runtime: push_to_pull_request_branch resolves branch/base against workspace root in multi-repo checkout when subrepo origin/HEAD is unset

[heiskr]

Filed by Copilot on behalf of @heiskr. This report is LLM-generated (gh-aw has no llm-generated label).

Reporting a runtime push_to_pull_request_branch failure in multi-repo (siderepo) workflows. It looks related to #41292 and #42256 but is distinct from both.

Environment

• gh-aw compiler v0.82.14. The bundled push handler (actions/setup/js/safe_outputs_handlers.cjs) push logic is byte-identical in v0.83.1, so this is not fixed there.
• A scheduled copilot agentic workflow in a host repo that checks out 7 sibling repos into subdirectories via checkout: with an explicit path: per repo.
• safe-outputs.push-to-pull-request-branch with target: "*" and an allowed-repos list of the 7 repos.

Symptom

The agent commits a fix inside the correct sibling subrepo checkout, provides the target repo and PR head branch to the tool, and the push still fails. Two signatures depending on whether branch is passed:

• Without branch: Detected branch 'main' equals base_branch 'main'. It detected the host repo at the workspace root, which sits on main.
• With branch: Failed to pin branch '<pr-branch>': fatal: Needed a single revision. The rev-parse runs in the workspace root, where that branch does not exist.

The agent never reaches the sibling subrepo. It exhausts retries and calls report_incomplete.

Root cause evidence

The checkout paths are emitted correctly (GH_AW_CHECKOUT_PATH_0..6 each point at a sibling subrepo dir), so this is not #42256 (missing path:). But build_checkout_manifest fails to resolve each subrepo's default branch:

[debug] build_checkout_manifest: git default branch lookup failed for <org>/<sibling>: Command failed: git -C .../<host>/<sibling> symbolic-ref --short refs/remotes/origin/HEAD
fatal: ref refs/remotes/origin/HEAD is not a symbolic ref

This repeats for all 7 subrepos. actions/checkout does not set refs/remotes/origin/HEAD, so the manifest has no default_branch for any sibling. With that missing, the push handler's branch/base detection falls back to the workspace-root repo instead of the resolved repoCwd of the target subrepo, which produces both error signatures above.

Why it differs from the known issues

• apply_samples.cjs ignores target-repo when fetching PR for push_to_pull_request_branch samples in siderepo workflows #41292: that was apply_samples.cjs (compile-time --use-samples replay), fixed in fix: apply_samples derivePrHeadRef uses target-repo config for siderepo PR lookups #41295. This failure is in the live safe_output handler at run time, not sample replay.
• compiler: require (or auto-generate) path: for cross-repo checkout: entries #42256: that is the compiler omitting path:. Here path: is present and paths resolve, yet the push still targets the workspace root.

Suggested directions

1. When origin/HEAD is unset, resolve each subrepo's default branch another way (for example git remote show origin, the GitHub API using the per-repo token in GH_AW_REPO_TOKENS, or the ref actions/checkout already knows) rather than leaving default_branch empty.
2. Independently, the push handler should key branch/base detection off the resolved target-repo repoCwd, and not fall back to the workspace root when the manifest lookup fails.

Happy to share a fuller sanitized log excerpt.