A team adds a reusable validation workflow for Copilot-generated pull requests. The workflow should upload logs on failure, avoid publishing secrets, and keep the required check failed when validation fails. Evaluate the following statements. 1. The workflow uploads diagnostics when validation fails. 2. Printing the environment is safe because secrets are masked. 3. The final step helps preserve a failed required check.

name: validate-agent-output

on:
  pull_request:
    branches:
      - main

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    env:
      API_TOKEN: ${{ secrets.TEST_API_TOKEN }}
    steps:
      - uses: actions/checkout@v4

         - name: Run validation
           id: validation
           run: |
             mkdir -p diagnostics
             npm ci
             npm test 2>&1 | tee diagnostics/output.log

         - name: Upload diagnostics
           if: failure()
           uses: actions/upload-artifact@v4
           with:
             name: validation-diagnostics
             path: diagnostics/

         - name: Print environment for debugging
           if: failure()
           run: env | sort

         - name: Preserve failure
           if: steps.validation.outcome == 'failure'
           run: exit 1