[plan] Extend SkipHardcodedFallback to detect GHE host from defaultGHHost and git remote

[github-actions]

Problem

The SkipHardcodedFallback field in PinContext prevents the compiler from silently falling back to potentially unverified bundled action pins when the dynamic resolver (which queries github.com) fails.

However, the current detection in pkg/workflow/compiler_types.go's PinContext() method only checks os.Getenv("GH_HOST"):

if ghHost := os.Getenv("GH_HOST"); ghHost != "" && ghHost != "github.com" {
    pinCtx.SkipHardcodedFallback = true
}

This misses two cases where the tool is effectively targeting a GHE host:

1. SetDefaultGHHost was called (e.g., by the add command after auto-detecting a GHE git remote), but GH_HOST env var is unset.
2. The git remote URL points to a GHE host but neither GH_HOST env var nor SetDefaultGHHost is set (fresh invocation of compile without any host config).

In these cases, SkipHardcodedFallback is not set, so a dynamic-resolution failure silently falls back to hardcoded pins.

Related issue: #39792

Fix

Extend PinContext() in pkg/workflow/compiler_types.go to also check getDefaultGHHost() (the value set via SetDefaultGHHost). If the effective host is non-empty and is not github.com, set SkipHardcodedFallback = true.

Implementation approach

// Existing check
if ghHost := os.Getenv("GH_HOST"); ghHost != "" && ghHost != "github.com" {
    pinCtx.SkipHardcodedFallback = true
}
// New: also check the programmatically-configured default host
if defaultHost := getDefaultGHHost(); defaultHost != "" && defaultHost != "github.com" {
    pinCtx.SkipHardcodedFallback = true
}

Note: after the companion fix (forcing github.com in resolveFromGitHub), dynamic resolution should succeed on GHE hosts. This check is defense-in-depth: if github.com is unreachable, the tool correctly refuses to emit unverified pins rather than silently using bundled fallbacks.

Files to modify

• pkg/workflow/compiler_types.go — add getDefaultGHHost() check in PinContext()
• pkg/workflow/compiler_types_test.go — add test case for the SetDefaultGHHost-set scenario

Acceptance criteria

• PinContext() sets SkipHardcodedFallback = true when SetDefaultGHHost was called with a non-github.com host, even if GH_HOST env var is unset
• PinContext() does not set SkipHardcodedFallback when SetDefaultGHHost was called with github.com
• Existing GH_HOST env var tests still pass
• Existing tests still pass (make agent-report-progress)

Generated by 📋 Plan Command · ◷
_{Comment /plan to run again}

• expires on Jun 19, 2026, 10:26 PM UTC-08:00