ${workflowMdPath}`);
-        return;
-      }
-    } catch (error) {
-      const errorMessage = getErrorMessage(error);
-      core.info(`  Could not compute hash from source: ${errorMessage}`);
-      return;
-    }
-
-    // Display both hashes
-    core.info(`  Lock file hash:  ${lockFileHash || "(not found)"}`);
-    core.info(`  Recomputed hash: ${recomputedHash}`);
-
-    // Check if hashes match
-    if (lockFileHash && recomputedHash) {
-      if (lockFileHash === recomputedHash) {
-        core.info("  ✅ Frontmatter hashes match");
-      } else {
-        core.warning(`  ⚠️  Frontmatter hashes DO NOT match - frontmatter may have changed`);
-      }
-    }
-  } catch (error) {
-    // Don't fail the step if hash checking fails, just log it
-    const errorMessage = getErrorMessage(error);
-    core.info(`Could not check frontmatter hashes: ${errorMessage}`);
+    core.setFailed(errorMessage);
   }
 }
 

From 614c5c60aa791d17f98bd294251135971c8b5a60 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 1 Feb 2026 12:20:59 +0000
Subject: [PATCH 5/6] Add .github folder checkout to activation job for hash
 validation

- Created generateCheckoutForActivation() function
- Activation job now checks out both actions and .github folders
- Uses shallow clone (depth: 1) for efficiency
- Enables frontmatter hash validation to read source .md files
- Pre-activation job still only checks out actions folder

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 pkg/workflow/compiler_activation_jobs.go |  3 +-
 pkg/workflow/compiler_yaml_helpers.go    | 53 ++++++++++++++++++++++++
 2 files changed, 55 insertions(+), 1 deletion(-)

diff --git a/pkg/workflow/compiler_activation_jobs.go b/pkg/workflow/compiler_activation_jobs.go
index 9a87da90a46..5896dc73a72 100644
--- a/pkg/workflow/compiler_activation_jobs.go
+++ b/pkg/workflow/compiler_activation_jobs.go
@@ -378,7 +378,8 @@ func (c *Compiler) buildActivationJob(data *WorkflowData, preActivationJobCreate
 	}
 
 	// For dev mode (local action path), checkout the actions folder first
-	steps = append(steps, c.generateCheckoutActionsFolder(data)...)
+	// For activation job, also checkout .github folder (shallow) for hash validation
+	steps = append(steps, c.generateCheckoutForActivation(data)...)
 
 	// Activation job doesn't need project support (no safe outputs processed here)
 	steps = append(steps, c.generateSetupStep(setupActionRef, SetupActionDestination, false)...)
diff --git a/pkg/workflow/compiler_yaml_helpers.go b/pkg/workflow/compiler_yaml_helpers.go
index 95076c0c9b4..3d7656fa9f6 100644
--- a/pkg/workflow/compiler_yaml_helpers.go
+++ b/pkg/workflow/compiler_yaml_helpers.go
@@ -145,6 +145,59 @@ func (c *Compiler) generateCheckoutActionsFolder(data *WorkflowData) []string {
 	return nil
 }
 
+// generateCheckoutForActivation generates the checkout step for the activation job
+// that needs both actions folder (for scripts) and .github folder (for hash validation).
+// This is specifically for the activation job that validates frontmatter hashes.
+//
+// Returns a slice of strings that can be appended to a steps array, where each
+// string represents a line of YAML for the checkout step. Returns nil if:
+// - Not in dev or script mode
+// - action-tag feature is specified (uses remote actions instead)
+func (c *Compiler) generateCheckoutForActivation(data *WorkflowData) []string {
+	// Check if action-tag is specified - if so, we're using remote actions
+	if data != nil && data.Features != nil {
+		if actionTagVal, exists := data.Features["action-tag"]; exists {
+			if actionTagStr, ok := actionTagVal.(string); ok && actionTagStr != "" {
+				// action-tag is set, use remote actions - no checkout needed
+				return nil
+			}
+		}
+	}
+
+	// Script mode: checkout both actions and .github folders from githubnext/gh-aw
+	if c.actionMode.IsScript() {
+		return []string{
+			"      - name: Checkout actions folder\n",
+			fmt.Sprintf("        uses: %s\n", GetActionPin("actions/checkout")),
+			"        with:\n",
+			"          repository: githubnext/gh-aw\n",
+			"          sparse-checkout: |\n",
+			"            actions\n",
+			"            .github\n",
+			"          path: /tmp/gh-aw/actions-source\n",
+			"          depth: 1\n",
+			"          persist-credentials: false\n",
+		}
+	}
+
+	// Dev mode: checkout both actions and .github folders (shallow)
+	if c.actionMode.IsDev() {
+		return []string{
+			"      - name: Checkout actions folder\n",
+			fmt.Sprintf("        uses: %s\n", GetActionPin("actions/checkout")),
+			"        with:\n",
+			"          sparse-checkout: |\n",
+			"            actions\n",
+			"            .github\n",
+			"          depth: 1\n",
+			"          persist-credentials: false\n",
+		}
+	}
+
+	// Release mode or other modes: no checkout needed
+	return nil
+}
+
 // generateGitHubScriptWithRequire generates a github-script step that loads a module using require().
 // Instead of repeating the global variable assignments inline, it uses the setup_globals helper function.
 //

From a0bd56e3956f41fdc0bf37159aede6728637a195 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 1 Feb 2026 12:31:44 +0000
Subject: [PATCH 6/6] Add shallow clone (depth: 1) to all dev mode checkouts

- Added depth: 1 to generateCheckoutActionsFolder dev mode
- Now all checkout steps use shallow clone for efficiency
- Activation job: checks out actions + .github (shallow)
- All other jobs: check out actions only (shallow)
- Reduces checkout time and disk usage across all jobs

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .github/workflows/agent-performance-analyzer.lock.yml      | 2 ++
 .github/workflows/agent-persona-explorer.lock.yml          | 2 ++
 .github/workflows/ai-moderator.lock.yml                    | 2 ++
 .github/workflows/archie.lock.yml                          | 2 ++
 .github/workflows/artifacts-summary.lock.yml               | 2 ++
 .github/workflows/audit-workflows.lock.yml                 | 2 ++
 .github/workflows/auto-triage-issues.lock.yml              | 2 ++
 .github/workflows/blog-auditor.lock.yml                    | 2 ++
 .github/workflows/brave.lock.yml                           | 2 ++
 .github/workflows/breaking-change-checker.lock.yml         | 2 ++
 .github/workflows/changeset.lock.yml                       | 2 ++
 .github/workflows/chroma-issue-indexer.lock.yml            | 2 ++
 .github/workflows/ci-coach.lock.yml                        | 2 ++
 .github/workflows/ci-doctor.lock.yml                       | 2 ++
 .github/workflows/claude-code-user-docs-review.lock.yml    | 2 ++
 .github/workflows/cli-consistency-checker.lock.yml         | 2 ++
 .github/workflows/cli-version-checker.lock.yml             | 2 ++
 .github/workflows/cloclo.lock.yml                          | 2 ++
 .github/workflows/code-scanning-fixer.lock.yml             | 2 ++
 .github/workflows/code-simplifier.lock.yml                 | 2 ++
 .github/workflows/codex-github-remote-mcp-test.lock.yml    | 2 ++
 .github/workflows/commit-changes-analyzer.lock.yml         | 2 ++
 .github/workflows/copilot-agent-analysis.lock.yml          | 2 ++
 .github/workflows/copilot-cli-deep-research.lock.yml       | 2 ++
 .github/workflows/copilot-pr-merged-report.lock.yml        | 2 ++
 .github/workflows/copilot-pr-nlp-analysis.lock.yml         | 2 ++
 .github/workflows/copilot-pr-prompt-analysis.lock.yml      | 2 ++
 .github/workflows/copilot-session-insights.lock.yml        | 2 ++
 .github/workflows/craft.lock.yml                           | 2 ++
 .github/workflows/daily-assign-issue-to-user.lock.yml      | 2 ++
 .github/workflows/daily-choice-test.lock.yml               | 2 ++
 .github/workflows/daily-cli-performance.lock.yml           | 2 ++
 .github/workflows/daily-code-metrics.lock.yml              | 2 ++
 .github/workflows/daily-compiler-quality.lock.yml          | 2 ++
 .github/workflows/daily-copilot-token-report.lock.yml      | 2 ++
 .github/workflows/daily-doc-updater.lock.yml               | 2 ++
 .github/workflows/daily-file-diet.lock.yml                 | 2 ++
 .github/workflows/daily-firewall-report.lock.yml           | 2 ++
 .github/workflows/daily-issues-report.lock.yml             | 2 ++
 .github/workflows/daily-malicious-code-scan.lock.yml       | 2 ++
 .github/workflows/daily-multi-device-docs-tester.lock.yml  | 2 ++
 .github/workflows/daily-news.lock.yml                      | 2 ++
 .github/workflows/daily-observability-report.lock.yml      | 2 ++
 .github/workflows/daily-performance-summary.lock.yml       | 2 ++
 .github/workflows/daily-regulatory.lock.yml                | 2 ++
 .github/workflows/daily-repo-chronicle.lock.yml            | 2 ++
 .github/workflows/daily-safe-output-optimizer.lock.yml     | 2 ++
 .github/workflows/daily-secrets-analysis.lock.yml          | 2 ++
 .github/workflows/daily-semgrep-scan.lock.yml              | 2 ++
 .github/workflows/daily-team-evolution-insights.lock.yml   | 2 ++
 .github/workflows/daily-team-status.lock.yml               | 2 ++
 .github/workflows/daily-testify-uber-super-expert.lock.yml | 2 ++
 .github/workflows/daily-workflow-updater.lock.yml          | 2 ++
 .github/workflows/deep-report.lock.yml                     | 2 ++
 .github/workflows/delight.lock.yml                         | 2 ++
 .github/workflows/dependabot-bundler.lock.yml              | 2 ++
 .github/workflows/dependabot-burner.lock.yml               | 2 ++
 .github/workflows/dependabot-go-checker.lock.yml           | 2 ++
 .github/workflows/dev-hawk.lock.yml                        | 2 ++
 .github/workflows/dev.lock.yml                             | 2 ++
 .github/workflows/developer-docs-consolidator.lock.yml     | 2 ++
 .github/workflows/dictation-prompt.lock.yml                | 2 ++
 .github/workflows/discussion-task-miner.lock.yml           | 2 ++
 .github/workflows/docs-noob-tester.lock.yml                | 2 ++
 .github/workflows/draft-pr-cleanup.lock.yml                | 2 ++
 .github/workflows/duplicate-code-detector.lock.yml         | 2 ++
 .github/workflows/example-custom-error-patterns.lock.yml   | 2 ++
 .github/workflows/example-permissions-warning.lock.yml     | 2 ++
 .github/workflows/example-workflow-analyzer.lock.yml       | 2 ++
 .github/workflows/firewall-escape.lock.yml                 | 2 ++
 .github/workflows/firewall.lock.yml                        | 2 ++
 .github/workflows/functional-pragmatist.lock.yml           | 2 ++
 .github/workflows/github-mcp-structural-analysis.lock.yml  | 2 ++
 .github/workflows/github-mcp-tools-report.lock.yml         | 2 ++
 .github/workflows/github-remote-mcp-auth-test.lock.yml     | 2 ++
 .github/workflows/glossary-maintainer.lock.yml             | 2 ++
 .github/workflows/go-fan.lock.yml                          | 2 ++
 .github/workflows/go-logger.lock.yml                       | 2 ++
 .github/workflows/go-pattern-detector.lock.yml             | 2 ++
 .github/workflows/grumpy-reviewer.lock.yml                 | 2 ++
 .github/workflows/hourly-ci-cleaner.lock.yml               | 2 ++
 .github/workflows/instructions-janitor.lock.yml            | 2 ++
 .github/workflows/issue-arborist.lock.yml                  | 2 ++
 .github/workflows/issue-classifier.lock.yml                | 2 ++
 .github/workflows/issue-monster.lock.yml                   | 2 ++
 .github/workflows/issue-triage-agent.lock.yml              | 2 ++
 .github/workflows/jsweep.lock.yml                          | 2 ++
 .github/workflows/layout-spec-maintainer.lock.yml          | 2 ++
 .github/workflows/lockfile-stats.lock.yml                  | 2 ++
 .github/workflows/mcp-inspector.lock.yml                   | 2 ++
 .github/workflows/mergefest.lock.yml                       | 2 ++
 .github/workflows/metrics-collector.lock.yml               | 2 ++
 .github/workflows/notion-issue-summary.lock.yml            | 2 ++
 .github/workflows/org-health-report.lock.yml               | 2 ++
 .github/workflows/pdf-summary.lock.yml                     | 2 ++
 .github/workflows/plan.lock.yml                            | 2 ++
 .github/workflows/poem-bot.lock.yml                        | 2 ++
 .github/workflows/portfolio-analyst.lock.yml               | 2 ++
 .github/workflows/pr-nitpick-reviewer.lock.yml             | 2 ++
 .github/workflows/pr-triage-agent.lock.yml                 | 2 ++
 .github/workflows/prompt-clustering-analysis.lock.yml      | 2 ++
 .github/workflows/python-data-charts.lock.yml              | 2 ++
 .github/workflows/q.lock.yml                               | 2 ++
 .github/workflows/release.lock.yml                         | 2 ++
 .github/workflows/repo-audit-analyzer.lock.yml             | 2 ++
 .github/workflows/repo-tree-map.lock.yml                   | 2 ++
 .github/workflows/repository-quality-improver.lock.yml     | 2 ++
 .github/workflows/research.lock.yml                        | 2 ++
 .github/workflows/safe-output-health.lock.yml              | 2 ++
 .github/workflows/schema-consistency-checker.lock.yml      | 2 ++
 .github/workflows/scout.lock.yml                           | 2 ++
 .github/workflows/secret-scanning-triage.lock.yml          | 2 ++
 .github/workflows/security-alert-burndown.lock.yml         | 2 ++
 .github/workflows/security-compliance.lock.yml             | 2 ++
 .github/workflows/security-fix-pr.lock.yml                 | 2 ++
 .github/workflows/security-guard.lock.yml                  | 2 ++
 .github/workflows/security-review.lock.yml                 | 2 ++
 .github/workflows/semantic-function-refactor.lock.yml      | 2 ++
 .github/workflows/sergo.lock.yml                           | 2 ++
 .github/workflows/slide-deck-maintainer.lock.yml           | 2 ++
 .github/workflows/smoke-claude.lock.yml                    | 2 ++
 .github/workflows/smoke-codex.lock.yml                     | 2 ++
 .github/workflows/smoke-copilot.lock.yml                   | 2 ++
 .github/workflows/smoke-opencode.lock.yml                  | 2 ++
 .github/workflows/smoke-test-tools.lock.yml                | 2 ++
 .github/workflows/stale-repo-identifier.lock.yml           | 2 ++
 .github/workflows/static-analysis-report.lock.yml          | 2 ++
 .github/workflows/step-name-alignment.lock.yml             | 2 ++
 .github/workflows/sub-issue-closer.lock.yml                | 2 ++
 .github/workflows/super-linter.lock.yml                    | 2 ++
 .github/workflows/technical-doc-writer.lock.yml            | 2 ++
 .github/workflows/terminal-stylist.lock.yml                | 2 ++
 .github/workflows/test-create-pr-error-handling.lock.yml   | 2 ++
 .github/workflows/test-project-url-default.lock.yml        | 2 ++
 .github/workflows/test-yaml-import.lock.yml                | 2 ++
 .github/workflows/tidy.lock.yml                            | 2 ++
 .github/workflows/typist.lock.yml                          | 2 ++
 .github/workflows/ubuntu-image-analyzer.lock.yml           | 2 ++
 .github/workflows/unbloat-docs.lock.yml                    | 2 ++
 .github/workflows/video-analyzer.lock.yml                  | 2 ++
 .github/workflows/weekly-issue-summary.lock.yml            | 2 ++
 .github/workflows/workflow-generator.lock.yml              | 2 ++
 .github/workflows/workflow-health-manager.lock.yml         | 2 ++
 .github/workflows/workflow-normalizer.lock.yml             | 2 ++
 .github/workflows/workflow-skill-extractor.lock.yml        | 2 ++
 pkg/workflow/compiler_yaml_helpers.go                      | 1 +
 146 files changed, 291 insertions(+)

diff --git a/.github/workflows/agent-performance-analyzer.lock.yml b/.github/workflows/agent-performance-analyzer.lock.yml
index e72fd036f01..cfed75d5431 100644
--- a/.github/workflows/agent-performance-analyzer.lock.yml
+++ b/.github/workflows/agent-performance-analyzer.lock.yml
@@ -57,6 +57,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/agent-persona-explorer.lock.yml b/.github/workflows/agent-persona-explorer.lock.yml
index 8b0b61be405..c0e91174c53 100644
--- a/.github/workflows/agent-persona-explorer.lock.yml
+++ b/.github/workflows/agent-persona-explorer.lock.yml
@@ -57,6 +57,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/ai-moderator.lock.yml b/.github/workflows/ai-moderator.lock.yml
index 6ce776d486e..2b3024dd71c 100644
--- a/.github/workflows/ai-moderator.lock.yml
+++ b/.github/workflows/ai-moderator.lock.yml
@@ -67,6 +67,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/archie.lock.yml b/.github/workflows/archie.lock.yml
index d52347f22df..7adaf071ab2 100644
--- a/.github/workflows/archie.lock.yml
+++ b/.github/workflows/archie.lock.yml
@@ -73,6 +73,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/artifacts-summary.lock.yml b/.github/workflows/artifacts-summary.lock.yml
index 5646f495db5..2c0de292081 100644
--- a/.github/workflows/artifacts-summary.lock.yml
+++ b/.github/workflows/artifacts-summary.lock.yml
@@ -56,6 +56,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/audit-workflows.lock.yml b/.github/workflows/audit-workflows.lock.yml
index adb2feded18..a8cad4b353b 100644
--- a/.github/workflows/audit-workflows.lock.yml
+++ b/.github/workflows/audit-workflows.lock.yml
@@ -58,6 +58,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/auto-triage-issues.lock.yml b/.github/workflows/auto-triage-issues.lock.yml
index 2dc74efdef8..f1fa232d1d7 100644
--- a/.github/workflows/auto-triage-issues.lock.yml
+++ b/.github/workflows/auto-triage-issues.lock.yml
@@ -61,6 +61,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/blog-auditor.lock.yml b/.github/workflows/blog-auditor.lock.yml
index f402590d5ad..018a79c78a1 100644
--- a/.github/workflows/blog-auditor.lock.yml
+++ b/.github/workflows/blog-auditor.lock.yml
@@ -55,6 +55,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/brave.lock.yml b/.github/workflows/brave.lock.yml
index 746f9d27b93..828ea02f033 100644
--- a/.github/workflows/brave.lock.yml
+++ b/.github/workflows/brave.lock.yml
@@ -65,6 +65,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/breaking-change-checker.lock.yml b/.github/workflows/breaking-change-checker.lock.yml
index 8af08ae4848..600d36c6736 100644
--- a/.github/workflows/breaking-change-checker.lock.yml
+++ b/.github/workflows/breaking-change-checker.lock.yml
@@ -53,6 +53,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/changeset.lock.yml b/.github/workflows/changeset.lock.yml
index cd66981d7ff..bc22c07cfd7 100644
--- a/.github/workflows/changeset.lock.yml
+++ b/.github/workflows/changeset.lock.yml
@@ -72,6 +72,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/chroma-issue-indexer.lock.yml b/.github/workflows/chroma-issue-indexer.lock.yml
index 53d537d388c..f78fd61e3f7 100644
--- a/.github/workflows/chroma-issue-indexer.lock.yml
+++ b/.github/workflows/chroma-issue-indexer.lock.yml
@@ -53,6 +53,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/ci-coach.lock.yml b/.github/workflows/ci-coach.lock.yml
index 63aaaa10a4b..d2ff1e65d85 100644
--- a/.github/workflows/ci-coach.lock.yml
+++ b/.github/workflows/ci-coach.lock.yml
@@ -57,6 +57,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/ci-doctor.lock.yml b/.github/workflows/ci-doctor.lock.yml
index 736dfabfd35..5fd1b996e20 100644
--- a/.github/workflows/ci-doctor.lock.yml
+++ b/.github/workflows/ci-doctor.lock.yml
@@ -65,6 +65,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/claude-code-user-docs-review.lock.yml b/.github/workflows/claude-code-user-docs-review.lock.yml
index ceae95ab339..a39deac62e9 100644
--- a/.github/workflows/claude-code-user-docs-review.lock.yml
+++ b/.github/workflows/claude-code-user-docs-review.lock.yml
@@ -51,6 +51,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/cli-consistency-checker.lock.yml b/.github/workflows/cli-consistency-checker.lock.yml
index e491fed64d3..87d765de148 100644
--- a/.github/workflows/cli-consistency-checker.lock.yml
+++ b/.github/workflows/cli-consistency-checker.lock.yml
@@ -50,6 +50,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/cli-version-checker.lock.yml b/.github/workflows/cli-version-checker.lock.yml
index 6c8066c7f0c..9140f4d5960 100644
--- a/.github/workflows/cli-version-checker.lock.yml
+++ b/.github/workflows/cli-version-checker.lock.yml
@@ -56,6 +56,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/cloclo.lock.yml b/.github/workflows/cloclo.lock.yml
index 7181d6c016a..f22b8b321fc 100644
--- a/.github/workflows/cloclo.lock.yml
+++ b/.github/workflows/cloclo.lock.yml
@@ -99,6 +99,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/code-scanning-fixer.lock.yml b/.github/workflows/code-scanning-fixer.lock.yml
index e2da1619b84..92e8424eb92 100644
--- a/.github/workflows/code-scanning-fixer.lock.yml
+++ b/.github/workflows/code-scanning-fixer.lock.yml
@@ -51,6 +51,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/code-simplifier.lock.yml b/.github/workflows/code-simplifier.lock.yml
index d0bd569123a..ddeba364a24 100644
--- a/.github/workflows/code-simplifier.lock.yml
+++ b/.github/workflows/code-simplifier.lock.yml
@@ -58,6 +58,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/codex-github-remote-mcp-test.lock.yml b/.github/workflows/codex-github-remote-mcp-test.lock.yml
index 4968ebe53fc..483564aaf6b 100644
--- a/.github/workflows/codex-github-remote-mcp-test.lock.yml
+++ b/.github/workflows/codex-github-remote-mcp-test.lock.yml
@@ -48,6 +48,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/commit-changes-analyzer.lock.yml b/.github/workflows/commit-changes-analyzer.lock.yml
index 0abab80c4c1..256f08eed3b 100644
--- a/.github/workflows/commit-changes-analyzer.lock.yml
+++ b/.github/workflows/commit-changes-analyzer.lock.yml
@@ -57,6 +57,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/copilot-agent-analysis.lock.yml b/.github/workflows/copilot-agent-analysis.lock.yml
index e77427bf9fa..7580802718a 100644
--- a/.github/workflows/copilot-agent-analysis.lock.yml
+++ b/.github/workflows/copilot-agent-analysis.lock.yml
@@ -57,6 +57,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/copilot-cli-deep-research.lock.yml b/.github/workflows/copilot-cli-deep-research.lock.yml
index d0c68f27f44..13e47ed0041 100644
--- a/.github/workflows/copilot-cli-deep-research.lock.yml
+++ b/.github/workflows/copilot-cli-deep-research.lock.yml
@@ -55,6 +55,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/copilot-pr-merged-report.lock.yml b/.github/workflows/copilot-pr-merged-report.lock.yml
index bef972a7812..6e728d428ab 100644
--- a/.github/workflows/copilot-pr-merged-report.lock.yml
+++ b/.github/workflows/copilot-pr-merged-report.lock.yml
@@ -55,6 +55,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/copilot-pr-nlp-analysis.lock.yml b/.github/workflows/copilot-pr-nlp-analysis.lock.yml
index 8eaad0934a2..5b7d5f3c8ce 100644
--- a/.github/workflows/copilot-pr-nlp-analysis.lock.yml
+++ b/.github/workflows/copilot-pr-nlp-analysis.lock.yml
@@ -57,6 +57,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/copilot-pr-prompt-analysis.lock.yml b/.github/workflows/copilot-pr-prompt-analysis.lock.yml
index a3da0fc541a..45a2d877321 100644
--- a/.github/workflows/copilot-pr-prompt-analysis.lock.yml
+++ b/.github/workflows/copilot-pr-prompt-analysis.lock.yml
@@ -57,6 +57,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/copilot-session-insights.lock.yml b/.github/workflows/copilot-session-insights.lock.yml
index fadf3987324..a4ffd467f61 100644
--- a/.github/workflows/copilot-session-insights.lock.yml
+++ b/.github/workflows/copilot-session-insights.lock.yml
@@ -60,6 +60,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/craft.lock.yml b/.github/workflows/craft.lock.yml
index 581db006336..6be738a93da 100644
--- a/.github/workflows/craft.lock.yml
+++ b/.github/workflows/craft.lock.yml
@@ -61,6 +61,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/daily-assign-issue-to-user.lock.yml b/.github/workflows/daily-assign-issue-to-user.lock.yml
index 3023b4cb985..0071bad1fda 100644
--- a/.github/workflows/daily-assign-issue-to-user.lock.yml
+++ b/.github/workflows/daily-assign-issue-to-user.lock.yml
@@ -50,6 +50,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/daily-choice-test.lock.yml b/.github/workflows/daily-choice-test.lock.yml
index c7098009e35..736d98ca59d 100644
--- a/.github/workflows/daily-choice-test.lock.yml
+++ b/.github/workflows/daily-choice-test.lock.yml
@@ -50,6 +50,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/daily-cli-performance.lock.yml b/.github/workflows/daily-cli-performance.lock.yml
index 52f3cd6abb0..37e586df92f 100644
--- a/.github/workflows/daily-cli-performance.lock.yml
+++ b/.github/workflows/daily-cli-performance.lock.yml
@@ -56,6 +56,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/daily-code-metrics.lock.yml b/.github/workflows/daily-code-metrics.lock.yml
index d24274b0f43..f212b4ab51e 100644
--- a/.github/workflows/daily-code-metrics.lock.yml
+++ b/.github/workflows/daily-code-metrics.lock.yml
@@ -57,6 +57,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/daily-compiler-quality.lock.yml b/.github/workflows/daily-compiler-quality.lock.yml
index 007246ac86d..015cad407e4 100644
--- a/.github/workflows/daily-compiler-quality.lock.yml
+++ b/.github/workflows/daily-compiler-quality.lock.yml
@@ -55,6 +55,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/daily-copilot-token-report.lock.yml b/.github/workflows/daily-copilot-token-report.lock.yml
index 6f59faaed76..86eee9254d8 100644
--- a/.github/workflows/daily-copilot-token-report.lock.yml
+++ b/.github/workflows/daily-copilot-token-report.lock.yml
@@ -55,6 +55,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/daily-doc-updater.lock.yml b/.github/workflows/daily-doc-updater.lock.yml
index 525a4615239..bcd997bbee9 100644
--- a/.github/workflows/daily-doc-updater.lock.yml
+++ b/.github/workflows/daily-doc-updater.lock.yml
@@ -51,6 +51,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/daily-file-diet.lock.yml b/.github/workflows/daily-file-diet.lock.yml
index f8b23032b3c..bd6b8d8805c 100644
--- a/.github/workflows/daily-file-diet.lock.yml
+++ b/.github/workflows/daily-file-diet.lock.yml
@@ -58,6 +58,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/daily-firewall-report.lock.yml b/.github/workflows/daily-firewall-report.lock.yml
index 78d10edbf31..e5f8bf344dc 100644
--- a/.github/workflows/daily-firewall-report.lock.yml
+++ b/.github/workflows/daily-firewall-report.lock.yml
@@ -57,6 +57,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/daily-issues-report.lock.yml b/.github/workflows/daily-issues-report.lock.yml
index 8d823fbe919..282c66c5a90 100644
--- a/.github/workflows/daily-issues-report.lock.yml
+++ b/.github/workflows/daily-issues-report.lock.yml
@@ -61,6 +61,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/daily-malicious-code-scan.lock.yml b/.github/workflows/daily-malicious-code-scan.lock.yml
index 7fb6f52f9d1..5c989dbcc95 100644
--- a/.github/workflows/daily-malicious-code-scan.lock.yml
+++ b/.github/workflows/daily-malicious-code-scan.lock.yml
@@ -55,6 +55,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/daily-multi-device-docs-tester.lock.yml b/.github/workflows/daily-multi-device-docs-tester.lock.yml
index 103f75cc6c0..233017affa4 100644
--- a/.github/workflows/daily-multi-device-docs-tester.lock.yml
+++ b/.github/workflows/daily-multi-device-docs-tester.lock.yml
@@ -61,6 +61,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/daily-news.lock.yml b/.github/workflows/daily-news.lock.yml
index 6c2beabf2fb..94549833127 100644
--- a/.github/workflows/daily-news.lock.yml
+++ b/.github/workflows/daily-news.lock.yml
@@ -58,6 +58,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/daily-observability-report.lock.yml b/.github/workflows/daily-observability-report.lock.yml
index 2ec86f37940..7034d05e314 100644
--- a/.github/workflows/daily-observability-report.lock.yml
+++ b/.github/workflows/daily-observability-report.lock.yml
@@ -57,6 +57,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/daily-performance-summary.lock.yml b/.github/workflows/daily-performance-summary.lock.yml
index e2dde2b48ec..af2715db2c1 100644
--- a/.github/workflows/daily-performance-summary.lock.yml
+++ b/.github/workflows/daily-performance-summary.lock.yml
@@ -57,6 +57,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/daily-regulatory.lock.yml b/.github/workflows/daily-regulatory.lock.yml
index 59c5307aaa9..066e910b7bd 100644
--- a/.github/workflows/daily-regulatory.lock.yml
+++ b/.github/workflows/daily-regulatory.lock.yml
@@ -56,6 +56,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/daily-repo-chronicle.lock.yml b/.github/workflows/daily-repo-chronicle.lock.yml
index 1f32abe2e8b..efa973c6f96 100644
--- a/.github/workflows/daily-repo-chronicle.lock.yml
+++ b/.github/workflows/daily-repo-chronicle.lock.yml
@@ -56,6 +56,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/daily-safe-output-optimizer.lock.yml b/.github/workflows/daily-safe-output-optimizer.lock.yml
index 03ff9440513..d7c7b9b02a5 100644
--- a/.github/workflows/daily-safe-output-optimizer.lock.yml
+++ b/.github/workflows/daily-safe-output-optimizer.lock.yml
@@ -60,6 +60,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/daily-secrets-analysis.lock.yml b/.github/workflows/daily-secrets-analysis.lock.yml
index f8f5e1a65a8..b38408a3607 100644
--- a/.github/workflows/daily-secrets-analysis.lock.yml
+++ b/.github/workflows/daily-secrets-analysis.lock.yml
@@ -55,6 +55,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/daily-semgrep-scan.lock.yml b/.github/workflows/daily-semgrep-scan.lock.yml
index dc7f85c14bd..2d0d90e8fd1 100644
--- a/.github/workflows/daily-semgrep-scan.lock.yml
+++ b/.github/workflows/daily-semgrep-scan.lock.yml
@@ -55,6 +55,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/daily-team-evolution-insights.lock.yml b/.github/workflows/daily-team-evolution-insights.lock.yml
index a52cac4638d..eb854babfd3 100644
--- a/.github/workflows/daily-team-evolution-insights.lock.yml
+++ b/.github/workflows/daily-team-evolution-insights.lock.yml
@@ -55,6 +55,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/daily-team-status.lock.yml b/.github/workflows/daily-team-status.lock.yml
index 4718f03b29e..dac045a3d92 100644
--- a/.github/workflows/daily-team-status.lock.yml
+++ b/.github/workflows/daily-team-status.lock.yml
@@ -64,6 +64,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/daily-testify-uber-super-expert.lock.yml b/.github/workflows/daily-testify-uber-super-expert.lock.yml
index 87cdce4b4ef..85c028dede5 100644
--- a/.github/workflows/daily-testify-uber-super-expert.lock.yml
+++ b/.github/workflows/daily-testify-uber-super-expert.lock.yml
@@ -59,6 +59,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/daily-workflow-updater.lock.yml b/.github/workflows/daily-workflow-updater.lock.yml
index d02ffb14689..6504f9725d0 100644
--- a/.github/workflows/daily-workflow-updater.lock.yml
+++ b/.github/workflows/daily-workflow-updater.lock.yml
@@ -51,6 +51,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/deep-report.lock.yml b/.github/workflows/deep-report.lock.yml
index c0bde060803..ab0422179e5 100644
--- a/.github/workflows/deep-report.lock.yml
+++ b/.github/workflows/deep-report.lock.yml
@@ -57,6 +57,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/delight.lock.yml b/.github/workflows/delight.lock.yml
index f9836a5f249..998ca2925f6 100644
--- a/.github/workflows/delight.lock.yml
+++ b/.github/workflows/delight.lock.yml
@@ -56,6 +56,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/dependabot-bundler.lock.yml b/.github/workflows/dependabot-bundler.lock.yml
index 3a021b1c5fc..2ad2297f3a8 100644
--- a/.github/workflows/dependabot-bundler.lock.yml
+++ b/.github/workflows/dependabot-bundler.lock.yml
@@ -51,6 +51,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/dependabot-burner.lock.yml b/.github/workflows/dependabot-burner.lock.yml
index a10273b5f9b..b11bd627a45 100644
--- a/.github/workflows/dependabot-burner.lock.yml
+++ b/.github/workflows/dependabot-burner.lock.yml
@@ -52,6 +52,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/dependabot-go-checker.lock.yml b/.github/workflows/dependabot-go-checker.lock.yml
index 684f70908dc..0bc6f7e9093 100644
--- a/.github/workflows/dependabot-go-checker.lock.yml
+++ b/.github/workflows/dependabot-go-checker.lock.yml
@@ -50,6 +50,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/dev-hawk.lock.yml b/.github/workflows/dev-hawk.lock.yml
index 059ce3f7683..910044be305 100644
--- a/.github/workflows/dev-hawk.lock.yml
+++ b/.github/workflows/dev-hawk.lock.yml
@@ -65,6 +65,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/dev.lock.yml b/.github/workflows/dev.lock.yml
index a5ef9207c8b..aab75383640 100644
--- a/.github/workflows/dev.lock.yml
+++ b/.github/workflows/dev.lock.yml
@@ -48,6 +48,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/developer-docs-consolidator.lock.yml b/.github/workflows/developer-docs-consolidator.lock.yml
index 4f24d5416dd..6e5c54026ae 100644
--- a/.github/workflows/developer-docs-consolidator.lock.yml
+++ b/.github/workflows/developer-docs-consolidator.lock.yml
@@ -55,6 +55,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/dictation-prompt.lock.yml b/.github/workflows/dictation-prompt.lock.yml
index 7b3156028e4..3632c853e85 100644
--- a/.github/workflows/dictation-prompt.lock.yml
+++ b/.github/workflows/dictation-prompt.lock.yml
@@ -54,6 +54,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/discussion-task-miner.lock.yml b/.github/workflows/discussion-task-miner.lock.yml
index 386ea8193c1..725eddc4401 100644
--- a/.github/workflows/discussion-task-miner.lock.yml
+++ b/.github/workflows/discussion-task-miner.lock.yml
@@ -56,6 +56,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/docs-noob-tester.lock.yml b/.github/workflows/docs-noob-tester.lock.yml
index 7d5d3650493..0fd5a726107 100644
--- a/.github/workflows/docs-noob-tester.lock.yml
+++ b/.github/workflows/docs-noob-tester.lock.yml
@@ -55,6 +55,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/draft-pr-cleanup.lock.yml b/.github/workflows/draft-pr-cleanup.lock.yml
index abc0d55686b..4c5b15d64e0 100644
--- a/.github/workflows/draft-pr-cleanup.lock.yml
+++ b/.github/workflows/draft-pr-cleanup.lock.yml
@@ -51,6 +51,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/duplicate-code-detector.lock.yml b/.github/workflows/duplicate-code-detector.lock.yml
index 6f628f38f3b..c1894f4e8b3 100644
--- a/.github/workflows/duplicate-code-detector.lock.yml
+++ b/.github/workflows/duplicate-code-detector.lock.yml
@@ -51,6 +51,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/example-custom-error-patterns.lock.yml b/.github/workflows/example-custom-error-patterns.lock.yml
index 18337382eb1..ea0c7255fa5 100644
--- a/.github/workflows/example-custom-error-patterns.lock.yml
+++ b/.github/workflows/example-custom-error-patterns.lock.yml
@@ -51,6 +51,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/example-permissions-warning.lock.yml b/.github/workflows/example-permissions-warning.lock.yml
index a168d13ab08..52495dec4b1 100644
--- a/.github/workflows/example-permissions-warning.lock.yml
+++ b/.github/workflows/example-permissions-warning.lock.yml
@@ -48,6 +48,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/example-workflow-analyzer.lock.yml b/.github/workflows/example-workflow-analyzer.lock.yml
index c98082345b0..c5e52a8f90b 100644
--- a/.github/workflows/example-workflow-analyzer.lock.yml
+++ b/.github/workflows/example-workflow-analyzer.lock.yml
@@ -55,6 +55,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/firewall-escape.lock.yml b/.github/workflows/firewall-escape.lock.yml
index 66a5af35d8a..b3e3894652c 100644
--- a/.github/workflows/firewall-escape.lock.yml
+++ b/.github/workflows/firewall-escape.lock.yml
@@ -61,6 +61,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/firewall.lock.yml b/.github/workflows/firewall.lock.yml
index 12d12c2ff0d..79a48ed8d49 100644
--- a/.github/workflows/firewall.lock.yml
+++ b/.github/workflows/firewall.lock.yml
@@ -48,6 +48,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/functional-pragmatist.lock.yml b/.github/workflows/functional-pragmatist.lock.yml
index c6c4d69b22f..552326ee75c 100644
--- a/.github/workflows/functional-pragmatist.lock.yml
+++ b/.github/workflows/functional-pragmatist.lock.yml
@@ -54,6 +54,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/github-mcp-structural-analysis.lock.yml b/.github/workflows/github-mcp-structural-analysis.lock.yml
index a02033a77e7..38317e6c499 100644
--- a/.github/workflows/github-mcp-structural-analysis.lock.yml
+++ b/.github/workflows/github-mcp-structural-analysis.lock.yml
@@ -55,6 +55,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/github-mcp-tools-report.lock.yml b/.github/workflows/github-mcp-tools-report.lock.yml
index 7770205bea0..51754405924 100644
--- a/.github/workflows/github-mcp-tools-report.lock.yml
+++ b/.github/workflows/github-mcp-tools-report.lock.yml
@@ -55,6 +55,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/github-remote-mcp-auth-test.lock.yml b/.github/workflows/github-remote-mcp-auth-test.lock.yml
index 49028ed8118..10f1b2ea9d7 100644
--- a/.github/workflows/github-remote-mcp-auth-test.lock.yml
+++ b/.github/workflows/github-remote-mcp-auth-test.lock.yml
@@ -51,6 +51,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/glossary-maintainer.lock.yml b/.github/workflows/glossary-maintainer.lock.yml
index 094b08f0ec2..c616c84751c 100644
--- a/.github/workflows/glossary-maintainer.lock.yml
+++ b/.github/workflows/glossary-maintainer.lock.yml
@@ -55,6 +55,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/go-fan.lock.yml b/.github/workflows/go-fan.lock.yml
index fe5c1070c94..312202672f2 100644
--- a/.github/workflows/go-fan.lock.yml
+++ b/.github/workflows/go-fan.lock.yml
@@ -54,6 +54,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/go-logger.lock.yml b/.github/workflows/go-logger.lock.yml
index ed85b87fd0a..4700cda37db 100644
--- a/.github/workflows/go-logger.lock.yml
+++ b/.github/workflows/go-logger.lock.yml
@@ -55,6 +55,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/go-pattern-detector.lock.yml b/.github/workflows/go-pattern-detector.lock.yml
index d13f313f314..72fa697096c 100644
--- a/.github/workflows/go-pattern-detector.lock.yml
+++ b/.github/workflows/go-pattern-detector.lock.yml
@@ -54,6 +54,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/grumpy-reviewer.lock.yml b/.github/workflows/grumpy-reviewer.lock.yml
index 657da3c22ce..9e8a8d57b81 100644
--- a/.github/workflows/grumpy-reviewer.lock.yml
+++ b/.github/workflows/grumpy-reviewer.lock.yml
@@ -66,6 +66,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/hourly-ci-cleaner.lock.yml b/.github/workflows/hourly-ci-cleaner.lock.yml
index 19ca29bd8fd..fc1ccb3822f 100644
--- a/.github/workflows/hourly-ci-cleaner.lock.yml
+++ b/.github/workflows/hourly-ci-cleaner.lock.yml
@@ -54,6 +54,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/instructions-janitor.lock.yml b/.github/workflows/instructions-janitor.lock.yml
index 6fad37d23b9..d4fd55bbc5e 100644
--- a/.github/workflows/instructions-janitor.lock.yml
+++ b/.github/workflows/instructions-janitor.lock.yml
@@ -51,6 +51,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/issue-arborist.lock.yml b/.github/workflows/issue-arborist.lock.yml
index f72d8783e04..8b32d86ce6a 100644
--- a/.github/workflows/issue-arborist.lock.yml
+++ b/.github/workflows/issue-arborist.lock.yml
@@ -55,6 +55,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/issue-classifier.lock.yml b/.github/workflows/issue-classifier.lock.yml
index 577e2100e4d..84b12f3aef7 100644
--- a/.github/workflows/issue-classifier.lock.yml
+++ b/.github/workflows/issue-classifier.lock.yml
@@ -61,6 +61,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/issue-monster.lock.yml b/.github/workflows/issue-monster.lock.yml
index fc9fa56eb41..91a24d24ff7 100644
--- a/.github/workflows/issue-monster.lock.yml
+++ b/.github/workflows/issue-monster.lock.yml
@@ -59,6 +59,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/issue-triage-agent.lock.yml b/.github/workflows/issue-triage-agent.lock.yml
index ba474e1e90f..717edbd2d45 100644
--- a/.github/workflows/issue-triage-agent.lock.yml
+++ b/.github/workflows/issue-triage-agent.lock.yml
@@ -53,6 +53,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/jsweep.lock.yml b/.github/workflows/jsweep.lock.yml
index d851dc5d863..944bae31de6 100644
--- a/.github/workflows/jsweep.lock.yml
+++ b/.github/workflows/jsweep.lock.yml
@@ -51,6 +51,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/layout-spec-maintainer.lock.yml b/.github/workflows/layout-spec-maintainer.lock.yml
index ea94451c349..41114e63faa 100644
--- a/.github/workflows/layout-spec-maintainer.lock.yml
+++ b/.github/workflows/layout-spec-maintainer.lock.yml
@@ -52,6 +52,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/lockfile-stats.lock.yml b/.github/workflows/lockfile-stats.lock.yml
index e0432d915af..2ec85e89c39 100644
--- a/.github/workflows/lockfile-stats.lock.yml
+++ b/.github/workflows/lockfile-stats.lock.yml
@@ -55,6 +55,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/mcp-inspector.lock.yml b/.github/workflows/mcp-inspector.lock.yml
index 65b6f703963..6de51c12e22 100644
--- a/.github/workflows/mcp-inspector.lock.yml
+++ b/.github/workflows/mcp-inspector.lock.yml
@@ -70,6 +70,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/mergefest.lock.yml b/.github/workflows/mergefest.lock.yml
index a8e1a9ef880..9de25b49a02 100644
--- a/.github/workflows/mergefest.lock.yml
+++ b/.github/workflows/mergefest.lock.yml
@@ -60,6 +60,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/metrics-collector.lock.yml b/.github/workflows/metrics-collector.lock.yml
index 3dc991ed1ed..9f14f671eb3 100644
--- a/.github/workflows/metrics-collector.lock.yml
+++ b/.github/workflows/metrics-collector.lock.yml
@@ -53,6 +53,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/notion-issue-summary.lock.yml b/.github/workflows/notion-issue-summary.lock.yml
index 5d7772d2ef5..34fbd62766f 100644
--- a/.github/workflows/notion-issue-summary.lock.yml
+++ b/.github/workflows/notion-issue-summary.lock.yml
@@ -57,6 +57,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/org-health-report.lock.yml b/.github/workflows/org-health-report.lock.yml
index b9f058455b3..f6f68b438d3 100644
--- a/.github/workflows/org-health-report.lock.yml
+++ b/.github/workflows/org-health-report.lock.yml
@@ -57,6 +57,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/pdf-summary.lock.yml b/.github/workflows/pdf-summary.lock.yml
index c910e7055ef..6dafbd49ee9 100644
--- a/.github/workflows/pdf-summary.lock.yml
+++ b/.github/workflows/pdf-summary.lock.yml
@@ -83,6 +83,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/plan.lock.yml b/.github/workflows/plan.lock.yml
index daab6345acb..c855782b68c 100644
--- a/.github/workflows/plan.lock.yml
+++ b/.github/workflows/plan.lock.yml
@@ -65,6 +65,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/poem-bot.lock.yml b/.github/workflows/poem-bot.lock.yml
index 7dc53f17b35..02a3e65d083 100644
--- a/.github/workflows/poem-bot.lock.yml
+++ b/.github/workflows/poem-bot.lock.yml
@@ -72,6 +72,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/portfolio-analyst.lock.yml b/.github/workflows/portfolio-analyst.lock.yml
index f59aafd7aab..c64e2b3da1e 100644
--- a/.github/workflows/portfolio-analyst.lock.yml
+++ b/.github/workflows/portfolio-analyst.lock.yml
@@ -58,6 +58,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/pr-nitpick-reviewer.lock.yml b/.github/workflows/pr-nitpick-reviewer.lock.yml
index 3142c6516b3..64347d38f28 100644
--- a/.github/workflows/pr-nitpick-reviewer.lock.yml
+++ b/.github/workflows/pr-nitpick-reviewer.lock.yml
@@ -92,6 +92,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/pr-triage-agent.lock.yml b/.github/workflows/pr-triage-agent.lock.yml
index 23eea6760a0..ffb2f5f3243 100644
--- a/.github/workflows/pr-triage-agent.lock.yml
+++ b/.github/workflows/pr-triage-agent.lock.yml
@@ -50,6 +50,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/prompt-clustering-analysis.lock.yml b/.github/workflows/prompt-clustering-analysis.lock.yml
index 8dac0d724e6..2e3a325b744 100644
--- a/.github/workflows/prompt-clustering-analysis.lock.yml
+++ b/.github/workflows/prompt-clustering-analysis.lock.yml
@@ -61,6 +61,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/python-data-charts.lock.yml b/.github/workflows/python-data-charts.lock.yml
index 3d3f328fcdc..aa1c0c69b6d 100644
--- a/.github/workflows/python-data-charts.lock.yml
+++ b/.github/workflows/python-data-charts.lock.yml
@@ -54,6 +54,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/q.lock.yml b/.github/workflows/q.lock.yml
index b55e931f292..a0efb038180 100644
--- a/.github/workflows/q.lock.yml
+++ b/.github/workflows/q.lock.yml
@@ -93,6 +93,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/release.lock.yml b/.github/workflows/release.lock.yml
index 4f42b9626d1..c6d69dffe1e 100644
--- a/.github/workflows/release.lock.yml
+++ b/.github/workflows/release.lock.yml
@@ -59,6 +59,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/repo-audit-analyzer.lock.yml b/.github/workflows/repo-audit-analyzer.lock.yml
index b38a9fe3f05..d5745bc3fbf 100644
--- a/.github/workflows/repo-audit-analyzer.lock.yml
+++ b/.github/workflows/repo-audit-analyzer.lock.yml
@@ -58,6 +58,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/repo-tree-map.lock.yml b/.github/workflows/repo-tree-map.lock.yml
index d1a7d06c115..f91add77709 100644
--- a/.github/workflows/repo-tree-map.lock.yml
+++ b/.github/workflows/repo-tree-map.lock.yml
@@ -55,6 +55,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/repository-quality-improver.lock.yml b/.github/workflows/repository-quality-improver.lock.yml
index 46050eb7165..b1fb3c3820b 100644
--- a/.github/workflows/repository-quality-improver.lock.yml
+++ b/.github/workflows/repository-quality-improver.lock.yml
@@ -54,6 +54,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/research.lock.yml b/.github/workflows/research.lock.yml
index 034080ac8fb..18fde5bfd2a 100644
--- a/.github/workflows/research.lock.yml
+++ b/.github/workflows/research.lock.yml
@@ -58,6 +58,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/safe-output-health.lock.yml b/.github/workflows/safe-output-health.lock.yml
index c501539f45d..7415c11b6db 100644
--- a/.github/workflows/safe-output-health.lock.yml
+++ b/.github/workflows/safe-output-health.lock.yml
@@ -57,6 +57,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/schema-consistency-checker.lock.yml b/.github/workflows/schema-consistency-checker.lock.yml
index cde923efb9a..d0b3371ddc9 100644
--- a/.github/workflows/schema-consistency-checker.lock.yml
+++ b/.github/workflows/schema-consistency-checker.lock.yml
@@ -55,6 +55,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/scout.lock.yml b/.github/workflows/scout.lock.yml
index 2fc85e1bf4b..0555a6262b8 100644
--- a/.github/workflows/scout.lock.yml
+++ b/.github/workflows/scout.lock.yml
@@ -108,6 +108,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/secret-scanning-triage.lock.yml b/.github/workflows/secret-scanning-triage.lock.yml
index 969857f7e8b..da2f2e2ee4a 100644
--- a/.github/workflows/secret-scanning-triage.lock.yml
+++ b/.github/workflows/secret-scanning-triage.lock.yml
@@ -52,6 +52,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/security-alert-burndown.lock.yml b/.github/workflows/security-alert-burndown.lock.yml
index 47ee6af4f18..39bf8af3fde 100644
--- a/.github/workflows/security-alert-burndown.lock.yml
+++ b/.github/workflows/security-alert-burndown.lock.yml
@@ -48,6 +48,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/security-compliance.lock.yml b/.github/workflows/security-compliance.lock.yml
index af62fa0de23..c9ce8e6f295 100644
--- a/.github/workflows/security-compliance.lock.yml
+++ b/.github/workflows/security-compliance.lock.yml
@@ -60,6 +60,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/security-fix-pr.lock.yml b/.github/workflows/security-fix-pr.lock.yml
index 4cfdc61506a..3cf970b3c9c 100644
--- a/.github/workflows/security-fix-pr.lock.yml
+++ b/.github/workflows/security-fix-pr.lock.yml
@@ -56,6 +56,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/security-guard.lock.yml b/.github/workflows/security-guard.lock.yml
index b0d47f48005..2e72db8b862 100644
--- a/.github/workflows/security-guard.lock.yml
+++ b/.github/workflows/security-guard.lock.yml
@@ -56,6 +56,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/security-review.lock.yml b/.github/workflows/security-review.lock.yml
index 9284e6acf3c..094b9617575 100644
--- a/.github/workflows/security-review.lock.yml
+++ b/.github/workflows/security-review.lock.yml
@@ -66,6 +66,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/semantic-function-refactor.lock.yml b/.github/workflows/semantic-function-refactor.lock.yml
index 09d9a9de668..f3bb82ca2f7 100644
--- a/.github/workflows/semantic-function-refactor.lock.yml
+++ b/.github/workflows/semantic-function-refactor.lock.yml
@@ -55,6 +55,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/sergo.lock.yml b/.github/workflows/sergo.lock.yml
index 4b42c4a97f9..17912dd7e0f 100644
--- a/.github/workflows/sergo.lock.yml
+++ b/.github/workflows/sergo.lock.yml
@@ -55,6 +55,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/slide-deck-maintainer.lock.yml b/.github/workflows/slide-deck-maintainer.lock.yml
index f286f766776..c02229d2855 100644
--- a/.github/workflows/slide-deck-maintainer.lock.yml
+++ b/.github/workflows/slide-deck-maintainer.lock.yml
@@ -58,6 +58,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml
index 0e136c80189..9b3ad95b9f3 100644
--- a/.github/workflows/smoke-claude.lock.yml
+++ b/.github/workflows/smoke-claude.lock.yml
@@ -74,6 +74,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/smoke-codex.lock.yml b/.github/workflows/smoke-codex.lock.yml
index e2460a5c414..1588526af41 100644
--- a/.github/workflows/smoke-codex.lock.yml
+++ b/.github/workflows/smoke-codex.lock.yml
@@ -71,6 +71,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml
index 1927f88a673..f098be0d5e1 100644
--- a/.github/workflows/smoke-copilot.lock.yml
+++ b/.github/workflows/smoke-copilot.lock.yml
@@ -70,6 +70,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/smoke-opencode.lock.yml b/.github/workflows/smoke-opencode.lock.yml
index e1e57450f37..3cf613e45ea 100644
--- a/.github/workflows/smoke-opencode.lock.yml
+++ b/.github/workflows/smoke-opencode.lock.yml
@@ -70,6 +70,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/smoke-test-tools.lock.yml b/.github/workflows/smoke-test-tools.lock.yml
index 0fe9adafa87..8fe00c90406 100644
--- a/.github/workflows/smoke-test-tools.lock.yml
+++ b/.github/workflows/smoke-test-tools.lock.yml
@@ -61,6 +61,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/stale-repo-identifier.lock.yml b/.github/workflows/stale-repo-identifier.lock.yml
index 70c819a71a1..cfcafd23899 100644
--- a/.github/workflows/stale-repo-identifier.lock.yml
+++ b/.github/workflows/stale-repo-identifier.lock.yml
@@ -65,6 +65,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/static-analysis-report.lock.yml b/.github/workflows/static-analysis-report.lock.yml
index eed9db45d4e..07633c99a37 100644
--- a/.github/workflows/static-analysis-report.lock.yml
+++ b/.github/workflows/static-analysis-report.lock.yml
@@ -56,6 +56,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/step-name-alignment.lock.yml b/.github/workflows/step-name-alignment.lock.yml
index 6ec925ea8c5..d055f891224 100644
--- a/.github/workflows/step-name-alignment.lock.yml
+++ b/.github/workflows/step-name-alignment.lock.yml
@@ -51,6 +51,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/sub-issue-closer.lock.yml b/.github/workflows/sub-issue-closer.lock.yml
index 8d115815a41..24319cb49a7 100644
--- a/.github/workflows/sub-issue-closer.lock.yml
+++ b/.github/workflows/sub-issue-closer.lock.yml
@@ -51,6 +51,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/super-linter.lock.yml b/.github/workflows/super-linter.lock.yml
index 2c35b4329e3..2e8211495fa 100644
--- a/.github/workflows/super-linter.lock.yml
+++ b/.github/workflows/super-linter.lock.yml
@@ -54,6 +54,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/technical-doc-writer.lock.yml b/.github/workflows/technical-doc-writer.lock.yml
index 05935113984..f8543b988ff 100644
--- a/.github/workflows/technical-doc-writer.lock.yml
+++ b/.github/workflows/technical-doc-writer.lock.yml
@@ -58,6 +58,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/terminal-stylist.lock.yml b/.github/workflows/terminal-stylist.lock.yml
index 7480245b4a2..55f9af4172e 100644
--- a/.github/workflows/terminal-stylist.lock.yml
+++ b/.github/workflows/terminal-stylist.lock.yml
@@ -51,6 +51,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/test-create-pr-error-handling.lock.yml b/.github/workflows/test-create-pr-error-handling.lock.yml
index 3aa85a8503b..dfe09dd0aa9 100644
--- a/.github/workflows/test-create-pr-error-handling.lock.yml
+++ b/.github/workflows/test-create-pr-error-handling.lock.yml
@@ -48,6 +48,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/test-project-url-default.lock.yml b/.github/workflows/test-project-url-default.lock.yml
index 2c683955c82..74fe28bc8fb 100644
--- a/.github/workflows/test-project-url-default.lock.yml
+++ b/.github/workflows/test-project-url-default.lock.yml
@@ -47,6 +47,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/test-yaml-import.lock.yml b/.github/workflows/test-yaml-import.lock.yml
index 82e115cc21d..36ac220fcf7 100644
--- a/.github/workflows/test-yaml-import.lock.yml
+++ b/.github/workflows/test-yaml-import.lock.yml
@@ -52,6 +52,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/tidy.lock.yml b/.github/workflows/tidy.lock.yml
index c4714f902a7..4edeaa01b95 100644
--- a/.github/workflows/tidy.lock.yml
+++ b/.github/workflows/tidy.lock.yml
@@ -72,6 +72,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/typist.lock.yml b/.github/workflows/typist.lock.yml
index 542a2d5c5d1..e009bc5ec2d 100644
--- a/.github/workflows/typist.lock.yml
+++ b/.github/workflows/typist.lock.yml
@@ -54,6 +54,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/ubuntu-image-analyzer.lock.yml b/.github/workflows/ubuntu-image-analyzer.lock.yml
index 6ec4f409d65..c12dcb86eb8 100644
--- a/.github/workflows/ubuntu-image-analyzer.lock.yml
+++ b/.github/workflows/ubuntu-image-analyzer.lock.yml
@@ -54,6 +54,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/unbloat-docs.lock.yml b/.github/workflows/unbloat-docs.lock.yml
index d1be7a42e1c..944c6e89218 100644
--- a/.github/workflows/unbloat-docs.lock.yml
+++ b/.github/workflows/unbloat-docs.lock.yml
@@ -69,6 +69,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/video-analyzer.lock.yml b/.github/workflows/video-analyzer.lock.yml
index 0a72bd36bb6..89e14188c2c 100644
--- a/.github/workflows/video-analyzer.lock.yml
+++ b/.github/workflows/video-analyzer.lock.yml
@@ -57,6 +57,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/weekly-issue-summary.lock.yml b/.github/workflows/weekly-issue-summary.lock.yml
index 77c13614c98..6cd526e696d 100644
--- a/.github/workflows/weekly-issue-summary.lock.yml
+++ b/.github/workflows/weekly-issue-summary.lock.yml
@@ -56,6 +56,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/workflow-generator.lock.yml b/.github/workflows/workflow-generator.lock.yml
index 76f6d65e817..177ff6a5e88 100644
--- a/.github/workflows/workflow-generator.lock.yml
+++ b/.github/workflows/workflow-generator.lock.yml
@@ -58,6 +58,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/workflow-health-manager.lock.yml b/.github/workflows/workflow-health-manager.lock.yml
index 1100df59526..f2256be521b 100644
--- a/.github/workflows/workflow-health-manager.lock.yml
+++ b/.github/workflows/workflow-health-manager.lock.yml
@@ -57,6 +57,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/workflow-normalizer.lock.yml b/.github/workflows/workflow-normalizer.lock.yml
index f0616ef4158..7b7963adf84 100644
--- a/.github/workflows/workflow-normalizer.lock.yml
+++ b/.github/workflows/workflow-normalizer.lock.yml
@@ -56,6 +56,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/.github/workflows/workflow-skill-extractor.lock.yml b/.github/workflows/workflow-skill-extractor.lock.yml
index bce2638654a..02ef1fdf373 100644
--- a/.github/workflows/workflow-skill-extractor.lock.yml
+++ b/.github/workflows/workflow-skill-extractor.lock.yml
@@ -55,6 +55,8 @@ jobs:
         with:
           sparse-checkout: |
             actions
+            .github
+          depth: 1
           persist-credentials: false
       - name: Setup Scripts
         uses: ./actions/setup
diff --git a/pkg/workflow/compiler_yaml_helpers.go b/pkg/workflow/compiler_yaml_helpers.go
index 3d7656fa9f6..487e18b9943 100644
--- a/pkg/workflow/compiler_yaml_helpers.go
+++ b/pkg/workflow/compiler_yaml_helpers.go
@@ -137,6 +137,7 @@ func (c *Compiler) generateCheckoutActionsFolder(data *WorkflowData) []string {
 			"        with:\n",
 			"          sparse-checkout: |\n",
 			"            actions\n",
+			"          depth: 1\n",
 			"          persist-credentials: false\n",
 		}
 	}