Safe Output Health Report - 2026-02-21

[github-actions[bot]]

Executive Summary

• Period: Last 24 hours (2026-02-21)
• Runs Analyzed: 23 (from today's window)
• Workflows Active: 21
• Safe Output Jobs Executed: 25
• Safe Output Jobs Failed: 2
• Safe Output Jobs Skipped (due to agent failure): 7
• Error Clusters Identified: 1
• Overall Safe Output Success Rate: 88.9%

⚠️ Note: This is the first audit run - no historical baseline is available for trend comparison. Cache memory has been initialized for future comparisons.

---

Safe Output Job Statistics

Job Type	Total Executions	Failures	Skipped	Success Rate
safe_outputs	18	2	5	61.1% (excl. skips)
update_cache_memory	3	0	1	100% (excl. skips)
upload_assets	2	0	2	N/A (all skipped)
unlock	1	0	0	100%
config	1	0	0	100%
release	1	0	0	100%

"Skipped" occurs when the upstream agent job fails - the safe output job never runs.

---

Error Clusters

Cluster 1: Git Branch Resolution Bug in push_to_pull_request_branch

• Count: 2 occurrences
• Affected Job Type: safe_outputs
• Affected Workflow: Smoke Multi PR
• Affected Runs:
  • §22248074296 — Run Add workflow: githubnext/agentics/weekly-research #2 at 01:53 UTC
  • §22248291876 — Run Add workflow: githubnext/agentics/weekly-research #3 at 02:06 UTC
• Resolved On: §22248592522 — Run Add workflow: githubnext/agentics/weekly-research #4 succeeded at 02:25 UTC

Sample Error Message

##[group]Fetching the repository
[command]/usr/bin/git -c protocol.version=2 fetch --no-tags --prune \
  --no-recurse-submodules --depth=1 origin \
  +refs/heads/17284/merge*:refs/remotes/origin/17284/merge* \
  +refs/tags/17284/merge*:refs/tags/17284/merge*
The process '/usr/bin/git' failed with exit code 1
Waiting 11 seconds before trying again
...
##[error]The process '/usr/bin/git' failed with exit code 1
##[warning]No files were found with the provided path: /tmp/safe-output-items.jsonl. No artifacts will be uploaded.

The checkout step was invoked with ref: 17284/merge (see with: block), which is not a valid branch name.

• Root Cause: The push_to_pull_request_branch handler derives the branch name by stripping the refs/pull/ prefix from the GITHUB_REF (refs/pull/17284/merge), producing 17284/merge. This is not a real branch — it is a virtual merge ref GitHub creates for CI. refs/heads/17284/merge does not exist, causing the actions/checkout fetch to fail with exit code 1 after three retries.
• Why Run Add workflow: githubnext/agentics/weekly-research #4 Succeeded: The agent used main as the target branch instead, bypassing the broken branch resolution.
• Impact: 2 safe_outputs job failures. The push_to_pull_request_branch safe output was not executed; no code was pushed to the PR.

---

Root Cause Analysis

Logic Error: PR Merge Ref Branch Derivation

When a workflow triggers on a pull_request event, GITHUB_REF is set to refs/pull/(number)/merge. The push_to_pull_request_branch handler appears to derive the target branch name by stripping refs/pull/ — yielding (number)/merge — rather than using the actual head branch name.

The correct value is available via:

• GITHUB_HEAD_REF environment variable (set for pull_request events, contains the actual head branch name)
• GitHub API (pull_request.head.ref field)

The successful run #4 avoided this by the agent producing a different branch target (main), not by a code fix.

Agent Failures (Not Safe Output Issues — Informational Only)

The following failures caused safe_outputs to be skipped (not failed). These are agent-level issues, not safe output job issues, and are out of scope for this audit but noted for completeness:

Run ID	Workflow	Agent Error
§22250109958	Issue Monster	Lockdown mode enabled, no custom GitHub token (GH_AW_GITHUB_TOKEN)
§22247848832	Issue Monster	Agent job failure (same lockdown token issue)
§22248171295	Daily Issues Report Generator	Agent job failure

---

Recommendations

Critical Issues (Immediate Action Required)

1. Fix: push_to_pull_request_branch — Use GITHUB_HEAD_REF for Branch Resolution
   • Priority: High
   • Root Cause: Branch name derived by stripping refs/pull/ from merge ref, producing N/merge — not a real branch
   • Recommended Action: Replace the branch derivation logic with GITHUB_HEAD_REF (available as an env var on pull_request events) or fetch the head branch from the GitHub API
   • Affected File: Likely actions/safe-outputs/checkout_pr_branch.cjs or actions/safe-outputs/push_to_pull_request_branch.cjs
   • Affected Workflows: Any workflow triggered on pull_request that produces push_to_pull_request_branch safe outputs

Bug Fixes Required

1. push_to_pull_request_branch Branch Derivation
   • File/Location: actions/safe-outputs/push_to_pull_request_branch.cjs (or related checkout_pr_branch.cjs)
   • Problem: The ref passed to actions/checkout is 17284/merge (derived from refs/pull/17284/merge by stripping refs/pull/)
   • Fix: Use process.env.GITHUB_HEAD_REF (or equivalent) to obtain the actual PR head branch name when the trigger is a pull_request event
   • Verification: Re-run smoke-multi-pr workflow on a PR to confirm branch checkout succeeds

Process Improvements

1. Add Integration Test for PR-Triggered push_to_pull_request_branch

   • Current State: The smoke test (smoke-multi-pr) validates the overall flow but the branch resolution bug was not caught in code review
   • Proposed: Add a unit test to checkout_pr_branch.test.cjs verifying that when GITHUB_REF=refs/pull/N/merge, the resolved branch is GITHUB_HEAD_REF not N/merge
   • Benefits: Catches regressions in PR branch resolution logic before deployment

2. Retry Logic for push_to_pull_request_branch Branch Not Found

   • Current State: The system retries the git fetch 3 times but always with the same (invalid) branch ref, then fails
   • Proposed: Add pre-validation to check if the derived branch ref is a merge ref pattern (\d+/merge) and automatically fall back to GITHUB_HEAD_REF
   • Benefits: Graceful degradation instead of hard failure

---

Work Item Plans

Work Item 1: Fix PR Merge Ref Branch Resolution in push_to_pull_request_branch

• Type: Bug Fix
• Priority: High
• Description: The push_to_pull_request_branch safe output handler incorrectly derives branch names from PR merge refs (refs/pull/N/merge), producing invalid branch names (N/merge). This causes git fetch to fail when any workflow triggered via pull_request event tries to push code back to the PR branch.
• Acceptance Criteria:
  • push_to_pull_request_branch correctly identifies the PR head branch when GITHUB_REF is refs/pull/N/merge
  • smoke-multi-pr passes consistently when triggered on a pull_request event
  • Unit test added to checkout_pr_branch.test.cjs covering the merge ref scenario
• Technical Approach: In the branch derivation logic, detect when GITHUB_REF matches refs/pull/\d+/merge pattern and use GITHUB_HEAD_REF instead. Alternatively, query the GitHub API for pull_request.head.ref.
• Effort: Small
• Dependencies: None

---

Historical Context

No historical data available — this is the first Safe Output Health Monitor run. Cache memory has been initialized at /tmp/gh-aw/cache-memory/safe-output-health/. Future audits will provide trend comparisons.

---

Metrics and KPIs

• Overall Safe Output Success Rate: 88.9% (16/18 jobs that actually ran)
• Most Reliable Job Types: update_cache_memory, unlock, config, release — 100% success
• Most Problematic Job Type: safe_outputs — 2 failures both from the same root cause
• Failure Pattern: Both failures within 13 minutes of each other, same workflow, same PR, same root cause

---

Next Steps

• Fix push_to_pull_request_branch branch resolution to use GITHUB_HEAD_REF
• Add unit test for PR merge ref branch derivation
• Investigate Issue Monster lockdown token errors (out of scope for this audit but needs attention)
• Run follow-up audit tomorrow to confirm safe_outputs success rate returns to 100%

References:

• §22248074296 — Smoke Multi PR failure rejig docs #1
• §22248291876 — Smoke Multi PR failure Add workflow: githubnext/agentics/weekly-research #2
• §22248592522 — Smoke Multi PR success (run Add workflow: githubnext/agentics/weekly-research #4)

AI generated by Safe Output Health Monitor

• expires on Feb 28, 2026, 4:24 AM UTC