Compiler v0.67.3 pins runtime setup action to v0.67.1, leaving stale entries in actions-lock.json

[deyaaeldeen]

Summary

After running gh aw update and gh aw compile with gh-aw v0.67.3, the actions-lock.json file ends up with two entries for github/gh-aw-actions/setup:

• v0.67.1 — the runtime version the compiler hardcodes into compiled .lock.yml files
• v0.67.3 — added by gh aw update but never referenced by any compiled workflow

"github/gh-aw-actions/setup@v0.67.1": {
  "sha": "80471a493be8c528dd27daf73cd644242a7965e0"
},
"github/gh-aw-actions/setup@v0.67.3": {
  "sha": "eef369c24101e76a5bf51579c26798b28f666813"
}

Steps to reproduce

1. gh aw update — updates compiler to v0.67.3, adds v0.67.3 entries to actions-lock.json
2. gh aw compile — compiles all workflows, but emits v0.67.1 SHA pins in .lock.yml files, re-adding v0.67.1 to actions-lock.json
3. Result: two versions of the same action in the lock file, with the "latest" one unused

Manually removing the v0.67.1 entry and recompiling does not help — the compiler re-adds it.

Expected behavior

The compiler should either:

• Pin the same version it was updated to (v0.67.3) in compiled output, or
• gh aw update should not add an entry for a version that the compiler will not use, or
• gh aw compile should prune stale/unreferenced entries from actions-lock.json

Environment

• gh-aw version: v0.67.3
• Repository: Azure/azure-sdk-for-js