Fix review feedback: inline reset into activateEventSection, expand coverage, revert smoke if

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Author: Copilot

.github/workflows/smoke-claude-on-copilot.lock.yml

@@ -388,6 +388,50 @@ func TestCommentOutProcessedFieldsInOnSection(t *testing.T) {
   workflow_dispatch:`,
 			description: "Should reset bots array tracker before entering workflow_run section",
 		},
+		{
+			name: "bots before workflow_run with multi-line arrays do not comment workflow_run list items",
+			input: `on:
+  bots:
+    - dependabot
+  workflow_run:
+    workflows:
+      - CI
+    types:
+      - completed
+  workflow_dispatch:`,
+			expected: `on:
+  # bots: # Bots processed as bot check in pre-activation job
+    # - dependabot # Bots processed as bot check in pre-activation job
+  workflow_run:
+    workflows:
+      - CI
+    types:
+      - completed
+  workflow_dispatch:`,
+			description: "Should not comment out multi-line workflow_run.workflows/types items when bots precedes workflow_run",
+		},
+		{
+			name: "skip-if-check-failing before workflow_run does not corrupt workflow_run list items",
+			input: `on:
+  skip-if-check-failing:
+    - build
+  workflow_run:
+    workflows:
+      - CI
+    types:
+      - completed
+  workflow_dispatch:`,
+			expected: `on:
+  # skip-if-check-failing: # Skip-if-check-failing processed as check status gate in pre-activation job
+    # - build
+  workflow_run:
+    workflows:
+      - CI
+    types:
+      - completed
+  workflow_dispatch:`,
+			description: "Should reset inSkipIfCheckFailing before entering workflow_run to prevent list-item corruption",
+		},
 		{
 			name: "roles before workflow_run do not comment workflow_run list items",
 			input: `on:

pkg/workflow/compiler_draft_test.go

@@ -164,7 +164,28 @@ func (c *Compiler) commentOutProcessedFieldsInOnSection(yamlStr string, frontmat
 	deploymentStatusIndent := -1
 	workflowRunIndent := -1
 	// activateEventSection resets all event-section flags and then activates the selected section.
+	// It also clears every top-level on: extension-array tracker (inBotsArray, inRolesArray,
+	// inSkipIfCheckFailing, etc.) before entering the new section.  This reset is required
+	// because each activateEventSection call ends with "continue", which bypasses the
+	// indent-based deactivation logic further down the loop.  Without the explicit reset here,
+	// a stale flag from a preceding bots:/roles:/skip-if-check-failing: block would cause that
+	// section's list items (e.g. "workflow_run.workflows: - CI") to be incorrectly commented out.
 	activateEventSection := func(section string, indent int) {
+		// Clear all top-level on: extension-array state so no sibling section leaks in.
+		inSkipRolesArray = false
+		inSkipBotsArray = false
+		inRolesArray = false
+		inBotsArray = false
+		inLabelsArray = false
+		inNeedsArray = false
+		// These trackers share the same exit-check-ordering issue: their deactivation
+		// logic runs after the "continue" that terminates each activateEventSection call,
+		// so they must also be reset here explicitly.
+		inSkipIfMatch = false
+		inSkipIfNoMatch = false
+		inSkipIfCheckFailing = false
+		inSkipAuthorAssociations = false
+
 		inPullRequest = section == "pull_request"
 		inIssues = section == "issues"
 		inDiscussion = section == "discussion"
@@ -194,16 +215,6 @@ func (c *Compiler) commentOutProcessedFieldsInOnSection(yamlStr string, frontmat
 			workflowRunIndent = -1
 		}
 	}
-	// resetOnArrayTrackers clears top-level on: extension array state when a new
-	// event section starts, preventing sibling sections from inheriting stale flags.
-	resetOnArrayTrackers := func() {
-		inSkipRolesArray = false
-		inSkipBotsArray = false
-		inRolesArray = false
-		inBotsArray = false
-		inLabelsArray = false
-		inNeedsArray = false
-	}
 
 	for _, line := range lines {
 		trimmedLine := strings.TrimSpace(line)
@@ -216,37 +227,31 @@ func (c *Compiler) commentOutProcessedFieldsInOnSection(yamlStr string, frontmat
 		// the permission comment-out logic.
 		if !inOnPermissions && !inOnSteps && !inSkipAuthorAssociations {
 			if (lineIndent == 2 || lineIndent == 4) && trimmedLine == "pull_request:" {
-				resetOnArrayTrackers()
 				activateEventSection("pull_request", lineIndent)
 				result = append(result, line)
 				continue
 			}
 			if (lineIndent == 2 || lineIndent == 4) && trimmedLine == "issues:" {
-				resetOnArrayTrackers()
 				activateEventSection("issues", lineIndent)
 				result = append(result, line)
 				continue
 			}
 			if (lineIndent == 2 || lineIndent == 4) && trimmedLine == "discussion:" {
-				resetOnArrayTrackers()
 				activateEventSection("discussion", lineIndent)
 				result = append(result, line)
 				continue
 			}
 			if (lineIndent == 2 || lineIndent == 4) && trimmedLine == "issue_comment:" {
-				resetOnArrayTrackers()
 				activateEventSection("issue_comment", lineIndent)
 				result = append(result, line)
 				continue
 			}
 			if (lineIndent == 2 || lineIndent == 4) && trimmedLine == "deployment_status:" {
-				resetOnArrayTrackers()
 				activateEventSection("deployment_status", lineIndent)
 				result = append(result, line)
 				continue
 			}
 			if (lineIndent == 2 || lineIndent == 4) && trimmedLine == "workflow_run:" {
-				resetOnArrayTrackers()
 				activateEventSection("workflow_run", lineIndent)
 				result = append(result, line)
 				continue

pkg/workflow/frontmatter_extraction_yaml.go

@@ -123,13 +123,15 @@ Test workflow content.`,
 			name: "workflow_run with sibling bots - strict mode - should pass",
 			frontmatter: `---
 on:
+  bots:
+    - dependabot
   workflow_run:
-    workflows: ["build"]
-    types: [completed]
+    workflows:
+      - build
+    types:
+      - completed
     branches:
       - main
-  bots:
-    - dependabot
 tools:
   github:
     toolsets: [repos]
@@ -147,12 +149,14 @@ Test workflow content.`,
 			name: "workflow_run with sibling roles all - strict mode - should pass",
 			frontmatter: `---
 on:
+  roles: all
   workflow_run:
-    workflows: ["build"]
-    types: [completed]
+    workflows:
+      - build
+    types:
+      - completed
     branches:
       - main
-  roles: all
 tools:
   github:
     toolsets: [repos]