Add safe-outputs.steps for injecting custom steps into safe-output jobs

[Copilot]

Adds a safe-outputs.steps field that lets users inject custom steps into the consolidated safe-outputs job. Injected steps run after repository checkout and action setup, but before any safe-output code executes. Steps from imported workflows are merged (concatenated) with the main workflow's steps.

Changes

• Schema (pkg/parser/schemas/main_workflow_schema.json): Added steps property to safe-outputs, using $ref: #/$defs/githubActionsStep to reuse the existing step interface
• Types (pkg/workflow/compiler_types.go): Added Steps []any to SafeOutputsConfig
• Parser (pkg/workflow/safe_outputs_config.go): Parses steps from safe-outputs frontmatter block
• Compiler (pkg/workflow/compiler_safe_outputs_job.go): Injects steps after PR checkout (if any) and before the handler manager step; applies action SHA pinning consistent with safe-outputs.jobs.steps
• Imports (pkg/workflow/imports.go): Merges safe-outputs.steps from imported workflows by concatenating imported steps after the main workflow's steps

Example

safe-outputs:
  create-issue: {}
  steps:
    - name: Install custom tool
      run: npm install my-package
    - name: Setup Node.js
      uses: actions/setup-node@v4
      with:
        node-version: "20"

Resulting step order in the generated job:

1. Checkout actions folder + setup action
2. Download agent output artifact
3. (Optional) PR checkout
4. User-injected steps ← inserted here (main workflow steps first, then steps from imported workflows)
5. Process Safe Outputs (handler manager)

Original prompt

Add a safe-output.steps field that allows users to inject steps into the safe-output jobs. These steps must run after checking out the repository and setting up the action, and before configuring or running any of the safe-output code. The steps provided by the user are copied into the safe-output jobs.
Add support in the JSON schema, the parser, and the generated code. Reuse the existing interfaces for steps.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[pelikhan]

@copilot entire steps get merged from imported workflows

[Copilot]

@copilot entire steps get merged from imported workflows

Done in a15c27d. safe-outputs.steps from imported workflows are now concatenated (appended after the main workflow's steps) in mergeSafeOutputConfig in imports.go, consistent with how other array fields are handled.

[Copilot]

Pull request overview

This PR adds support for injecting custom steps into the consolidated safe-outputs job through a new safe-outputs.steps configuration field. These steps execute after repository checkout and action setup, but before any safe-output processing logic runs.

Changes:

• Added steps field to the safe-outputs configuration schema and type definitions
• Implemented parsing and merging logic for user-provided steps (concatenating imported workflow steps after main workflow steps)
• Integrated step injection into the safe-outputs job compilation with SHA pinning support

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pkg/parser/schemas/main_workflow_schema.json	Added steps property to safe-outputs schema definition
pkg/workflow/compiler_types.go	Added Steps []any field to SafeOutputsConfig struct
pkg/workflow/safe_outputs_config.go	Implemented parsing of steps from safe-outputs frontmatter
pkg/workflow/imports.go	Added logic to concatenate imported steps with main workflow steps
pkg/workflow/compiler_safe_outputs_job.go	Implemented step injection with SHA pinning in the consolidated job

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The error message should mention that the step will be skipped in the generated workflow to make the impact clearer to users reviewing logs.

Suggested change

	consolidatedSafeOutputsJobLog.Printf("Warning: safe-outputs step at index %d is not a valid step object (must be a map with properties like name, run, uses). Skipping this step.", i)
	consolidatedSafeOutputsJobLog.Printf("Warning: safe-outputs step at index %d is not a valid step object (must be a map with properties like name, run, uses). Skipping this step in the generated workflow.", i)

[Copilot]

Error message could be more actionable by suggesting the user check the step structure in their workflow configuration.

Suggested change

	return nil, nil, fmt.Errorf("failed to convert safe-outputs step at index %d to typed step: %w", i, err)
	return nil, nil, fmt.Errorf("failed to convert safe-outputs step at index %d to typed step: %w. Check that this entry in 'safe-outputs.steps' uses the correct GitHub Actions step structure (a map with keys like 'name', 'run', or 'uses').", i, err)