From 232cc8193c2abecb49cdcb93a985e95781c8a7b3 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 4 Jul 2026 04:21:27 +0000
Subject: [PATCH 1/4] Initial plan


From ab0bf61a4e798f0fb54bb75b2c5589439ae5b145 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 4 Jul 2026 04:34:12 +0000
Subject: [PATCH 2/4] Stop emitting deprecated artifact v3 pins

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 cmd/gh-aw/main.go                          |  2 +-
 pkg/cli/compile_compiler_setup.go          |  4 +-
 pkg/cli/compile_config.go                  |  2 +-
 pkg/parser/schemas/repo_config_schema.json |  2 +-
 pkg/workflow/action_pins.go                | 26 +---------
 pkg/workflow/action_pins_test.go           | 55 ++++++++++------------
 pkg/workflow/compiler.go                   |  2 +-
 pkg/workflow/compiler_types.go             |  6 +--
 pkg/workflow/repo_config.go                |  7 ++-
 9 files changed, 38 insertions(+), 68 deletions(-)

diff --git a/cmd/gh-aw/main.go b/cmd/gh-aw/main.go
index 75c58fddfc1..064c8782c90 100644
--- a/cmd/gh-aw/main.go
+++ b/cmd/gh-aw/main.go
@@ -752,7 +752,7 @@ Use "` + string(constants.CLIExtensionPrefix) + ` help all" to show help for all
 	compileCmd.Flags().Bool("validate-images", false, "Require Docker to be available for container image validation. Without this flag, container image validation is silently skipped when Docker is not installed or the daemon is not running")
 	compileCmd.Flags().Bool("no-models-dev-lookup", false, "Disable compile-time models.dev pricing lookup for models missing from the embedded catalog")
 	compileCmd.Flags().String("prior-manifest-file", "", "Path to a JSON file containing pre-cached gh-aw-manifests (map[lockFile]*GHAWManifest); used by the MCP server to supply a tamper-proof manifest baseline captured at startup")
-	compileCmd.Flags().Bool("ghes", false, "Enable GitHub Enterprise Server (GHES) compatibility mode: emit upload-artifact@v3 and download-artifact@v3 instead of the latest v7/v8 which are not supported on GHES. Overrides the aw.json ghes field")
+	compileCmd.Flags().Bool("ghes", false, "Enable GitHub Enterprise Server (GHES) compatibility mode. Artifact actions continue using latest non-v3 pins (v3 is deprecated). Overrides the aw.json ghes field")
 	if err := compileCmd.Flags().MarkHidden("prior-manifest-file"); err != nil {
 		// Non-fatal: flag is registered even if MarkHidden fails
 		_ = err
diff --git a/pkg/cli/compile_compiler_setup.go b/pkg/cli/compile_compiler_setup.go
index 0206a5da21d..66491b6a3e2 100644
--- a/pkg/cli/compile_compiler_setup.go
+++ b/pkg/cli/compile_compiler_setup.go
@@ -188,10 +188,10 @@ func configureCompilerFlags(compiler *workflow.Compiler, config CompileConfig) {
 	}
 
 	// Set GHES compatibility mode when the --ghes flag is passed.
-	// When enabled, the compiler emits v3.x artifact action pins for GHES compatibility.
+	// v3 artifact pins are deprecated, so artifact actions continue to use latest pins.
 	compiler.SetGHESCompat(config.GHESCompat)
 	if config.GHESCompat {
-		compileCompilerSetupLog.Print("GHES compatibility mode enabled via --ghes flag: artifact actions will use v3.x pins")
+		compileCompilerSetupLog.Print("GHES compatibility mode enabled via --ghes flag: artifact actions will use latest non-v3 pins")
 	}
 
 	// Load pre-cached manifests from file (written by MCP server at startup).
diff --git a/pkg/cli/compile_config.go b/pkg/cli/compile_config.go
index d22a6dc273c..90be6c42cbb 100644
--- a/pkg/cli/compile_config.go
+++ b/pkg/cli/compile_config.go
@@ -36,7 +36,7 @@ type CompileConfig struct {
 	Approve                bool     // Approve all safe update changes, skipping safe update enforcement regardless of strict mode setting.
 	ValidateImages         bool     // Require Docker to be available for container image validation (fail instead of skipping when Docker is unavailable)
 	PriorManifestFile      string   // Path to a JSON file containing pre-cached manifests (map[lockFile]*GHAWManifest) collected at MCP server startup; takes precedence over git HEAD / filesystem reads for safe update enforcement
-	GHESCompat             bool     // Enable GHES compatibility mode: emit v3.x artifact action pins instead of v7/v8 (overrides aw.json ghes field)
+	GHESCompat             bool     // Enable GHES compatibility mode (overrides aw.json ghes field); artifact actions still use latest non-v3 pins
 	DisableModelsDevLookup bool     // Disable compile-time models.dev pricing lookup for models missing from the embedded catalog
 }
 
diff --git a/pkg/parser/schemas/repo_config_schema.json b/pkg/parser/schemas/repo_config_schema.json
index 8c6b4390a61..89999cac369 100644
--- a/pkg/parser/schemas/repo_config_schema.json
+++ b/pkg/parser/schemas/repo_config_schema.json
@@ -20,7 +20,7 @@
       }
     },
     "ghes": {
-      "description": "Enable GitHub Enterprise Server (GHES) compatibility mode. When true, the compiler emits GHES-compatible artifact action versions (upload-artifact@v3, download-artifact@v3) instead of the latest v7/v8 which are not supported on GHES.",
+      "description": "Enable GitHub Enterprise Server (GHES) compatibility mode. Artifact actions continue to use latest non-v3 pins because upload-artifact/download-artifact v3 are deprecated.",
       "type": "boolean"
     },
     "help_command": {
diff --git a/pkg/workflow/action_pins.go b/pkg/workflow/action_pins.go
index 74dc64b991d..f6eefe34579 100644
--- a/pkg/workflow/action_pins.go
+++ b/pkg/workflow/action_pins.go
@@ -55,22 +55,6 @@ func extractActionVersion(uses string) string {
 	return actionpins.ExtractVersion(uses)
 }
 
-// ghesArtifactPin holds the version tag and commit SHA for a GHES-compatible artifact action pin.
-type ghesArtifactPin struct {
-	version string
-	sha     string
-}
-
-// ghesArtifactCompatPins contains hardcoded GHES-compatible artifact action pins.
-// These are the highest v3.x releases that avoid the @actions/artifact v2.0.0+
-// GHES incompatibility (validated against GHES 3.19.1 per gh-aw#29551).
-// Hardcoded because action_pins.json is auto-generated by `make recompile` and
-// only tracks the latest versions — v3.x entries would be stripped.
-var ghesArtifactCompatPins = map[string]ghesArtifactPin{
-	"actions/upload-artifact":   {version: "v3.2.2", sha: "c6a366c94c3e0affe28c06c8df20a878f24da3cf"},
-	"actions/download-artifact": {version: "v3.1.0", sha: "a9bc5e6ef2cb54c177f32aa5726adaa15e7e2d59"},
-}
-
 // getActionPin returns the pinned reference for the latest version of the repo
 // using only the embedded pins (no WorkflowData required).
 func getActionPin(repo string) string {
@@ -82,8 +66,7 @@ func getActionPin(repo string) string {
 	return actionpins.FormatPinnedActionReference(repo, pins[0].SHA, pins[0].Version)
 }
 
-// getActionPin returns the pinned reference for the given repo, using GHES-compatible
-// v3.x pins for artifact actions when c.ghesArtifactCompat is true.
+// getActionPin returns the pinned reference for the given repo.
 //
 // This is the preferred call site for code running inside a Compiler method, since it
 // automatically honours the per-compilation GHES compat flag without any global state.
@@ -92,13 +75,6 @@ func getActionPin(repo string) string {
 // any existing entry and mark it as "used" for orphan pruning. This ensures compiler-generated
 // action references (e.g., actions/cache/save in notify steps) are tracked.
 func (c *Compiler) getActionPin(repo string) string {
-	if c.ghesArtifactCompat {
-		if pin, ok := ghesArtifactCompatPins[repo]; ok {
-			actionPinsLog.Printf("GHES compat: using %s@%s instead of latest", repo, pin.version)
-			return actionpins.FormatPinnedActionReference(repo, pin.sha, pin.version)
-		}
-	}
-
 	// Check the cache for any existing entry for this repo (regardless of version).
 	// Compiler-generated actions don't specify versions, so prefer a cached entry only
 	// when it is at least as new as the latest embedded pin.
diff --git a/pkg/workflow/action_pins_test.go b/pkg/workflow/action_pins_test.go
index 90cd365c495..26319cf9dbd 100644
--- a/pkg/workflow/action_pins_test.go
+++ b/pkg/workflow/action_pins_test.go
@@ -1576,7 +1576,7 @@ func TestSliceToStepsErrorHandling(t *testing.T) {
 	}
 }
 
-// TestGetActionPinGHESArtifactCompat tests that GHES artifact compat mode returns v3 pins
+// TestGetActionPinGHESArtifactCompat verifies GHES compat mode does not emit deprecated v3 artifact pins.
 func TestGetActionPinGHESArtifactCompat(t *testing.T) {
 	// Verify default (compat disabled) returns latest (v7/v8)
 	defaultCompiler := NewCompiler()
@@ -1607,19 +1607,19 @@ func TestGetActionPinGHESArtifactCompat(t *testing.T) {
 	compatCompiler.ghesArtifactCompat = true
 
 	uploadPinGHES := compatCompiler.getActionPin("actions/upload-artifact")
-	if !strings.Contains(uploadPinGHES, "# v3.2.2") {
-		t.Errorf("With GHES compat, expected upload-artifact v3.2.2, got: %s", uploadPinGHES)
+	if strings.Contains(uploadPinGHES, "# v3") {
+		t.Errorf("With GHES compat, expected non-v3 upload-artifact pin, got: %s", uploadPinGHES)
 	}
-	if !strings.Contains(uploadPinGHES, "c6a366c94c3e0affe28c06c8df20a878f24da3cf") {
-		t.Errorf("With GHES compat, expected upload-artifact v3.2.2 SHA, got: %s", uploadPinGHES)
+	if uploadPinGHES != uploadPin {
+		t.Errorf("With GHES compat, expected upload-artifact pin to match default, default=%s compat=%s", uploadPin, uploadPinGHES)
 	}
 
 	downloadPinGHES := compatCompiler.getActionPin("actions/download-artifact")
-	if !strings.Contains(downloadPinGHES, "# v3.1.0") {
-		t.Errorf("With GHES compat, expected download-artifact v3.1.0, got: %s", downloadPinGHES)
+	if strings.Contains(downloadPinGHES, "# v3") {
+		t.Errorf("With GHES compat, expected non-v3 download-artifact pin, got: %s", downloadPinGHES)
 	}
-	if !strings.Contains(downloadPinGHES, "a9bc5e6ef2cb54c177f32aa5726adaa15e7e2d59") {
-		t.Errorf("With GHES compat, expected download-artifact v3.1.0 SHA, got: %s", downloadPinGHES)
+	if downloadPinGHES != downloadPin {
+		t.Errorf("With GHES compat, expected download-artifact pin to match default, default=%s compat=%s", downloadPin, downloadPinGHES)
 	}
 
 	// Non-artifact actions should be unaffected by GHES compat
@@ -1629,20 +1629,19 @@ func TestGetActionPinGHESArtifactCompat(t *testing.T) {
 	}
 }
 
-// TestGHESArtifactCompatReset tests that two Compiler instances with different compat
-// settings return different pins, confirming state is per-instance, not global.
+// TestGHESArtifactCompatReset tests that toggling compat mode does not leak state.
 func TestGHESArtifactCompatReset(t *testing.T) {
 	// Default compiler returns latest pin
 	defaultCompiler := NewCompiler()
 	defaultPin := defaultCompiler.getActionPin("actions/upload-artifact")
 
-	// Compat compiler returns v3 pin
+	// Compat compiler should return the same non-deprecated pin as default.
 	compatCompiler := NewCompiler()
 	compatCompiler.ghesArtifactCompat = true
 	compatPin := compatCompiler.getActionPin("actions/upload-artifact")
 
-	if defaultPin == compatPin {
-		t.Error("GHES compat pin should differ from default pin")
+	if defaultPin != compatPin {
+		t.Error("GHES compat pin should match default pin")
 	}
 
 	// Default compiler is unchanged after compat compiler was used
@@ -1651,24 +1650,20 @@ func TestGHESArtifactCompatReset(t *testing.T) {
 	}
 }
 
-// TestGHESArtifactCompatPinsExist verifies that the hardcoded GHES compat pins are valid.
-func TestGHESArtifactCompatPinsExist(t *testing.T) {
+// TestGHESArtifactCompatDoesNotUseV3 verifies GHES compat mode never emits deprecated v3 artifact pins.
+func TestGHESArtifactCompatDoesNotUseV3(t *testing.T) {
 	c := NewCompiler()
 	c.ghesArtifactCompat = true
-	for repo, pin := range ghesArtifactCompatPins {
-		if pin.sha == "" {
-			t.Errorf("ghesArtifactCompatPins[%s] has empty SHA", repo)
-		}
-		if pin.version == "" {
-			t.Errorf("ghesArtifactCompatPins[%s] has empty version", repo)
-		}
-		result := c.getActionPin(repo)
-		if result == "" {
-			t.Errorf("getActionPin(%s) returned empty with GHES compat enabled", repo)
-		}
-		if !strings.Contains(result, pin.sha) {
-			t.Errorf("getActionPin(%s) did not contain expected SHA %s, got: %s", repo, pin.sha, result)
-		}
+	for _, repo := range []string{"actions/upload-artifact", "actions/download-artifact"} {
+		t.Run(repo, func(t *testing.T) {
+			result := c.getActionPin(repo)
+			if result == "" {
+				t.Errorf("getActionPin(%s) returned empty with GHES compat enabled", repo)
+			}
+			if strings.Contains(result, "# v3") {
+				t.Errorf("getActionPin(%s) should not return a v3 pin, got: %s", repo, result)
+			}
+		})
 	}
 }
 
diff --git a/pkg/workflow/compiler.go b/pkg/workflow/compiler.go
index 1d3c3ad1927..74b97945feb 100644
--- a/pkg/workflow/compiler.go
+++ b/pkg/workflow/compiler.go
@@ -442,7 +442,7 @@ func (c *Compiler) CompileWorkflowData(workflowData *WorkflowData, markdownPath
 		}
 	}
 	if c.ghesArtifactCompat {
-		actionPinsLog.Print("GHES artifact compatibility mode enabled: artifact actions will use v3.x pins")
+		actionPinsLog.Print("GHES artifact compatibility mode enabled: using latest artifact action pins (v3 pins are deprecated)")
 	}
 
 	// Generate lock file name
diff --git a/pkg/workflow/compiler_types.go b/pkg/workflow/compiler_types.go
index 8a57eb3f565..c3f58d28c21 100644
--- a/pkg/workflow/compiler_types.go
+++ b/pkg/workflow/compiler_types.go
@@ -105,7 +105,7 @@ type Compiler struct {
 	priorManifests          map[string]*GHAWManifest // Pre-cached manifests keyed by lock file path; takes precedence over git HEAD / filesystem reads
 	requireDocker           bool                     // If true, fail validation when Docker is not available instead of silently skipping
 	ghesCompatFromCLI       bool                     // If true, GHES compat was requested via --ghes CLI flag (takes precedence over aw.json)
-	ghesArtifactCompat      bool                     // If true, emit GHES-compatible v3.x pins for artifact actions instead of the latest v7/v8
+	ghesArtifactCompat      bool                     // If true, GHES compatibility mode is enabled; artifact actions still use latest non-v3 pins
 	ownerTypeCache          map[string]string        // Cached GitHub owner type ("User"/"Organization"/"") keyed by owner login; not goroutine-safe (Compiler is used sequentially)
 	copilotRequestsTipShown map[string]bool          // Tracks markdown paths that already emitted the copilot-requests enable tip in this compiler instance
 	// modelPricingResolver is an optional callback for resolving per-token pricing of models that
@@ -242,8 +242,8 @@ func (c *Compiler) SetAllowActionRefs(allow bool) {
 }
 
 // SetGHESCompat enables GHES artifact compatibility mode via the --ghes CLI flag.
-// When true, the compiler emits GHES-compatible v3.x artifact action pins
-// (upload-artifact@v3, download-artifact@v3) instead of the latest v7/v8.
+// v3 artifact actions are deprecated, so artifact actions continue using the
+// latest non-v3 pins.
 // This flag takes precedence over the aw.json ghes field.
 func (c *Compiler) SetGHESCompat(enabled bool) {
 	c.ghesCompatFromCLI = enabled
diff --git a/pkg/workflow/repo_config.go b/pkg/workflow/repo_config.go
index 12694937476..7263f565677 100644
--- a/pkg/workflow/repo_config.go
+++ b/pkg/workflow/repo_config.go
@@ -7,7 +7,7 @@
 // Configuration reference:
 //
 //	{
-//	  "ghes": true,               // enables GHES compatibility mode (v3 artifact pins)
+//	  "ghes": true,               // enables GHES compatibility mode (artifact pins remain latest non-v3)
 //	  "help_command": false,      // disables builtin centralized /help comment handler
 //	  "utc": "-08:00", // project home UTC offset for rendered local times
 //	  "auto_upgrade": true, // set to true to generate agentic-auto-upgrade.yml with weekly schedule
@@ -115,9 +115,8 @@ func (m *MaintenanceConfig) IsLabelTriggerEnabled() bool {
 // RepoConfig is the parsed representation of aw.json.
 type RepoConfig struct {
 	// GHES enables GitHub Enterprise Server compatibility mode.
-	// When true, the compiler emits GHES-compatible artifact action versions
-	// (upload-artifact@v3, download-artifact@v3) instead of the latest v7/v8
-	// which are not supported on GHES.
+	// When true, the compiler enables GHES compatibility behavior. Artifact actions
+	// continue to use latest non-v3 pins because v3 artifact actions are deprecated.
 	GHES bool
 
 	// UTC is the project's home UTC offset used for rendering local times in CLI output.

From 930b2d437bcf2bf9735948c865507df6e1a27219 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 4 Jul 2026 07:54:21 +0000
Subject: [PATCH 3/4] docs: align GHES compatibility wording and drop
 tautological test

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
---
 .../reference/enterprise-configuration.md     |  6 +++---
 .../docs/reference/self-hosted-runners.md     |  6 +++---
 pkg/workflow/action_pins.go                   |  4 ++--
 pkg/workflow/action_pins_test.go              | 21 -------------------
 pkg/workflow/compiler.go                      |  2 +-
 pkg/workflow/compiler_types.go                |  2 +-
 6 files changed, 10 insertions(+), 31 deletions(-)

diff --git a/docs/src/content/docs/reference/enterprise-configuration.md b/docs/src/content/docs/reference/enterprise-configuration.md
index 0310ceee195..fc7be49d6ee 100644
--- a/docs/src/content/docs/reference/enterprise-configuration.md
+++ b/docs/src/content/docs/reference/enterprise-configuration.md
@@ -1,6 +1,6 @@
 ---
 title: Enterprise Configuration
-description: Configure GitHub Agentic Workflows for GitHub Enterprise Server (GHES) and GitHub Enterprise Cloud (GHEC), including artifact compatibility and CLI setup.
+description: Configure GitHub Agentic Workflows for GitHub Enterprise Server (GHES) and GitHub Enterprise Cloud (GHEC), including GHES compatibility mode and CLI setup.
 sidebar:
   order: 51
 ---
@@ -11,11 +11,11 @@ This page covers configuration options specific to GitHub Enterprise Server (GHE
 
 ## GitHub Enterprise Server (GHES) Compatibility
 
-### Artifact Compatibility Mode
+### GHES Compatibility Mode
 
 GHES instances running versions that predate `@actions/artifact` v2.0.0 support cannot use `actions/upload-artifact@v4+` or `actions/download-artifact@v4+`. Attempting to run compiled workflows on these instances produces a `GHESNotSupportedError`.
 
-gh-aw includes a GHES compatibility mode that instructs the compiler to emit `upload-artifact@v3.2.2` and `download-artifact@v3.1.0` instead of the latest v4+ versions.
+gh-aw includes a GHES compatibility mode for GHES-specific compile behavior. Artifact actions continue using the latest non-v3 pins because v3 artifact actions are deprecated.
 
 #### Enable via `aw.json` (recommended)
 
diff --git a/docs/src/content/docs/reference/self-hosted-runners.md b/docs/src/content/docs/reference/self-hosted-runners.md
index af58648b0ce..f3e8cf43218 100644
--- a/docs/src/content/docs/reference/self-hosted-runners.md
+++ b/docs/src/content/docs/reference/self-hosted-runners.md
@@ -197,11 +197,11 @@ Self-hosted runners need outbound HTTPS access to:
 
 Agentic workflows can run on GHES with some additional configuration.
 
-### Artifact compatibility
+### GHES compatibility mode
 
 GHES does not support the `@actions/artifact` v2.0.0+ backend used by `upload-artifact@v4+` and `download-artifact@v4+`. Compiled workflows use the latest artifact action versions by default, which fail on GHES with `GHESNotSupportedError`.
 
-Enable GHES compatibility mode in `.github/workflows/aw.json` to use compatible v3.x artifact actions:
+Enable GHES compatibility mode in `.github/workflows/aw.json` for GHES-specific compile behavior:
 
 ```json
 {
@@ -215,7 +215,7 @@ Or compile with `--ghes` for one-off workflow generation:
 gh aw compile --ghes my-workflow.md
 ```
 
-This makes the compiler emit `upload-artifact@v3.2.2` and `download-artifact@v3.1.0` instead of the latest versions, which are compatible with all GHES versions.
+Artifact actions continue using the latest non-v3 pins because v3 artifact actions are deprecated.
 
 ### API endpoint
 
diff --git a/pkg/workflow/action_pins.go b/pkg/workflow/action_pins.go
index f6eefe34579..a33d87e821b 100644
--- a/pkg/workflow/action_pins.go
+++ b/pkg/workflow/action_pins.go
@@ -68,8 +68,8 @@ func getActionPin(repo string) string {
 
 // getActionPin returns the pinned reference for the given repo.
 //
-// This is the preferred call site for code running inside a Compiler method, since it
-// automatically honours the per-compilation GHES compat flag without any global state.
+// This is the preferred call site for code running inside a Compiler method because it
+// reuses the compiler's shared cache/resolver and marks cached pins as used for pruning.
 //
 // If the compiler has an action cache and resolver, this method will check the cache for
 // any existing entry and mark it as "used" for orphan pruning. This ensures compiler-generated
diff --git a/pkg/workflow/action_pins_test.go b/pkg/workflow/action_pins_test.go
index 26319cf9dbd..5942bbdbc14 100644
--- a/pkg/workflow/action_pins_test.go
+++ b/pkg/workflow/action_pins_test.go
@@ -1629,27 +1629,6 @@ func TestGetActionPinGHESArtifactCompat(t *testing.T) {
 	}
 }
 
-// TestGHESArtifactCompatReset tests that toggling compat mode does not leak state.
-func TestGHESArtifactCompatReset(t *testing.T) {
-	// Default compiler returns latest pin
-	defaultCompiler := NewCompiler()
-	defaultPin := defaultCompiler.getActionPin("actions/upload-artifact")
-
-	// Compat compiler should return the same non-deprecated pin as default.
-	compatCompiler := NewCompiler()
-	compatCompiler.ghesArtifactCompat = true
-	compatPin := compatCompiler.getActionPin("actions/upload-artifact")
-
-	if defaultPin != compatPin {
-		t.Error("GHES compat pin should match default pin")
-	}
-
-	// Default compiler is unchanged after compat compiler was used
-	if defaultCompiler.getActionPin("actions/upload-artifact") != defaultPin {
-		t.Error("Default compiler pin changed after compat compiler was used — state leaked")
-	}
-}
-
 // TestGHESArtifactCompatDoesNotUseV3 verifies GHES compat mode never emits deprecated v3 artifact pins.
 func TestGHESArtifactCompatDoesNotUseV3(t *testing.T) {
 	c := NewCompiler()
diff --git a/pkg/workflow/compiler.go b/pkg/workflow/compiler.go
index 74b97945feb..0e9561bc8ba 100644
--- a/pkg/workflow/compiler.go
+++ b/pkg/workflow/compiler.go
@@ -442,7 +442,7 @@ func (c *Compiler) CompileWorkflowData(workflowData *WorkflowData, markdownPath
 		}
 	}
 	if c.ghesArtifactCompat {
-		actionPinsLog.Print("GHES artifact compatibility mode enabled: using latest artifact action pins (v3 pins are deprecated)")
+		actionPinsLog.Print("GHES compatibility mode enabled: artifact actions continue using latest non-v3 pins")
 	}
 
 	// Generate lock file name
diff --git a/pkg/workflow/compiler_types.go b/pkg/workflow/compiler_types.go
index c3f58d28c21..2b6e1af03da 100644
--- a/pkg/workflow/compiler_types.go
+++ b/pkg/workflow/compiler_types.go
@@ -241,7 +241,7 @@ func (c *Compiler) SetAllowActionRefs(allow bool) {
 	c.allowActionRefs = allow
 }
 
-// SetGHESCompat enables GHES artifact compatibility mode via the --ghes CLI flag.
+// SetGHESCompat enables GHES compatibility mode via the --ghes CLI flag.
 // v3 artifact actions are deprecated, so artifact actions continue using the
 // latest non-v3 pins.
 // This flag takes precedence over the aw.json ghes field.

From ff58f4d545b2237b8924d5d0f0e86539289c6341 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 4 Jul 2026 07:58:58 +0000
Subject: [PATCH 4/4] docs: clarify GHES mode wording in references

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
---
 docs/src/content/docs/reference/enterprise-configuration.md | 2 +-
 docs/src/content/docs/reference/self-hosted-runners.md      | 2 +-
 pkg/workflow/compiler_types.go                              | 5 ++---
 3 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/docs/src/content/docs/reference/enterprise-configuration.md b/docs/src/content/docs/reference/enterprise-configuration.md
index fc7be49d6ee..79567fb8c9b 100644
--- a/docs/src/content/docs/reference/enterprise-configuration.md
+++ b/docs/src/content/docs/reference/enterprise-configuration.md
@@ -15,7 +15,7 @@ This page covers configuration options specific to GitHub Enterprise Server (GHE
 
 GHES instances running versions that predate `@actions/artifact` v2.0.0 support cannot use `actions/upload-artifact@v4+` or `actions/download-artifact@v4+`. Attempting to run compiled workflows on these instances produces a `GHESNotSupportedError`.
 
-gh-aw includes a GHES compatibility mode for GHES-specific compile behavior. Artifact actions continue using the latest non-v3 pins because v3 artifact actions are deprecated.
+gh-aw includes a GHES compatibility mode toggle (`aw.json` `ghes` or `gh aw compile --ghes`) so GHES-targeted repositories can compile with explicit GHES mode enabled. Artifact actions continue using the latest non-v3 pins because v3 artifact actions are deprecated.
 
 #### Enable via `aw.json` (recommended)
 
diff --git a/docs/src/content/docs/reference/self-hosted-runners.md b/docs/src/content/docs/reference/self-hosted-runners.md
index f3e8cf43218..e3658f498f6 100644
--- a/docs/src/content/docs/reference/self-hosted-runners.md
+++ b/docs/src/content/docs/reference/self-hosted-runners.md
@@ -201,7 +201,7 @@ Agentic workflows can run on GHES with some additional configuration.
 
 GHES does not support the `@actions/artifact` v2.0.0+ backend used by `upload-artifact@v4+` and `download-artifact@v4+`. Compiled workflows use the latest artifact action versions by default, which fail on GHES with `GHESNotSupportedError`.
 
-Enable GHES compatibility mode in `.github/workflows/aw.json` for GHES-specific compile behavior:
+Enable GHES compatibility mode in `.github/workflows/aw.json` to compile with GHES mode explicitly enabled:
 
 ```json
 {
diff --git a/pkg/workflow/compiler_types.go b/pkg/workflow/compiler_types.go
index 2b6e1af03da..03e9557df45 100644
--- a/pkg/workflow/compiler_types.go
+++ b/pkg/workflow/compiler_types.go
@@ -242,9 +242,8 @@ func (c *Compiler) SetAllowActionRefs(allow bool) {
 }
 
 // SetGHESCompat enables GHES compatibility mode via the --ghes CLI flag.
-// v3 artifact actions are deprecated, so artifact actions continue using the
-// latest non-v3 pins.
-// This flag takes precedence over the aw.json ghes field.
+// It overrides the aw.json ghes field for the current compilation run.
+// Artifact actions still use the latest non-v3 pins.
 func (c *Compiler) SetGHESCompat(enabled bool) {
 	c.ghesCompatFromCLI = enabled
 }