[WIP] Ensure updates are pushing to other orgs and repos by Copilot · Pull Request #5 · BlackRoad-OS/.github

Copilot · 2026-01-27T20:58:56Z

Implementation Plan: Test & Ensure Updates Push to Orgs

Understanding

This repository (.github) is a central coordination hub for 15 BlackRoad organizations. The implementation adds:

Mechanism to push updates TO other org repositories
Tests to validate sync functionality
Automated PR merge to main

Implementation Checklist

Original prompt

lets actually be testing and ensuring that updates here are actually pushing to the other orgs and repos and once you submit the pull request ensure it hits main

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Co-authored-by: blackboxprogramming <118287761+blackboxprogramming@users.noreply.github.com>

.github/workflows/auto-merge.yml

+            PR_NUMBER="${{ github.event.pull_request.number }}"
+          elif [ "${{ github.event_name }}" == "workflow_run" ]; then
+            # Extract PR number from workflow run
+            PR_NUMBER=$(gh pr list --json number,headRefName --jq '.[] | select(.headRefName=="${{ github.event.workflow_run.head_branch }}") | .number' | head -1)


In general, to fix this type of problem in GitHub Actions, you should avoid using ${{ ... }} expressions with untrusted values directly inside run: scripts. Instead, pass the value into the step via env: and then consume it using the shell’s variable expansion syntax (e.g., $HEAD_BRANCH) or via process.env in JavaScript. This ensures that the shell does not reinterpret the value as code, regardless of its contents.

For this specific workflow, the risky part is line 41:

PR_NUMBER=$(gh pr list --json number,headRefName --jq '.[] | select(.headRefName=="${{ github.event.workflow_run.head_branch }}") | .number' | head -1)

The best fix that preserves existing functionality is:

Add an environment variable (e.g., HEAD_BRANCH) to this step, assigned from ${{ github.event.workflow_run.head_branch }}.

Update the run: script to reference $HEAD_BRANCH inside the jq filter, using shell variable expansion, while preserving the required quoting so that jq receives the correct string and the branch name is not interpreted as code.

Concretely:

Extend the env: block in the “Get PR info” step with HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}.

Change the PR_NUMBER assignment to use $HEAD_BRANCH instead of an inlined ${{ ... }}. Because the script is single-quoted with an internal double-quoted jq string, the safest approach is to break out of single quotes just around the $HEAD_BRANCH reference: first build the jq filter in a shell variable using proper quoting, then pass that variable to gh pr list --jq.

All changes are within .github/workflows/auto-merge.yml, in the shown step.

.github/workflows/auto-merge.yml

+      - name: Check merge conditions
+        id: check
+        run: |
+          STATE="${{ steps.pr.outputs.state }}"


To fix this, we should stop using GitHub expression syntax (${{ ... }}) directly inside the shell script body for values that originate from workflow inputs/outputs. Instead, we should bind those values to environment variables at the step level (env:) and then reference them using standard shell variable expansion (e.g., $STATE) inside the script. This aligns with GitHub’s guidance and breaks the taint flow into the shell command parser.

Concretely, for the “Check merge conditions” step (lines 67–87), we will:

Add an env: section that maps STATE, MERGEABLE, and REVIEW_DECISION to ${{ steps.pr.outputs.state }}, ${{ steps.pr.outputs.mergeable }}, and ${{ steps.pr.outputs.review_decision }} respectively.

Simplify the run: script so it relies solely on $STATE, $MERGEABLE, and $REVIEW_DECISION, removing the inline ${{ ... }} assignments in the script body.

No other steps need modification to address this particular alert, and this change preserves existing behavior: the variables in the script will contain exactly the same values as before, but are populated in a safer way by the runner rather than the shell parsing interpolated expressions.

.github/workflows/auto-merge.yml

+        id: check
+        run: |
+          STATE="${{ steps.pr.outputs.state }}"
+          MERGEABLE="${{ steps.pr.outputs.mergeable }}"


In general, to fix this class of problems in GitHub Actions, any untrusted or potentially untrusted data that needs to be used in a shell script should be assigned to an environment variable at the workflow level (using ${{ ... }} only in the env: mapping), and then referenced inside the script using the shell’s own variable syntax ($VAR), not ${{ env.VAR }} or similar expression syntax.

For this workflow, the problematic use is in the “Check merge conditions” step, where the script begins with:

run: | STATE="${{ steps.pr.outputs.state }}" MERGEABLE="${{ steps.pr.outputs.mergeable }}" REVIEW_DECISION="${{ steps.pr.outputs.review_decision }}"

The safest fix, without altering behavior, is:

Add an env: section to that step, mapping:

STATE: ${{ steps.pr.outputs.state }}

MERGEABLE: ${{ steps.pr.outputs.mergeable }}

REVIEW_DECISION: ${{ steps.pr.outputs.review_decision }}

Remove the three assignment lines inside the run: block and instead rely on those environment variables directly ($STATE, $MERGEABLE, $REVIEW_DECISION) everywhere in the script, which is already the case for subsequent references.

This keeps functionality identical (the variables have the same names and contents) while complying with the recommended pattern: untrusted values are injected only into environment variables via expressions, and the shell script reads them with native syntax. No additional imports or external dependencies are required, and no other steps need to change.

.github/workflows/auto-merge.yml

+        run: |
+          STATE="${{ steps.pr.outputs.state }}"
+          MERGEABLE="${{ steps.pr.outputs.mergeable }}"
+          REVIEW_DECISION="${{ steps.pr.outputs.review_decision }}"


General approach: Avoid using ${{ steps.pr.outputs.review_decision }} directly inside the run: script. Instead, pass the value into the step via env: and use standard shell variable expansion ($REVIEW_DECISION) within the script. This aligns with the recommended pattern of copying untrusted expressions into environment variables and only using native shell syntax in the command body.

Concrete fix for this workflow:

In the Check merge conditions step (lines 67–96), add an env: section that maps a new environment variable (e.g., STATE, MERGEABLE, REVIEW_DECISION) from the step outputs:
REVIEW_DECISION: ${{ steps.pr.outputs.review_decision }}.

In the run: script of that same step, stop reassigning these variables using ${{ ... }}. Instead, rely on the environment variables already populated by env:. So remove or simplify the lines:

STATE="${{ steps.pr.outputs.state }}" MERGEABLE="${{ steps.pr.outputs.mergeable }}" REVIEW_DECISION="${{ steps.pr.outputs.review_decision }}"

and use $STATE, $MERGEABLE, and $REVIEW_DECISION directly.

No other steps need to change, because the CodeQL alert is specific to ${{ steps.pr.outputs.review_decision }} at line 72.

This preserves behavior (the logic still checks the same values) while ensuring no GitHub Actions expressions are present inside the actual shell script body.

.github/workflows/auto-merge.yml

+          echo "🎯 Auto-merge Summary"
+          echo ""
+          echo "PR: #${{ steps.pr.outputs.pr_number }}"
+          echo "State: ${{ steps.pr.outputs.state }}"


General fix approach: avoid using ${{ ... }} directly inside shell scripts for values derived from external data. Instead, assign those expression values to environment variables in the step configuration (env:) and then reference them in the script using the shell’s native $VAR syntax.

Best concrete fix here: in the Summary step, move all ${{ steps.* }} and ${{ job.status }} references out of the run: body into env: variables, then reference them with $VAR inside the script. This removes the vulnerable pattern and also addresses any related variants (not only state but pr_number, can_merge, job.status) in one place.

Specifically, in .github/workflows/auto-merge.yml:

For the Summary step (lines 124–132), add an env: section with variables like SUMMARY_PR_NUMBER, SUMMARY_STATE, SUMMARY_CAN_MERGE, and SUMMARY_JOB_STATUS, each assigned from the corresponding ${{ ... }} expression.

Update the run: block to echo using $SUMMARY_PR_NUMBER, $SUMMARY_STATE, $SUMMARY_CAN_MERGE, and $SUMMARY_JOB_STATUS instead of interpolated expressions.
No new methods or imports are required; this is purely a YAML/workflow configuration change.

.github/workflows/sync-to-orgs.yml

Co-authored-by: blackboxprogramming <118287761+blackboxprogramming@users.noreply.github.com>

…ocumentation Co-authored-by: blackboxprogramming <118287761+blackboxprogramming@users.noreply.github.com>

.github/workflows/auto-merge.yml

Co-authored-by: blackboxprogramming <118287761+blackboxprogramming@users.noreply.github.com>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 46f5a4b8ef

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-01-31T12:42:14Z

.github/workflows/auto-merge.yml

+          if [ -z "$PR_NUMBER" ]; then
+            echo "No PR number found for branch ${{ github.event.workflow_run.head_branch }}"
+            exit 1


Guard workflow_run when no PR exists

On workflow_run events, CI also runs for direct pushes to main/develop (see .github/workflows/ci.yml on.push.branches), so there is often no associated PR. In that case PR_NUMBER will be empty and this step exits 1, causing the auto-merge workflow to fail on every push/merge to those branches. Consider skipping the job when github.event.workflow_run.pull_requests is empty or explicitly gating workflow_run to PR-triggered runs to avoid persistent failures.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-01-31T12:42:14Z

.github/workflows/auto-merge.yml

+          if [ "$STATE" == "OPEN" ] && \
+             [ "$MERGEABLE" == "MERGEABLE" ] && \
+             [ "$REVIEW_DECISION" == "APPROVED" ]; then


Enforce base branch before auto-merge

The merge gate only checks state, mergeable, and reviewDecision and never verifies the PR’s base branch. Because CI also runs on develop, an approved PR targeting develop will satisfy these checks and be auto-merged, despite the workflow’s stated intent to merge only to main. Add a base-branch condition (e.g., github.event.pull_request.base.ref == 'main' or equivalent for workflow_run) to prevent unintended merges to non-main branches.

Useful? React with 👍 / 👎.

Copilot

Pull request overview

This PR implements a comprehensive sync system to push updates from the central .github repository (The Bridge) to other BlackRoad organization repositories. The implementation adds automated sync workflows, comprehensive testing, auto-merge functionality, and documentation.

Changes:

Adds sync-to-orgs workflow that dispatches repository events to active organization repositories
Implements auto-merge workflow to automatically merge approved PRs after CI passes
Integrates sync testing into the CI pipeline
Provides comprehensive documentation and receiver workflow templates

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
tests/test_sync.py	Test suite validating sync workflow configuration and registry structure
tests/test_integration.py	End-to-end integration test simulating the complete sync flow
.github/workflows/sync-to-orgs.yml	Main workflow dispatching sync events to target organization repositories
.github/workflows/auto-merge.yml	Workflow automating PR merges after approval and successful CI
.github/workflows/ci.yml	Updated CI pipeline including sync functionality tests
templates/workflows/sync-receiver.yml	Template workflow for target repositories to receive and process sync events
docs/SYNC.md	Comprehensive documentation covering sync architecture, usage, and troubleshooting
README.md	Updated overview with sync features and quick start instructions

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

.github/workflows/sync-to-orgs.yml

.github/workflows/auto-merge.yml

Copilot · 2026-01-31T12:46:50Z

.github/workflows/auto-merge.yml

+            echo "No PR number found for branch ${{ github.event.workflow_run.head_branch }}"
+            exit 1


The workflow will fail with "exit 1" when no PR number is found for a branch in workflow_run events. However, this is normal behavior when CI runs on direct commits to main (not from a PR). The workflow should handle this case gracefully by exiting early without error, rather than failing the entire workflow. Consider checking if this is a PR-related run before attempting to find the PR number, or exit with success (exit 0) when no PR is found.

Suggested change

echo "No PR number found for branch ${{ github.event.workflow_run.head_branch }}"

exit 1

if [ "${{ github.event_name }}" == "workflow_run" ]; then

echo "No PR number found for branch ${{ github.event.workflow_run.head_branch }}; this workflow_run is not associated with a PR. Exiting successfully."

exit 0

else

echo "No PR number found for event type: ${{ github.event_name }}"

exit 1

fi

.github/workflows/auto-merge.yml

templates/workflows/sync-receiver.yml

tests/test_sync.py

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

tests/test_integration.py

.github/workflows/sync-to-orgs.yml

tests/test_sync.py

.github/workflows/auto-merge.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 8 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-27T18:36:30Z

tests/test_sync.py

+        # Should trigger on push to main
+        if "push" in triggers:
+            branches = triggers["push"].get("branches", [])


If the workflow YAML ever omits the push trigger entirely, this test won't record an error because it only validates branches when "push" in triggers. Consider adding an else path that calls self.error(...) when the push trigger is missing so regressions are caught.

Copilot · 2026-02-27T18:36:30Z

templates/workflows/sync-receiver.yml

+  sync:
+    name: Sync Updates
+    runs-on: ubuntu-latest
+


This template pushes commits back to the default branch, but it doesn't request contents: write permissions. In repos/orgs where the default GITHUB_TOKEN permission is read-only, the git push step will fail. Add explicit workflow/job permissions: contents: write (and keep pull-requests etc. off unless needed).

Suggested change

permissions:

contents: write

Copilot · 2026-02-27T18:36:31Z

.github/workflows/sync-to-orgs.yml

+          # Output for next steps
+          with open('$GITHUB_OUTPUT', 'a') as f:
+              f.write(f'orgs={json.dumps(orgs)}\\n')


In this Python step, open('$GITHUB_OUTPUT', 'a') writes to a literal file named $GITHUB_OUTPUT rather than the Actions output file path. As a result, steps.registry.outputs.orgs will be empty and the dispatch step will likely fail when it tries to json.loads the missing/empty env var. Use the GITHUB_OUTPUT environment variable (e.g., via os.environ['GITHUB_OUTPUT']) or write the output from the shell instead.

Copilot · 2026-02-27T18:36:31Z

.github/workflows/sync-to-orgs.yml

+
+      - name: Dispatch to target orgs
+        env:
+          GITHUB_TOKEN: ${{ secrets.DISPATCH_TOKEN || secrets.GITHUB_TOKEN }}


secrets.GITHUB_TOKEN is repository-scoped and typically cannot call repository_dispatch on other repositories (even within the same org). Falling back to it will make sync appear configured but fail at runtime; consider requiring DISPATCH_TOKEN (fail fast if missing) or only using the fallback when dispatching to the current repo.

Suggested change

GITHUB_TOKEN: ${{ secrets.DISPATCH_TOKEN || secrets.GITHUB_TOKEN }}

GITHUB_TOKEN: ${{ secrets.DISPATCH_TOKEN }}

Copilot · 2026-02-27T18:36:31Z

.github/workflows/sync-to-orgs.yml

+          if failures:
+              print(f'⚠️  {len(failures)} dispatch(es) failed:')
+              for failure in failures:
+                  print(f'  - {failure}')
+              print('')


The dispatch script collects failures but never exits non-zero when dispatches fail, so the workflow can report success even when nothing was synced. Consider failing the job when failures is non-empty (and potentially exempting dry_run) so broken dispatches surface immediately.

Copilot · 2026-02-27T18:36:31Z

.github/workflows/auto-merge.yml

+    if: |
+      (github.event_name == 'pull_request_review' && github.event.review.state == 'approved') ||
+      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
+


The job condition runs on any successful workflow_run of CI, including CI runs triggered by direct pushes to main/develop (where there is no PR). That will cause this workflow to error (no PR found) and may also risk selecting the wrong PR when matching by branch name. Gate workflow_run handling to PR-triggered runs only (e.g., require github.event.workflow_run.event == 'pull_request' and/or a non-empty workflow_run.pull_requests list), and ensure the PR targets main before enabling auto-merge.

Copilot · 2026-02-27T18:36:31Z

.github/workflows/auto-merge.yml

+            # Extract PR number from workflow run
+            PR_NUMBER=$(gh pr list --json number,headRefName --jq '.[] | select(.headRefName=="${{ github.event.workflow_run.head_branch }}") | .number' | head -1)


For workflow_run, deriving the PR number by listing PRs and matching headRefName to workflow_run.head_branch is ambiguous and can return the wrong PR if multiple PRs share the same head branch name (or return nothing and fail). Prefer using the PR number(s) provided in the workflow_run event payload (when present) to identify the exact PR that triggered CI.

Suggested change

# Extract PR number from workflow run

PR_NUMBER=$(gh pr list --json number,headRefName --jq '.[] | select(.headRefName=="${{ github.event.workflow_run.head_branch }}") | .number' | head -1)

# Extract PR number directly from workflow_run payload

if [ -n "${{ github.event.workflow_run.pull_requests[0].number }}" ]; then

PR_NUMBER="${{ github.event.workflow_run.pull_requests[0].number }}"

else

echo "Workflow run is not associated with a pull request."

exit 1

fi

Copilot · 2026-02-27T18:36:32Z

docs/SYNC.md

+with open('routes/registry.yaml') as f:
+    reg = yaml.safe_load(f)
+    active = [code for code, org in reg['orgs'].items() if org.get('status') == 'active']
+    print(f'Active orgs: {', '.join(active)}')


This Python example is syntactically invalid because the f-string contains nested single quotes: print(f'Active orgs: {', '.join(active)}'). Adjust the quoting (or build the joined string separately) so the snippet can be copied/pasted and run as shown.

Suggested change

print(f'Active orgs: {', '.join(active)}')

joined = ', '.join(active)

print(f'Active orgs: {joined}')

Initial plan

c2d9d7c

Copilot AI assigned Copilot and blackboxprogramming Jan 27, 2026

Copilot started work on behalf of blackboxprogramming January 27, 2026 20:59 View session

Add sync to orgs and auto-merge functionality with tests

cde310d

Co-authored-by: blackboxprogramming <118287761+blackboxprogramming@users.noreply.github.com>

github-advanced-security bot found potential problems Jan 27, 2026

View reviewed changes

Copilot AI and others added 2 commits January 27, 2026 21:06

Add integration tests and fix sync-receiver template

330d352

Co-authored-by: blackboxprogramming <118287761+blackboxprogramming@users.noreply.github.com>

Address code review feedback: improve error handling, security, and d…

caa4bce

…ocumentation Co-authored-by: blackboxprogramming <118287761+blackboxprogramming@users.noreply.github.com>

github-advanced-security bot found potential problems Jan 27, 2026

View reviewed changes

.github/workflows/auto-merge.yml Fixed Show fixed Hide fixed

Changes before error encountered

46f5a4b

Co-authored-by: blackboxprogramming <118287761+blackboxprogramming@users.noreply.github.com>

Copilot AI requested a review from blackboxprogramming January 27, 2026 21:13

blackboxprogramming approved these changes Jan 31, 2026

View reviewed changes

blackboxprogramming marked this pull request as ready for review January 31, 2026 12:39

Copilot AI review requested due to automatic review settings January 31, 2026 12:39

Copilot started reviewing on behalf of blackboxprogramming January 31, 2026 12:40 View session

chatgpt-codex-connector bot reviewed Jan 31, 2026

View reviewed changes

Copilot AI reviewed Jan 31, 2026

View reviewed changes

Copilot AI mentioned this pull request Feb 3, 2026

Add automated PR management system #18

Draft

blackboxprogramming requested review from blackboxprogramming and Copilot February 27, 2026 18:10

blackboxprogramming and others added 3 commits February 27, 2026 12:10

Update sync-to-orgs.yml

2f7efb2

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update sync-to-orgs.yml

2722283

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update auto-merge.yml

217ed3a

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot started reviewing on behalf of blackboxprogramming February 27, 2026 18:11 View session

blackboxprogramming and others added 3 commits February 27, 2026 12:11

Update sync-receiver.yml

4b38457

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update test_sync.py

5b82d34

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update test_sync.py

a360f58

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

blackboxprogramming approved these changes Feb 27, 2026

View reviewed changes

Copilot AI reviewed Feb 27, 2026

View reviewed changes

blackboxprogramming and others added 6 commits February 27, 2026 12:17

Update test_integration.py

4cb9cfb

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update sync-to-orgs.yml

6e24632

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update sync-to-orgs.yml

fce6ef6

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update sync-to-orgs.yml

779f03e

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update auto-merge.yml

4fda558

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update auto-merge.yml

541d59b

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

blackboxprogramming requested review from blackboxprogramming and Copilot February 27, 2026 18:22

Copilot started reviewing on behalf of blackboxprogramming February 27, 2026 18:23 View session

blackboxprogramming approved these changes Feb 27, 2026

View reviewed changes

Copilot AI reviewed Feb 27, 2026

View reviewed changes

@@ -123,10 +123,15 @@
                   - name: Summary
                     if: always()
+                    env:
+                      SUMMARY_PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
+                      SUMMARY_STATE: ${{ steps.pr.outputs.state }}
+                      SUMMARY_CAN_MERGE: ${{ steps.check.outputs.can_merge }}
+                      SUMMARY_JOB_STATUS: ${{ job.status }}
                     run: |
                       echo "🎯 Auto-merge Summary"
                       echo ""
-                      echo "PR: #${{ steps.pr.outputs.pr_number }}"
-                      echo "State: ${{ steps.pr.outputs.state }}"
-                      echo "Can merge: ${{ steps.check.outputs.can_merge }}"
-                      echo "Status: ${{ job.status }}"
+                      echo "PR: #$SUMMARY_PR_NUMBER"
+                      echo "State: $SUMMARY_STATE"
+                      echo "Can merge: $SUMMARY_CAN_MERGE"
+                      echo "Status: $SUMMARY_JOB_STATUS"

@@ -32,13 +32,15 @@
                     id: pr
                     env:
                       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                      HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
                     run: |
                       # Get PR number from the event
                       if [ "${{ github.event_name }}" == "pull_request_review" ]; then
                         PR_NUMBER="${{ github.event.pull_request.number }}"
                       elif [ "${{ github.event_name }}" == "workflow_run" ]; then
                         # Extract PR number from workflow run
-                        PR_NUMBER=$(gh pr list --json number,headRefName --jq '.[] | select(.headRefName=="${{ github.event.workflow_run.head_branch }}") | .number' | head -1)
+                        JQ_FILTER=".[] | select(.headRefName==\"$HEAD_BRANCH\") | .number"
+                        PR_NUMBER=$(gh pr list --json number,headRefName --jq "$JQ_FILTER" | head -1)
                       else
                         echo "No PR found for event type: ${{ github.event_name }}"
                         exit 1

		echo "No PR number found for branch ${{ github.event.workflow_run.head_branch }}"
		exit 1

	GITHUB_TOKEN: ${{ secrets.DISPATCH_TOKEN \|\| secrets.GITHUB_TOKEN }}
	GITHUB_TOKEN: ${{ secrets.DISPATCH_TOKEN }}

		# Extract PR number from workflow run
		PR_NUMBER=$(gh pr list --json number,headRefName --jq '.[] \| select(.headRefName=="${{ github.event.workflow_run.head_branch }}") \| .number' \| head -1)

-            # Extract PR number from workflow run
-            PR_NUMBER=$(gh pr list --json number,headRefName --jq '.[] | select(.headRefName=="${{ github.event.workflow_run.head_branch }}") | .number' | head -1)
+            # Extract PR number directly from workflow_run payload
+            if [ -n "${{ github.event.workflow_run.pull_requests[0].number }}" ]; then
+              PR_NUMBER="${{ github.event.workflow_run.pull_requests[0].number }}"
+            else
+              echo "Workflow run is not associated with a pull request."
+              exit 1
+            fi

	print(f'Active orgs: {', '.join(active)}')
	joined = ', '.join(active)
	print(f'Active orgs: {joined}')

Conversation

Copilot AI commented Jan 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Implementation Plan: Test & Ensure Updates Push to Orgs

Understanding

Implementation Checklist

Uh oh!

Check failure

Uh oh!

Uh oh!

Copilot Autofix

Check failure

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot Autofix

Check failure

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot Autofix

Check failure

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot Autofix

Check failure

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot Autofix

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Jan 31, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector bot Jan 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Jan 31, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Jan 27, 2026 •

edited

Loading