Investigate and harden PureLock coverage safe-output pathing for PR #55077

[Copilot]

The update-code-coverage (upload_code_coverage) safe output in the PureLock flow failed because coverage output was written to a runner temp location that was read-only in this execution context. This change updates PureLock’s coverage artifact handoff to use a writable path and an explicit absolute file reference.

• Root cause identified

  • PureLock instructions directed Cobertura output to $RUNNER_TEMP/gh-aw/safeoutputs/upload-code-coverage/, which was not writable in the failing runtime.

• Workflow instruction update

  • Updated .github/workflows/purelock.md to generate cobertura.xml under /tmp/gh-aw/purelock/.
  • Updated the safe-output call contract to pass file: "/tmp/gh-aw/purelock/cobertura.xml".

• Compiled workflow alignment

  • Recompiled .github/workflows/purelock.lock.yml so generated workflow behavior matches the updated markdown source.

mkdir -p /tmp/gh-aw/purelock
go test ./<unique-succeeded-package-dir>/... -count=1 -covermode=atomic -coverprofile=/tmp/gh-aw/purelock/generated-tests.out
"$(go env GOPATH)/bin/gocover-cobertura" < /tmp/gh-aw/purelock/generated-tests.out > /tmp/gh-aw/purelock/cobertura.xml
# safe output payload: file="/tmp/gh-aw/purelock/cobertura.xml"

[Copilot]

Pull request overview

Moves PureLock coverage output to a writable temporary path and updates its safe-output reference.

Changes:

• Writes Cobertura output under /tmp/gh-aw/purelock.
• Refreshes compiled workflow metadata.

Show a summary per file

File	Description
.github/workflows/purelock.md	Updates coverage generation and upload path.
.github/workflows/purelock.lock.yml	Updates the generated body hash.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.87.5