Skip to content

[safeoutputs] Fix temporary_id '#' prefix confusion in field values (add_labels, remove_labels, and others)#32708

Open
Copilot wants to merge 4 commits into
mainfrom
copilot/fix-temporary-id-usage
Open

[safeoutputs] Fix temporary_id '#' prefix confusion in field values (add_labels, remove_labels, and others)#32708
Copilot wants to merge 4 commits into
mainfrom
copilot/fix-temporary-id-usage

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented May 16, 2026

Agents were incorrectly passing "#aw_summary" (with #) as add_labels.item_number, causing validator rejections. The preamble only taught the #aw_X body-reference syntax without clarifying that field values must omit the #. Additionally, add_labels.item_number was typed "number" in the schema despite the validator already accepting temporary ID strings.

Schema fixes (safe_outputs_tools.json)

  • add_labels.item_number and remove_labels.item_number: Changed type from "number" to ["number", "string"], added "pattern": "^(\\d+|aw_[A-Za-z0-9]{3,12})$" — aligns schema with what the validator already accepts
  • create_issue.parent, add_comment.item_number, assign_milestone.issue_number, assign_to_agent.issue_number: Added — without leading '#' to descriptions that previously said only (e.g., 'aw_abc123')

Preamble fix (actions/setup/md/safe_outputs_prompt.md)

Replaced the single ambiguous line with a two-clause version that explicitly disambiguates the two forms:

# Before
temporary_id: optional cross-reference field (e.g. use #aw_abc1 in a body). Format: aw_ + 3–8 alphanumeric chars (/^aw_[A-Za-z0-9]{3,8}$/). Omit when not needed.

# After
temporary_id: optional cross-reference field. Format: aw_ + 3–12 alphanumeric chars (/^aw_[A-Za-z0-9]{3,12}$/).
When **referencing** a temporary_id in a body or markdown text, use #aw_abc1 — the # is replaced with the real
issue/PR number after creation. When using a temporary_id as a **field value** (item_number, issue_number,
parent, etc.), pass the raw id without the #: 'aw_abc1'. Omit entirely when not needed.

Also corrects the documented range from 3–8 to 3–12 to match the actual validator (isTemporaryId uses {3,12}).

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
    • Triggering command: /usr/bin/gh gh repo view --json owner,name --jq .owner.login + "/" + .name x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh repo view --json owner,name --jq .owner.login + "/" + .name 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/orgs/owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/owner/actions/secrets --jq .secrets[].name -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv 0409880/b521/parser.test /tmp/go-build2100409880/b114/vet.cfg (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv 3634-31808/test-3908275178/.github/workflows 0409880/b124/vet.cfg 64/pkg/tool/linux_amd64/link GOSUMDB GOWORK 64/bin/go 64/pkg/tool/linux_amd64/link -uns�� ingutil.test /tmp/go-build2100409880/b100/vet.cfg ortcfg.link /tmp/go-build343infocmp -trimpath 64/bin/go zB-TXKqHgYfYiaJd1d/b4hju8YCrl3pFusTbaSG/CwoPpFZaremote.origin.url (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv 6/001/inlined-b.md 0409880/b257/vet.cfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/xconfig -c agent-performancremote.upstream.url GOPROXY 1/x64/bin/node GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcache/go/1.25.8/x--json (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv t0 Test User 1/x64/bin/node m0s GO111MODULE (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv -bool l /usr/bin/git -errorsas -ifaceassert -nilfunc git conf�� user.name Test User /usr/bin/git -json GO111MODULE x_amd64/vet git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv get --local r: $owner, name: $name) { hasDiscussionsEnabled } } credential.helpe/usr/bin/gh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv sRemoteWithRealGtest-logs/run-1 sRemoteWithRealGitbranch_with_hyphen4269974779/002/work ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x--all -uns�� Onlymin-integritid,name,path,state /tmp/go-build210--repo 1/x64/bin/node GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcache/go/1.25.8/xTest User (http block)
  • https://api.github.com/repos/actions/download-artifact/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv install --package-lock-oowner=github n-dir/git /actions/secretsinfocmp -buildtags /opt/hostedtoolcxterm-color sed s|[/�� ithub-script/git/ref/tags/v9 /opt/hostedtoolcache/go/1.25.8/x-trimpath r: $owner, name: $name) { hasDiscussionsEnabled } } maxdepth 5 -typegit -trimpath f281e864 gh (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv k/gh-aw/gh-aw/pkg/semverutil/semverutil.go k/gh-aw/gh-aw/pkg/semverutil/semverutil_test.go /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -- unsafe 64/bin/go /opt/hostedtoolcache/go/1.25.8/x--jq -o /tmp/go-build2100409880/b528/_pkg_.a l /usr/bin/git -p main -lang=go1.25 git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv ry=1 -importcfg 0409880/b549/_pkg_.a -s -w -buildmode=exe git -C /tmp/compile-instructions-test-965830693 show om/owner/repo.git -json GO111MODULE x_amd64/vet /opt/hostedtoolc--jq (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v9
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv pkg/actionpins/data/action_pins.json; \ cp .github/aw/actions-lock.json pkg/workflow/data/action_pins.json; \ echo "��� Action pins synced successfully"; \ else \ echo "��� (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v9.0.0
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE -1xP2rRv73mm env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv FieldEnforcement89804453/001 -buildtags /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -errorsas -ifaceassert -nilfunc /opt/hostedtoolcache/go/1.25.8/xconfig -ato�� 86 -buildtags (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv g/fileutil/fileutil.go g/fileutil/tar.go 1/x64/bin/node GOINSECURE GOMOD GOMODCACHE /opt/hostedtoolc-test.v=true t-ha�� vaScript29878706-test.timeout=10m0s /tmp/go-build210-test.run=^Test 64/pkg/tool/linu-test.short=true GOSUMDB GOWORK 64/bin/go 64/pkg/tool/linux_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv FieldEnforcement89804453/001 /tmp/go-build2100409880/b289/vet.cfg /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -json GO111MODULE 64/bin/go /opt/hostedtoolcache/go/1.25.8/xremote.upstream.url -ato�� runs/20260516-213634-31808/test-2700494693/.github/workflows -buildtags /usr/bin/git l -ifaceassert -nilfunc git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv runs/20260516-213634-31808/test-3831182593 config (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv get --local /usr/local/bin/git credential.helpegit (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv ace-editor.md GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/xowner/repo (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv -json 0409880/b461/_testmain.go 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuowner/test-repo -uns�� 0409880/b465/agentdrain.test /tmp/go-build2100409880/b005/vet.cfg (http block)
  • https://api.github.com/repos/aws-actions/configure-aws-credentials/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv bility_SameInputSameOutput1316654980/001/stability-test.md --jq /usr/bin/git -json GO111MODULE 64/bin/go git comm�� -m initial commit /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv runs/20260516-213634-31808/test-2815503398/.github/workflows /dev/null /usr/bin/infocmp l GO111MODULE 64/bin/go infocmp -1 xterm-color go /tmp/go-build2100409880/b528/semverutil.test -json (http block)
  • https://api.github.com/repos/azure/login/git/ref/tags/v2
    • Triggering command: /usr/bin/gh gh api /repos/azure/login/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv bility_SameInputSameOutput1316654980/001/stability-test.md -json=Name,ImportPath,Error,Dir,GoFiles,IgnoredGoFiles,IgnoredOtnonexistent-workflow-12345 /usr/lib/git-core/git -json GO111MODULE 64/bin/go /usr/lib/git-cor--package-lock-only rev-�� --objects --stdin t --exclude-hidden/usr/lib/git-core/git --all --quiet git (http block)
  • https://api.github.com/repos/docker/login-action/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv -e -f /usr/lib/git-core/git -- unsafe 64/bin/go /usr/lib/git-cor--package-lock-only unpa�� --pack_header=2,3 l 0409880/b544/vet.cfg -json GO111MODULE 64/bin/go git (http block)
  • https://api.github.com/repos/docker/metadata-action/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/docker/metadata-action/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/docker/metadata-action/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 /opt/hostedtoolc--jq sv Imports137883650git /tmp/go-build210-C 1/x64/bin/node gh api /ref/tags/v9 --jq yml ithub/workflows/git -buildtags 1/x64/bin/node git (http block)
  • https://api.github.com/repos/docker/setup-buildx-action/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 ache/go/1.25.8/x--jq $name) { hasDiscussionsEnabled } } 0409880/b517/loggit /tmp/go-build210-C 0409880/b517/imp/home/REDACTED/work/gh-aw/gh-aw/.github/workflows gh api /ref/tags/v9 --jq sv ry=1 l ache/node/24.14./home/REDACTED/work/gh-aw/gh-aw/.github/workflows pins synced succonfig (http block)
  • https://api.github.com/repos/github/gh-aw
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch get om/github/gh-aw (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch ithub-script/gitremote.origin.url --jq bject.type] | @tsv -test.paniconexigit -test.v=true (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv 3634-31808/aw-manifest-legacy-13--workflow tname) r: $owner, name: $name) { hasDiscussionsEnabled } } -json GO111MODULE 64/bin/go /opt/hostedtoolcache/go/1.25.8/xremote.origin.url -uns�� test1.md test2.lock.yml ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -json GO111MODULE 64/bin/go ache/go/1.25.8/x--jq (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x--jq -uns�� 4226001368 /tmp/go-build2100409880/b076/vet.cfg tutil.test GOSUMDB b/gh-aw/pkg/envu-1 64/bin/go tutil.test (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv edcfg GO111MODULE tartedAt,updatedAt,event,headBranch,headSha,displayTitle H_PREFIX_ARGS="--docker-host-path-prefix /tmp/gh-aw" fi echo "$GH_AW_DOCKER_HOST_PATH_PREFIX_AR GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuorigin -uns�� CompiledOutput3547264460/001 /tmp/go-build2100409880/b066/vet.cfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOSUMDB GOWORK 64/bin/go ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-05-09 GOMOD GOMODCACHE x_amd64/vet env -json .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-04-16 GOMOD GOMODCACHE x_amd64/compile env -json .cfg 64/pkg/tool/linu-nolocalimports GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuTest commit (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-02-15 GOMOD GOMODCACHE 64/pkg/tool/linutest@example.com itma�� tions/setup/js/node_modules/flat-p .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env 2256729325/.github/workflows GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuremote.origin.url (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 itbranch_with_hyphen4269974779/002/work 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuremote2 (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu.github/workflows/test.md (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/pkg/tool/linu-nolocalimports GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuorigin (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1234567890
    • Triggering command: /usr/bin/gh gh api repos/{owner}/{repo}/actions/runs/1234567890 --jq {databaseId: .id, number: .run_number, url: .html_url, status: .status, conclusion: .conclusion, workflowName: .name, workflowPath: .path, createdAt: .created_at, startedAt: .run_started_at, updatedAt: .updated_at, event: .event, headBranch: .head_branch, -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name LsRemoteWithRealGitmaster_branch-ifaceassert 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuremote.origin.url (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name itcustom_branch2795410070/002/work 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuother env -json GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linutest@example.com (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuremote.origin.url (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuupstream env 3414023626/.github/workflows GO111MODULE nutil.test GOINSECURE GOMOD GOMODCACHE nutil.test (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 LsRemoteWithRealGitbranch_with_hyphen4269974779/001' 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuremote1 env y_with_repos=public_3079240458/0-s .cfg .cfg GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/xtest@example.com (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name LsRemoteWithRealGitcustom_branch2795410070/001' 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuremote.origin.url (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 LsRemoteWithRealGitcustom_branch2795410070/001' 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuremote2 (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linumyorg env -json GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE 64/pkg/tool/linu-nolocalimports GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu/tmp/go-build2100409880/b556/_testmain.go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path 743790201/001' 743790201/001' -importcfg /tmp/go-build3299389139/b001/importcfg -pack /tmp/testenv-2082132473/main.go x_amd64/vet env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE 64/pkg/tool/linutest@example.com (http block)
  • https://api.github.com/repos/github/gh-aw/contents/.github/workflows/shared/reporting.md
    • Triggering command: /tmp/go-build2100409880/b470/cli.test /tmp/go-build2100409880/b470/cli.test -test.testlogfile=/tmp/go-build2100409880/b470/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv runs/20260516-213634-31808/aw-manifest-legacy-1323868344/.github/workflows --revs /usr/bin/git url --delta-base-off-1 -q git -C ErrorFormatting694651310/001 remote ache/node/24.14.1/x64/bin/node -json GO111MODULE x_amd64/link ache/node/24.14.1/x64/bin/node (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv se go .cfg GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-extld=gcc (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link (http block)
  • https://api.github.com/repos/github/gh-aw/issues/17
    • Triggering command: /usr/bin/gh gh api repos/github/gh-aw/issues/17 /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/tar.go env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
  • https://api.github.com/repos/google-github-actions/auth/git/ref/tags/v2
    • Triggering command: /usr/bin/gh gh api /repos/google-github-actions/auth/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv t0 go (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv g_.a 0409880/b078/vet.cfg $name) { hasDiscussionsEnabled } } GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuremote.origin.url (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • https://api.github.com/repos/org/repo/pulls/1
    • Triggering command: /usr/bin/gh gh api repos/org/repo/pulls/1 go env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
  • https://api.github.com/repos/owner/repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/owner/repo/actions/secrets --jq .secrets[].name -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo -importcfg /tmp/go-build1232326179/b001/importcfg -pack /tmp/testenv-1955735486/main.go x_amd64/vet env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-remote-workflow --limit 30 --repo owner/repo 64/pkg/tool/linuAdd workflow (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
  • https://api.github.com/repos/test/repo
    • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch rity2215232635/001 0409880/b058/vet.cfg 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)

If you need me to access, download, or install something from one of these locations, you can either:


pr-sous-chef: branch refresh requested in https://github.com/github/gh-aw/actions/runs/25975883485

Generated by 👨‍🍳 PR Sous Chef ·

- Update add_labels.item_number and remove_labels.item_number in
  safe_outputs_tools.json to accept ["number", "string"] with pattern
  ^(\d+|aw_[A-Za-z0-9]{3,12})$ matching actual validator behavior
- Add 'without leading #' clarification to create_issue.parent,
  add_comment.item_number, assign_milestone.issue_number, and
  assign_to_agent.issue_number descriptions
- Update safe_outputs_prompt.md preamble to contrast body-reference
  (#aw_X) vs field-value (aw_X without #) forms, and fix 3–8 → 3–12
  to match actual validator behavior
- Recompile all 229 workflows to propagate new preamble

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/4e4b9f82-1a7b-4c39-8dfe-6a79f36ee669

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
Copilot AI changed the title [WIP] Clarify temporary_id usage in item_number and issue_number fields [safeoutputs] Fix temporary_id '#' prefix confusion in field values (add_labels, remove_labels, and others) May 16, 2026
Copilot AI requested a review from gh-aw-bot May 16, 2026 21:42
@pelikhan pelikhan marked this pull request as ready for review May 16, 2026 21:42
Copilot AI review requested due to automatic review settings May 16, 2026 21:42
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Tightens schema and prompt guidance to fix agents incorrectly passing #aw_* (with a #) as item_number/issue_number/parent field values, while only body references should include the #.

Changes:

  • Allow string temporary IDs in add_labels.item_number and remove_labels.item_number JSON schema (with a regex pattern) instead of number-only.
  • Clarify in several description fields that field-value temporary IDs must be passed without a leading #.
  • Rewrite the temporary_id paragraph in the safe-outputs preamble to disambiguate body references (#aw_X) from field values (aw_X); also corrects the documented length range from 3–8 to 3–12.
Show a summary per file
File Description
pkg/workflow/js/safe_outputs_tools.json Broaden item_number types for add/remove_labels, add regex pattern, and append "without leading '#'" guidance in several descriptions.
actions/setup/md/safe_outputs_prompt.md Replace the single ambiguous temporary_id line with a two-clause explanation distinguishing body references from field values, and fix the length range.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

pkg/workflow/js/safe_outputs_tools.json:657

  • Same issue as in add_labels: this pattern excludes underscores, but the canonical isTemporaryId validator accepts aw_ followed by 3–12 characters from [A-Za-z0-9_] (case-insensitive). IDs like aw_pr_fix would fail schema validation despite being accepted at runtime.
          "pattern": "^(\\d+|aw_[A-Za-z0-9]{3,12})$",
  • Files reviewed: 2/2 changed files
  • Comments generated: 2

Comment thread pkg/workflow/js/safe_outputs_tools.json Outdated
"type": "number",
"description": "Issue or PR number to add labels to. This is the numeric ID from the GitHub URL (e.g., 456 in github.com/owner/repo/issues/456). If omitted, adds labels to the issue or PR that triggered this workflow. Only works for issue or pull_request event triggers. For schedule, workflow_dispatch, or other triggers, item_number is required \u2014 omitting it will silently skip the label operation."
"type": ["number", "string"],
"pattern": "^(\\d+|aw_[A-Za-z0-9]{3,12})$",
Comment thread actions/setup/md/safe_outputs_prompt.md Outdated
```

temporary_id: optional cross-reference field (e.g. use #aw_abc1 in a body). Format: aw_ + 3–8 alphanumeric chars (/^aw_[A-Za-z0-9]{3,8}$/). Omit when not needed.
temporary_id: optional cross-reference field. Format: aw_ + 3–12 alphanumeric chars (/^aw_[A-Za-z0-9]{3,12}$/). When **referencing** a temporary_id in a body or markdown text, use #aw_abc1 — the # is replaced with the real issue/PR number after creation. When using a temporary_id as a **field value** (item_number, issue_number, parent, etc.), pass the raw id without the #: 'aw_abc1'. Omit entirely when not needed.
@pelikhan
Copy link
Copy Markdown
Collaborator

@copilot the safe output JavaScript parser should accept with # or not # prefix.

… to include underscores

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copy link
Copy Markdown
Contributor Author

Copilot AI commented May 16, 2026

@copilot the safe output JavaScript parser should accept with # or not # prefix.

Done in the latest commit. validateIssueNumberOrTemporaryId in safe_output_type_validator.cjs now strips a leading # before calling isTemporaryId, so "#aw_summary" is accepted and normalised to "aw_summary" — mirroring the existing resolveNumberFromTemporaryId behaviour. The JSON schema patterns for add_labels.item_number and remove_labels.item_number were also updated to #?aw_[A-Za-z0-9_]{3,12} (allowing both forms plus underscores), and the preamble now documents that both 'aw_abc1' and '#aw_abc1' are accepted as field values.

Copilot AI requested a review from pelikhan May 16, 2026 21:58
@github-actions
Copy link
Copy Markdown
Contributor

@copilot review all comments and address the unresolved review feedback here, especially the temporary-id regex/doc mismatch.

Generated by 👨‍🍳 PR Sous Chef ·

@github-actions
Copy link
Copy Markdown
Contributor

Please refresh the branch with the remaining safe-outputs fixes and rerun checks so maintainers can review the final state quickly.

Generated by 👨‍🍳 PR Sous Chef ·

@github-actions
Copy link
Copy Markdown
Contributor

Please refresh the branch and rerun checks after the latest fixes.

Generated by 👨‍🍳 PR Sous Chef ·

@github-actions
Copy link
Copy Markdown
Contributor

@copilot review all comments

Please address the unresolved review feedback, then push an updated branch.

Generated by 👨‍🍳 PR Sous Chef ·

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[safeoutputs] Clarify temporary_id usage in item_number/issue_number/parent fields — agents incorrectly prefix with '#'

4 participants