Fix: include custom jobs, scripts, and actions in `<safe-output-tools>` prompt block by Copilot · Pull Request #23487 · github/gh-aw

Copilot · 2026-03-29T20:50:44Z

Custom safe-output entries (jobs, scripts, actions) were wired into the compiled YAML but silently omitted from the <safe-output-tools> prompt block, causing the agent's instructions to diverge from the actual runtime tool surface.

Changes

unified_prompt_step.go — buildSafeOutputsSections: After building the predefined tool list, appends normalized names (dashes→underscores, sorted for determinism) from SafeOutputsConfig.Jobs, .Scripts, and .Actions.

# Before — only predefined tools appeared:
Tools: add_comment, create_issue, noop

# After — custom entries are included:
Tools: add_comment, create_issue, noop, deploy, notify, my_action

safe_outputs_prompt_tools_test.go (new): Table-driven tests covering each custom type, name normalization, sort ordering, and a consistency check asserting every custom entry in the config has a corresponding entry in the compiled prompt block.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw **/*.cjs ache/go/1.25.0/x--show-toplevel git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE hutil.test git (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git ch /opt/hostedtoolcrev-parse /usr/bin/git git (http block)
https://api.github.com/orgs/test-owner/actions/secrets
- Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE de_modules/.bin/GOMODCACHE GOINSECURE GOMOD GOMODCACHE go env '**/*.ts' '**/*.GOINSECURE GO111MODULE 64/bin/sh GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/gh -json GO111MODULE 64/bin/go gh (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel 64/pkg/tool/linurev-parse /usr/bin/git git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v3
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha --noprofile GOPROXY ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet GOSUMDB GOWORK 64/bin/go ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha 64/bin/go git /usr/bin/git --show-toplevel go /usr/lib/git-cor--show-toplevel git rev-�� --show-toplevel /usr/lib/git-cor--package-lock-only /usr/bin/git REDACTED x_amd64/vet /usr/bin/git git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v5
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha "prettier" --check '**/*.cjs' '**/*.ts' '**/*.jsGOINSECURE GOPROXY ndor/bin/bash GOSUMDB GOWORK 64/bin/go go env -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha GOMODCACHE go /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel go /usr/bin/git 0143-41295/test-git GO111MODULE 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/compile 0/x64/bin/node g_.a g/repoutil/repourev-parse /opt/hostedtoolc--show-toplevel git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha /tmp/go-build3097436317/b454/_pkg_.a -trimpath /usr/bin/git -p main -lang=go1.25 git rev-�� --git-dir -dwarf=false /usr/bin/git go1.25.0 -c=4 -nolocalimports git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha /tmp/TestHashStability_SameInputSameOutput3340469783/001/stability-test.md go /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE ache/go/1.25.0/x--show-toplevel git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE /opt/hostedtoolc--show-toplevel git (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v8
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 0/x64/bin/node GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE ache/go/1.25.0/xGOMODCACHE GOINSECURE GOMOD GOMODCACHE go tion�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE 86_64/node GOINSECURE GOMOD GOMODCACHE go 0/x6�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git -C /tmp/gh-aw-test-runs/20260329-210143-41295/test-4037805142 rev-parse /usr/bin/git @{u} GO111MODULE 64/bin/go git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git rev-�� --show-toplevel PATH"; [ -n "$GOROOT" ] && expo /usr/bin/gh --show-toplevel 64/pkg/tool/linurev-parse /usr/bin/git gh (http block)
https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha /tmp/TestHashStability_SameInputSameOutput3340469783/001/stabili-errorsas go /usr/bin/git -template-expresgit GO111MODULE 64/bin/go git rev-�� --show-toplevel go /opt/hostedtoolcache/node/24.14.0/x64/bin/node -json GO111MODULE 64/bin/go node (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel ger.test /usr/bin/git git (http block)
https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha runs/20260329-210143-41295/test-3010155653/.github/workflows GO111MODULE 7436317/b308/vet.cfg l GOMOD GOMODCACHE go env -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linu^remote\..*\.gh-resolved$ (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha --show-toplevel git /usr/bin/git .github/workflowgit go /usr/bin/unpigz git rev-�� --show-toplevel /usr/bin/unpigz /usr/bin/infocmp -c go /usr/bin/git infocmp (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha /tmp/go-build3097436317/b450/testutil.test -importcfg /usr/bin/git -s -w -buildmode=exe git rev-�� --git-dir -extld=gcc /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha 0143-41295/test-4037805142 GO111MODULE 7436317/b390/vet.cfg l GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel git /usr/bin/git GOMODCACHE go 7436317/b465/vet--show-toplevel git rev-�� --show-toplevel git /usr/bin/git GOMODCACHE go /usr/bin/gh git (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE 7436317/b388/vet.cfg GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 7436317/b448/styles.test GOINSECURE GOMOD GOMODCACHE 7436317/b448/styles.test (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha --show-toplevel git /usr/bin/git --get remote.origin.urrev-parse /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
- Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE OT/XsnwPQlVgjjkPano75dw/KS7vWdv67GlQHo_qCXr1 (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
- Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env e-analyzer.md GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
- Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
- Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env e-analyzer.md GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
- Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE npx (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
- Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
- Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node (http block)
https://api.github.com/repos/github/gh-aw/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path -json GO111MODULE ache/go/1.25.0/xGOMODCACHE GOINSECURE GOMOD GOMODCACHE go env '**/*.ts' '**/*.GOINSECURE GO111MODULE ache/go/1.25.0/xGOMODCACHE GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE 64/pkg/tool/linu-buildtags env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel x_amd64/link /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel mB/sjFzGmkD50VkgymAEVTh/scadxqNZcVILi6xfvgbr /usr/bin/git prettier --check x_amd64/vet git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel 64/pkg/tool/linurev-parse /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 7Q/OVEEPPXF-qDUl4STcQP9/rdcaY69Wrev-parse -c mpiledOutput1440711025/001 GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel go /usr/bin/git ithub-script/gitgit GO111MODULE /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel go /usr/bin/git -json l /home/REDACTED/.co--show-toplevel git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha */*.ts' '**/*.jsGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha */*.ts' '**/*.jsGOINSECURE GO111MODULE 64/bin/go hen \ echo "JSO/opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/compile GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE hp-7uZoDVICB env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha */*.ts' '**/*.jsGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh -c edOutput3206255799/001 GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go git (http block)
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile /usr/bin/git 7436317/b425/_pkgit GO111MODULE 7436317/b425=> git rev-�� --show-toplevel go /usr/bin/git runs/20260329-21git GO111MODULE 0/x64/bin/node git (http block)
https://api.github.com/repos/nonexistent/repo/actions/runs/12345
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE sh -c 114050945/.github/workflows GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go sh (http block)
https://api.github.com/repos/owner/repo/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo ache/go/1.25.0/xGOMODCACHE GOINSECURE GOMOD GOMODCACHE go env '**/*.ts' '**/*.GOINSECURE GO111MODULE ode GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo ache/go/1.25.0/xGOMODCACHE GOINSECURE GOMOD GOMODCACHE go env '**/*.ts' '**/*.GOINSECURE GO111MODULE n-dir/node GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/owner/repo/contents/file.md
- Triggering command: /tmp/go-build3097436317/b404/cli.test /tmp/go-build3097436317/b404/cli.test -test.testlogfile=/tmp/go-build3097436317/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE bin/node GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/test-owner/test-repo/actions/secrets
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -json GO111MODULE 0/x64/bin/node GOINSECURE GOMOD igFiles,SwigCXXF-json go 0/x6�� -json GO111MODULE n-dir/sh GOINSECURE GOMOD GOMODCACHE go (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.

… prompt block The buildSafeOutputsSections function now includes custom jobs (SafeOutputsConfig.Jobs), scripts (SafeOutputsConfig.Scripts), and actions (SafeOutputsConfig.Actions) in the compiled <safe-output-tools> prompt section, preventing silent drift between the runtime configuration surface and the agent-facing compiled instructions. Agent-Logs-Url: https://github.com/github/gh-aw/sessions/c4791b62-2306-4194-adbd-6a5c94ba32ef Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

Fixes a mismatch where custom safe-output entries (jobs, scripts, actions) were present in the compiled workflow/tool surface but omitted from the <safe-output-tools> prompt block shown to the agent.

Changes:

Update buildSafeOutputsSections to append normalized, deterministically-sorted custom tool names from SafeOutputsConfig.Jobs, .Scripts, and .Actions.
Add a new unit test file to validate custom tool inclusion, normalization, and consistency between config and prompt block.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
pkg/workflow/unified_prompt_step.go	Adds custom jobs/scripts/actions into the `<safe-output-tools>` prompt tools list (normalized + sorted for determinism).
pkg/workflow/safe_outputs_prompt_tools_test.go	Adds table-driven tests to ensure custom safe-output entries appear in the compiled prompt tools block.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-29T21:14:38Z

pkg/workflow/safe_outputs_prompt_tools_test.go

+			assert.ElementsMatch(t, tt.expectedTools, actualToolNames,
+				"Tool names in <safe-output-tools> should match expected set")


assert.ElementsMatch ignores ordering, so the test cases claiming deterministic sorting (e.g., "multiple custom jobs are sorted") will still pass even if the tool list is emitted in the wrong order. Use an order-sensitive assertion (e.g., compare the parsed slice with assert.Equal) for the cases that are intended to validate sorting/determinism (or add a separate order check).

Suggested change

assert.ElementsMatch(t, tt.expectedTools, actualToolNames,

"Tool names in <safe-output-tools> should match expected set")

assert.Equal(t, tt.expectedTools, actualToolNames,

"Tool names in <safe-output-tools> should match expected order and set")

Copilot · 2026-03-29T21:14:39Z

pkg/workflow/safe_outputs_prompt_tools_test.go

+	// Concatenate all non-file section content to find the tools block
+	var toolsBuilder strings.Builder
+	for _, section := range sections {
+		if !section.IsFile {
+			toolsBuilder.WriteString(section.Content)
+			toolsBuilder.WriteString("\n")
+		}
+	}
+	toolsContent := toolsBuilder.String()
+
+	// Every custom job name (normalized) must appear in the tools list
+	for jobName := range config.Jobs {
+		normalizedName := strings.ReplaceAll(jobName, "-", "_")
+		assert.Contains(t, toolsContent, normalizedName,
+			"Custom job %q (normalized: %q) should appear in <safe-output-tools>", jobName, normalizedName)
+	}
+
+	// Every custom script name (normalized) must appear in the tools list
+	for scriptName := range config.Scripts {
+		normalizedName := strings.ReplaceAll(scriptName, "-", "_")
+		assert.Contains(t, toolsContent, normalizedName,
+			"Custom script %q (normalized: %q) should appear in <safe-output-tools>", scriptName, normalizedName)
+	}
+
+	// Every custom action name (normalized) must appear in the tools list
+	for actionName := range config.Actions {
+		normalizedName := strings.ReplaceAll(actionName, "-", "_")
+		assert.Contains(t, toolsContent, normalizedName,
+			"Custom action %q (normalized: %q) should appear in <safe-output-tools>", actionName, normalizedName)
+	}


This consistency test is currently substring-based (assert.Contains on concatenated section content). That can produce false positives (e.g., a custom tool name that is a substring of another token or appears in some other inline section text), so it may not actually detect drift. Consider extracting/parsing the actual Tools: ... line and asserting exact tool identifiers (and reuse stringutil.NormalizeSafeOutputIdentifier for normalization instead of duplicating strings.ReplaceAll).

pelikhan · 2026-03-29T21:27:43Z

@copilot review comments

- Use assert.Equal (order-sensitive) instead of assert.ElementsMatch so sorting/determinism test cases actually validate emission order - Rewrite consistency test to parse the exact Tools: line into a set of identifiers and assert membership, using stringutil.NormalizeSafeOutputIdentifier instead of strings.ReplaceAll to avoid false positives from substring matches - Extract helper extractToolNamesFromSections to avoid duplication Agent-Logs-Url: https://github.com/github/gh-aw/sessions/88d2ab26-99ab-40e0-8b1f-04dd925ae6a1 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-03-29T21:34:24Z

@copilot review comments

Both review comments addressed in bac5ffa:

Changed assert.ElementsMatch → assert.Equal so order-sensitive test cases (e.g. "multiple custom jobs are sorted") actually validate emission order.
Rewrote the consistency test to parse the exact Tools: line into a set of identifiers and check membership, using stringutil.NormalizeSafeOutputIdentifier instead of strings.ReplaceAll. Extracted a shared extractToolNamesFromSections helper to avoid duplicating the parsing logic.

Initial plan

07198b6

Copilot AI assigned Copilot and pelikhan Mar 29, 2026

Copilot started work on behalf of pelikhan March 29, 2026 20:50 View session

Copilot AI linked an issue Mar 29, 2026 that may be closed by this pull request

Compiled <safe-output-tools> can omit custom safe-output tools/jobs #23484

Closed

Copilot AI changed the title ~~[WIP] Fix omission of custom safe-output tools in compiled prompt~~ Fix: include custom jobs, scripts, and actions in <safe-output-tools> prompt block Mar 29, 2026

Copilot finished work on behalf of pelikhan March 29, 2026 21:07

Copilot AI requested a review from pelikhan March 29, 2026 21:07

pelikhan marked this pull request as ready for review March 29, 2026 21:10

Copilot AI review requested due to automatic review settings March 29, 2026 21:10

Copilot started reviewing on behalf of pelikhan March 29, 2026 21:11 View session

Copilot AI reviewed Mar 29, 2026

View reviewed changes

Copilot started work on behalf of pelikhan March 29, 2026 21:27 View session

Copilot finished work on behalf of pelikhan March 29, 2026 21:35

pelikhan approved these changes Mar 29, 2026

View reviewed changes

pelikhan merged commit 3caa109 into main Mar 29, 2026
57 checks passed

pelikhan deleted the copilot/fix-omit-custom-safe-output-tools branch March 29, 2026 23:47

github-actions bot mentioned this pull request Mar 30, 2026

[docs] Update documentation for features from 2026-03-30 #23503

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix: include custom jobs, scripts, and actions in `<safe-output-tools>` prompt block#23487

Fix: include custom jobs, scripts, and actions in `<safe-output-tools>` prompt block#23487
pelikhan merged 3 commits intomainfrom
copilot/fix-omit-custom-safe-output-tools

Copilot AI commented Mar 29, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 29, 2026

Uh oh!

Copilot AI Mar 29, 2026

Uh oh!

pelikhan commented Mar 29, 2026

Uh oh!

Copilot AI commented Mar 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		assert.ElementsMatch(t, tt.expectedTools, actualToolNames,
		"Tool names in <safe-output-tools> should match expected set")

Conversation

Copilot AI commented Mar 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Mar 29, 2026

Uh oh!

Copilot AI commented Mar 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Mar 29, 2026 •

edited

Loading