feat: support multi-repo wildcard target-repo in safe_outputs job by dsyme · Pull Request #36657 · github/gh-aw

dsyme · 2026-06-03T14:34:59Z

Summary

When target-repo: "*" is configured for create-pull-request or push-to-pull-request-branch, the safe_outputs job now checks out all repositories from checkout: frontmatter into subdirectories (mirroring the agent job layout), enabling pull requests to multiple repositories in a single run.

Changes

Go compiler

compiler_safe_outputs_steps.go: Added buildMultiRepoCheckoutSteps() — when wildcard is detected, generates checkout steps for all repos, configures git credentials per-directory (git -C), and fetches additional refs per-repo.
safe_outputs_patch_workspace.go: Added injectCheckoutMapping() — builds a map of repo slug → relative path from checkout: configs and injects it into handler config as checkout_mapping.
safe_outputs_config.go / safe_outputs_config_generation.go: Wire up injectCheckoutMapping call.

JS handlers

create_pull_request.cjs: Uses checkout_mapping to resolve subdirectory, process.chdir() with try/finally restore. Falls back to findRepoCheckout() workspace scan, then legacy dynamic remote switching.
push_to_pull_request_branch.cjs: Checks checkout_mapping before falling back to findRepoCheckout() workspace scan.

Docs & Schema

Updated schema descriptions for target-repo in both create-pull-request and push-to-pull-request-branch to document wildcard support.
Updated safe-outputs-pull-requests.md reference docs to explain multi-repo capability.

Tests

Added TestInjectCheckoutMappingForWildcardTargetRepo covering injection, skip cases (non-wildcard, wiki, unrelated handlers).

Verification

Compiled a test workflow with target-repo: "*" and two allowed repos — generated lock.yml is correct
Traced full execution path through JS handlers — all git operations target correct directories
All file paths (bundles, patches) are absolute so they work regardless of CWD
Git credentials configured per-repo via git -C
CWD always restored via try/finally

When target-repo is set to "*" for create-pull-request or push-to-pull-request-branch, the safe_outputs job now checks out ALL repositories declared in checkout: frontmatter into subdirectories (mirroring the agent job layout). Changes: - Add buildMultiRepoCheckoutSteps() to generate per-repo checkout, git-credential, and fetch-ref steps in safe_outputs - Add injectCheckoutMapping() to pass repo-to-path mapping in handler config - Update create_pull_request.cjs to use checkout_mapping for directory resolution with process.chdir() and try/finally restore - Enhance push_to_pull_request_branch.cjs to check checkout_mapping before falling back to workspace scan - Update schema descriptions to document wildcard support - Update docs to reflect multi-repo capability - Add tests for injectCheckoutMapping

Copilot

Pull request overview

Adds wildcard ("*") support for target-repo in safe-outputs PR/push handlers by teaching the safe_outputs job to check out multiple repositories and by passing a compile-time checkout → path map down to JS handlers so they can operate in the correct subdirectory.

Changes:

Generate multi-repo checkout + per-directory git-remote configuration in safe_outputs when target-repo: "*" is used.
Inject checkout_mapping into safe-outputs handler config for wildcard runs and consume it in JS handlers (with workspace-scan fallbacks).
Update schema/docs and add a Go unit test for checkout mapping injection.

Show a summary per file

File	Description
pkg/workflow/safe_outputs_patch_workspace.go	Injects `checkout_mapping` into handler config for wildcard `target-repo`.
pkg/workflow/safe_outputs_config.go	Wires `injectCheckoutMapping` into compiled handler config env.
pkg/workflow/safe_outputs_config_generation.go	Wires `injectCheckoutMapping` into generated runtime config.
pkg/workflow/compiler_safe_outputs_steps.go	Adds multi-repo checkout / git credentialing / per-repo extra-ref fetching for wildcard targets.
pkg/workflow/compiler_safe_outputs_config_test.go	Adds test coverage for wildcard checkout mapping injection behavior.
pkg/parser/schemas/main_workflow_schema.json	Documents `target-repo: "*"` wildcard support in schema descriptions.
docs/src/content/docs/reference/safe-outputs-pull-requests.md	Documents cross-repo wildcard behavior and expectations.
actions/setup/js/push_to_pull_request_branch.cjs	Uses `checkout_mapping` to resolve repo checkout directory before scanning workspace.
actions/setup/js/create_pull_request.cjs	Uses `checkout_mapping` and `process.chdir()` (with restoration) to run git operations in the correct repo directory.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 9/9 changed files
Comments generated: 4

        switch (ifNoChanges) {
          case "error":
-            return { success: false, error: message };
+            return { success: false, error: "No changes to push - failing as configured by if-no-changes: error" };



Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Initial plan * chore: start CI failure investigation Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * test: make checkout action pin expectations dynamic Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

…36648) * Plan: fix false-positive extension upgrade success reporting Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Verify extension version after self-upgrade before reporting success Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Harden self-upgrade by validating installed version post-upgrade Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * initial plan Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Replace custom version regex with semverutil token scanning in parseInstalledVersionOutput Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Fix backup cleanup ordering in rename+retry path; fix lint issues Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Co-authored-by: Peli de Halleux <pelikhan@users.noreply.github.com>

…mas (#36636) * fix: add missing target/target-repo/allowed-repos to safe output schemas The JSON schema for several safe output types was missing properties that the Go code (SafeOutputTargetConfig) and CJS runtime already supported, causing 'Unknown properties' validation errors at compile time. Fixed safe outputs: - resolve-pull-request-review-thread: added target, target-repo, allowed-repos - assign-milestone: added target, allowed-repos - hide-comment: added target, allowed-repos - link-sub-issue: added target, allowed-repos - close-discussion: added allowed-repos - close-pull-request: added allowed-repos - update-discussion: added allowed-repos - update-pull-request: added allowed-repos - mark-pull-request-as-ready-for-review: added allowed-repos - add-reviewer: added allowed-repos - assign-to-agent: added allowed-repos Added comprehensive schema validation test that exercises target, target-repo, and allowed-repos for all 25 safe output types that embed SafeOutputTargetConfig, plus negative tests confirming unknown properties are still rejected. * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * docs(adr): add draft ADR-36636 for safe-output schema sync Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Peli de Halleux <pelikhan@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Initial plan * Fix testifylint: remove unnecessary fmt.Sprintf in slog_adapter_test.go Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

When target-repo is "*" and no checkout_mapping is provided (legacy path), if neither findRepoCheckout nor checkoutManager can locate the target repository, proceed with a warning instead of failing. This allows allow_empty PRs to be created via API without requiring a local checkout of the target repo.

github-actions · 2026-06-03T14:55:51Z

✅ smoke-ci: safeoutputs CLI comment + comment-memory run (26892979103)

Generated by 🧪 Smoke CI for issue #36657 · ◷

github-actions · 2026-06-03T16:46:06Z

@copilot review all comments and address unresolved review feedback.

pr-sous-chef: please resolve the active review feedback before merging.

Generated by 👨‍🍳 PR Sous Chef · gpt54mini 3M · ◷

Copilot AI review requested due to automatic review settings June 3, 2026 14:35

Copilot started reviewing on behalf of dsyme June 3, 2026 14:35 View session

This comment has been minimized.

Sign in to view

Copilot AI reviewed Jun 3, 2026

View reviewed changes

dsyme and others added 3 commits June 3, 2026 15:47

Potential fix for pull request finding

5ac552b

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

883a73b

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

e990900

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

This comment has been minimized.

Sign in to view

github-actions Bot and others added 9 commits June 3, 2026 15:53

Enforce specifications for syncutil, testutil, timeutil (#36639)

4245329

Add Daily Ambient Context Optimizer workflow (#36642)

4367160

Add Copilot SDK Driver standalone reference specification (#36632)

37cac82

Tighten ET computation details layout and compact model aliases (#36634)

3f48e5d

github-actions Bot mentioned this pull request Jun 3, 2026

[aw] No-Op Runs #36156

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: support multi-repo wildcard target-repo in safe_outputs job#36657

feat: support multi-repo wildcard target-repo in safe_outputs job#36657
dsyme wants to merge 13 commits into
mainfrom
multi-repo-wildcard-safe-outputs

dsyme commented Jun 3, 2026

Uh oh!

This comment has been minimized.

This comment has been minimized.

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment has been minimized.

github-actions Bot commented Jun 3, 2026

Uh oh!

github-actions Bot commented Jun 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

dsyme commented Jun 3, 2026

Summary

Changes

Go compiler

JS handlers

Docs & Schema

Tests

Verification

Uh oh!

This comment has been minimized.

This comment has been minimized.

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment has been minimized.

github-actions Bot commented Jun 3, 2026

Uh oh!

github-actions Bot commented Jun 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants