[ESS DA GA] Connect Workday Skill

[Surendra Goutham (is-goutham)]

Description

Adds  /connect workday  support for ESS DA agents, including architecture-aware routing, Workday extension package installation for HR and IT, Entra and Workday tenant configuration guidance, resumable validation, and honest configuration status reporting.

Also introduces safer per-agent lifecycle handling for existing CEA Workday integrations, including scoped validation, explicit publish approval, and rollback support.

Related issue

• N/A

Type of change

• Bug fix (non-breaking change which fixes an issue)
✓ New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
✓ Documentation update
✓ Refactor / cleanup

Testing

• Focused Connect Workday and FlightCheck tests: 96 passed
• Full test suite: 2,344 passed, 14 skipped
• The remaining 11 installer-related failures are pre-existing and reproducible on  main .

Checklist

✓ My code follows the existing style
✓ I have added/updated tests where applicable
✓ I have updated documentation as needed

Static validation (samples/ only)

Validation
• YAML parse: N/A
• AdaptiveDialog kind: N/A
• XML parse: N/A
• Filename convention (new): N/A
• Folder convention (new, incl. README.md): N/A
• Diff scope (samples/ only): N/A
• Secrets / internal URLs: N/A

[Copilot]

🟡 Changes recommended

Lifecycle regression handling, routing, readiness persistence, and Dataverse authorization contain blocking correctness and security issues.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds architecture-aware /connect workday support for ESS Declarative Agents and safer per-agent CEA lifecycle handling.

Changes:

• Adds DA HR Workday setup, validation, installation, and authorization workflows.
• Introduces resumable CEA lifecycle state, scoped validation, rollback, and publishing approval.
• Expands FlightCheck and automated tests for DA packages and active-agent scoping.

File summaries

File	Description
tests/setup/test_setup_router.py	Tests architecture-aware routing.
tests/scripts/test_install_workday_da_extension.py	Tests DA package installation.
tests/scripts/test_checkpoint.py	Tests named scoped rollback.
tests/flightcheck/test_cli.py	Tests DA scope isolation.
tests/flightcheck/test_cli_single_checkpoint.py	Tests config overlays and agent scoping.
tests/flightcheck/checks/test_workday_extension.py	Tests active-agent validation.
tests/flightcheck/checks/test_workday_da.py	Tests DA package checks.
tests/flightcheck/checks/test_entra_app.py	Tests architecture-specific Entra hints.
solutions/ess-maker-skills/src/skills/setup/workday-da/verify-connection.md	Defines final runtime validation.
solutions/ess-maker-skills/src/skills/setup/workday-da/tasks.md	Defines the DA checklist.
solutions/ess-maker-skills/src/skills/setup/workday-da/SKILL.md	Orchestrates DA Workday setup.
solutions/ess-maker-skills/src/skills/setup/workday-da/shared/permission-gate.md	Defines shared role gates.
solutions/ess-maker-skills/src/skills/setup/workday-da/shared/connection-fields.md	Defines connection-field validation.
solutions/ess-maker-skills/src/skills/setup/workday-da/shared/config-schema.md	Documents DA state schema.
solutions/ess-maker-skills/src/skills/setup/workday-da/shared/checklist-updater.md	Persists checklist progress.
solutions/ess-maker-skills/src/skills/setup/workday-da/provision-entra-app.md	Guides Entra provisioning.
solutions/ess-maker-skills/src/skills/setup/workday-da/install-extension.md	Guides DA package installation.
solutions/ess-maker-skills/src/skills/setup/workday-da/configure-tenant.md	Guides Workday tenant setup.
solutions/ess-maker-skills/src/skills/setup/workday-da/configure-power-platform.md	Guides Power Platform integration.
solutions/ess-maker-skills/src/skills/connect/workday/SKILL.md	Starts installed CEA lifecycle.
solutions/ess-maker-skills/src/skills/connect/workday/contract.json	Defines Workday lifecycle phases.
solutions/ess-maker-skills/src/skills/connect/workday/actions/wire-user-context-redirect.md	Wires and publishes user context.
solutions/ess-maker-skills/src/skills/connect/steps.md	Documents architecture routing.
solutions/ess-maker-skills/src/skills/connect/step1.md	Implements integration routing.
solutions/ess-maker-skills/src/skills/connect/SKILL.md	Documents connect dispatch.
solutions/ess-maker-skills/src/skills/connect/shared/lifecycle-runner.md	Implements resumable lifecycles.
solutions/ess-maker-skills/src/skills/connect/shared/lifecycle-contract-schema.md	Documents lifecycle contracts.
solutions/ess-maker-skills/scripts/install_workday_da_extension.py	Installs the DA extension package.
solutions/ess-maker-skills/scripts/flightcheck/registry.py	Registers the DA checkpoint.
solutions/ess-maker-skills/scripts/flightcheck/cli.py	Adds config and agent arguments.
solutions/ess-maker-skills/scripts/flightcheck/checks/workday_tenant.py	Generalizes provider config messaging.
solutions/ess-maker-skills/scripts/flightcheck/checks/workday_extension.py	Scopes checks to one agent.
solutions/ess-maker-skills/scripts/flightcheck/checks/workday_da.py	Validates DA package presence.
solutions/ess-maker-skills/scripts/flightcheck/checks/_workday_app_assignment.py	Isolates explicit provider overlays.
solutions/ess-maker-skills/scripts/checkpoint.py	Adds named, path-scoped restoration.
solutions/ess-maker-skills/scripts/alm/README.md	Documents target-environment authorization.
solutions/ess-maker-skills/scripts/alm/Enable-CosmosDAFlowAuthorization.ps1	Provisions Dataverse flow authorization.
solutions/ess-maker-skills/README.md	Documents DA Workday support.

Review details

Suppressed comments (1)

solutions/ess-maker-skills/scripts/alm/Enable-CosmosDAFlowAuthorization.ps1:278

• When the lookup returns multiple teams, this prints [FAIL] but leaves $ok true. If the first team has the requested shares, the script exits 0 even though the documented success condition requires exactly one team and Flow-RP will choose ambiguously. Mark every count other than one as a failed verification.

} else {
    Write-Fail "GetTeamsForBotId returned $($teamCheck.Count) teams; Flow-RP takes the first and expects exactly one"
    if ($teamCheck.Count -eq 0) { $ok = $false }

• Files reviewed: 38/38 changed files
• Comments generated: 10
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Surendra Goutham (is-goutham)]

Kept the Microsoft PowerShell file unchanged; setup now blocks missing authorization/team creation until a corrected script is available.