Fix missing cross-repo and auth properties in safe output schemas#18754
Merged
Fix missing cross-repo and auth properties in safe output schemas#18754
Conversation
Co-authored-by: dsyme <7204669+dsyme@users.noreply.github.com>
… schema properties - Add github-token to add-comment, create-issue, create-discussion schemas - Add target-repo and allowed-repos to create-code-scanning-alert and push-to-pull-request-branch schemas - Add allowed-repos and github-token to update-issue schema - Add runner and agent-output to custom safe-outputs/jobs schema - Handle runner (alias for runs-on) and agent-output (alias for output) in safe_jobs.go Co-authored-by: dsyme <7204669+dsyme@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix safe outputs to support target-repo and allowed-repos
Fix missing cross-repo and auth properties in safe output schemas
Feb 27, 2026
dsyme
reviewed
Feb 27, 2026
…ep auth, add comprehensive tests Co-authored-by: dsyme <7204669+dsyme@users.noreply.github.com>
…nce, fix assert.Emptyf Co-authored-by: dsyme <7204669+dsyme@users.noreply.github.com>
Contributor
Author
|
Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
dsyme
reviewed
Feb 28, 2026
Contributor
Author
|
Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
dsyme
force-pushed
the
copilot/fix-safe-outputs-target-repo-support
branch
from
93c725f to
bbc11a3
Compare
dsyme
reviewed
Feb 28, 2026
…oss handlers - Create handler_auth.cjs with createAuthenticatedGitHubClient(config) helper - Update add_comment.cjs, create_issue.cjs, create_discussion.cjs to use authClient instead of global github (no global mutation for cross-repo auth) - Update update_handler_factory.cjs with authClient and cross-repo routing via message.repo - Add handler_auth.test.cjs with 6 tests for the shared auth helper - Add 4 tests to update_handler_factory.test.cjs covering auth and cross-repo routing - Update TestHandlerManagerStepPerOutputTokenInHandlerConfig to be precise about where per-output tokens appear (handler config JSON, NOT step-level github-token) - Fix create_issue_group.test.cjs to pass github client to searchForExistingParent Co-authored-by: dsyme <7204669+dsyme@users.noreply.github.com>
Contributor
Author
|
Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
…tput handlers - Add github-token passthrough to Go handler registry for 22 handlers: add_labels, remove_labels, add_reviewer, assign_milestone, mark_pull_request_as_ready_for_review, update_discussion, link_sub_issue, update_release, create_pull_request_review_comment, submit_pull_request_review, reply_to_pull_request_review_comment, resolve_pull_request_review_thread, create_pull_request, push_to_pull_request_branch, update_pull_request, close_pull_request, hide_comment, dispatch_workflow, missing_tool, missing_data, assign_to_user, unassign_from_user - Update all corresponding .cjs handler files to use createAuthenticatedGitHubClient: replaces direct global github.rest.* and github.graphql() calls with authClient equivalents, falling back to global github when no token set - Also update close_issue.cjs and close_discussion.cjs with the same pattern (no registry change needed yet as their schemas lack github-token) - Fix submit_pr_review.test.cjs to set global.github mock in beforeEach so tests don't fail after other tests delete global.github Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
Author
|
Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
|
🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation... |
Contributor
|
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
Contributor
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
Contributor
Contributor
Agent Container Tool Check
Result: 12/12 tools available ✅ Overall Status: PASS
|
Contributor
|
Commit pushed:
|
Contributor
|
🤖 Smoke test §22526414033 results for
Overall: PASS (11/12 — Serena MCP not available)
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
This PR consistently applies the createAuthenticatedGitHubClient pattern across all safe-output handlers, enabling proper cross-repo token support. The schema additions for cross-repo and auth properties are well-tested. LGTM.
📰 BREAKING: Report filed by Smoke Copilot
| const { parseBoolTemplatable } = require("./templatable.cjs"); | ||
| const { resolveTarget } = require("./safe_output_helpers.cjs"); | ||
| const { resolveTargetRepoConfig, resolveAndValidateRepo } = require("./repo_helpers.cjs"); | ||
| const { createAuthenticatedGitHubClient } = require("./handler_auth.cjs"); |
Contributor
There was a problem hiding this comment.
Good pattern — importing createAuthenticatedGitHubClient here ensures all GitHub API calls in this file use the correct token for cross-repo operations.
| const maxCount = config.max || 20; | ||
| const { defaultTargetRepo, allowedRepos } = resolveTargetRepoConfig(config); | ||
|
|
||
| // Create an authenticated GitHub client. Uses config["github-token"] when set |
Contributor
There was a problem hiding this comment.
Creating authClient once at the top of main() and reusing it throughout is clean and avoids redundant auth setup on each API call.
Contributor
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
…FO_* env var format Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Fixed in commit |
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
|
Commit pushed:
|
Contributor
|
Smoke Test Results — Run §22526414043 | Status: PARTIAL
|
Contributor
There was a problem hiding this comment.
💥 Automated smoke test review - all systems nominal! The createAuthenticatedGitHubClient pattern is well-applied consistently across handlers, and the cross-repo auth improvements look solid.
💥 [THE END] — Illustrated by Smoke Claude
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TargetRepoSlug/AllowedReposfields added)github-token) for all 31 handler typesrunner/agent-outputalias support insafe_jobs.goparseAllowedReposFromConfighelper +ParseTargetConfigfixbuildHandlerManagerStephandler_auth.cjs— sharedcreateAuthenticatedGitHubClient(config)helpercreateAuthenticatedGitHubClienthandler_auth.cjsadded to SAFE_OUTPUTS_FILES insetup.shfor explicit validation/installationbuildHandlerManagerStepparseAllowedReposFromConfigdoc comment to accurately describe nil vs empty slice return contractsafe_outputs_cross_repo_config_test.goaw_info_versions_test.goto useGH_AW_INFO_*env var format (tests were checking for oldcli_version:/awf_version:YAML format, butgenerateCreateAwInfonow generates env vars)Original prompt
This section details on the original issue you should resolve
<issue_title>Many safe outputs don't support either
target-repoorallowed-repos</issue_title><issue_description>
Many safe outputs don't support either
target-repoorallowed-reposThe safe outputs involved can be inferred from the name of the workflow test (e.g. add-comment)
We should fix all these systematically
.github/workflows/test-copilot-siderepo-add-comment.md:16:5: error: at '/safe-outputs/add-comment' (line 16, column 5): Unknown property: github-token. Valid fields are: allowed-reasons, allowed-repos, discussion, discussions, hide-older-comments, issues, max, pull-requests, target, target-repo. 'github-token' belongs under 'tools/github', 'plugins' or 'safe-outputs/mark-pull-request-as-ready-for-review'
13 | add-comment:
14 | target-repo: 'githubnext/gh-aw-side-repo'
15 | allowed-repos: ['githubnext/gh-aw-side-repo']
16 | github-token: ${{ secrets.TEMP_USER_PAT }}
^^^^^^^^^^^^
17 | # min: 1
18 | ---
19 |
.github/workflows/test-copilot-siderepo-add-discussion-comment.md:17:5: error: at '/safe-outputs/add-comment' (line 17, column 5): Unknown property: github-token. Valid fields are: allowed-reasons, allowed-repos, discussion, discussions, hide-older-comments, issues, max, pull-requests, target, target-repo. 'github-token' belongs under 'plugins', 'tools/github' or 'safe-outputs/autofix-code-scanning-alert'
14 | discussion: true
15 | target-repo: 'githubnext/gh-aw-side-repo'
16 | allowed-repos: ['githubnext/gh-aw-side-repo']
17 | github-token: ${{ secrets.TEMP_USER_PAT }}
^^^^^^^^^^^^
18 | # min: 1
19 | ---
20 |
.github/workflows/test-copilot-siderepo-command.md:16:5: error: at '/safe-outputs/add-comment' (line 16, column 5): Unknown property: github-token. Valid fields are: allowed-reasons, allowed-repos, discussion, discussions, hide-older-comments, issues, max, pull-requests, target, target-repo. 'github-token' belongs under 'safe-outputs/close-pull-request', 'safe-outputs/create-pull-request' or 'safe-outputs/autofix-code-scanning-alert'
13 | add-comment:
14 | target-repo: 'githubnext/gh-aw-side-repo'
15 | allowed-repos: ['githubnext/gh-aw-side-repo']
16 | github-token: ${{ secrets.TEMP_USER_PAT }}
^^^^^^^^^^^^
17 | # min: 1
18 | missing-tool:
19 | ---
.github/workflows/test-copilot-siderepo-create-discussion.md:15:5: error: at '/safe-outputs/create-discussion' (line 15, column 5): Unknown property: github-token. Valid fields are: allowed-labels, allowed-repos, category, close-older-discussions, expires, fallback-to-issue, footer, labels, max, target-repo, .... 'github-token' belongs under 'tools/github', 'safe-outputs/add-labels' or 'safe-outputs/assign-milestone'
12 | title-prefix: "[copilot-test] "
13 | target-repo: 'githubnext/gh-aw-side-repo'
14 | allowed-repos: ['githubnext/gh-aw-side-repo']
15 | github-token: ${{ secrets.TEMP_USER_PAT }}
^^^^^^^^^^^^
16 | # categories:
17 | # min: 1
18 | ---
.github/workflows/test-copilot-siderepo-create-issue.md:16:5: error: at '/safe-outputs/create-issue' (line 16, column 5): Unknown property: github-token. Valid fields are: allowed-labels, allowed-repos, assignees, close-older-issues, expires, footer, group, labels, max, target-repo, .... 'github-token' belongs under 'plugins', 'tools/github' or 'safe-outputs/dispatch-workflow'
13 | labels: [copilot, automation, haiku]
14 | target-repo: 'githubnext/gh-aw-side-repo'
15 | allowed-repos: ['githubnext/gh-aw-side-repo']
16 | github-token: ${{ secrets.TEMP_USER_PAT }}
^^^^^^^^^^^^
17 | # min: 1
18 | ---
19 |
.github/workflows/test-copilot-siderepo-create-repository-code-scanning-alert.md:14:5: error: at '/safe-outputs/create-code-scanning-alert' (line 14, column 5): Unknown properties: allowed-repos, target-repo. Valid fields are: driver, github-token, max. 'allowed-repos' belongs under 'safe-outputs/add-comment', 'safe-outputs/create-agent-task' or 'safe-outputs/reply-to-pull-request-review-comment'. 'target-repo' belongs under 'tools/repo-memory', 'safe-outputs/close-discussion' or 'safe-outputs/close-issue'
11 | safe-outputs:
12 | create-code-scanning-alert:
13 | max: 10
14 | target-repo: 'githubnext/gh-aw-side-repo'
^^^^^^^^^^^
15 | allowed-repos: ['githubnext/gh-aw-side-repo']
16 | github-token: ${{ secrets.TEMP_USER_PAT }}
17 | # min: 1
.github/workflows/test-copilot-siderepo-custom-safe-outputs.md:14:7: error: at '/safe-outputs/jobs/print' (line 14, column 7): Unknown properties: agent-output, runner
11 | threat-detection: false
12 | jobs:
13 | print:
14 | runner: ubuntu-latest
^^^^^^
15 | agent-output: message
16 | inputs:
17 | message:
.github/workflows/test-copilot-siderepo-mcp.md:15:5: error: at '/safe-outputs/create-issue' (line 15, column 5): Unknown property: github-token. Val...