Convert Write Safe Outputs Tools step to actions/github-script with JSON env vars by Copilot · Pull Request #24872 · github/gh-aw

Copilot · 2026-04-06T11:55:13Z

Summary

Converts the "Write Safe Outputs Tools" step (step 31, referenced in https://github.com/github/gh-aw/actions/runs/24028507303/job/70072190053#step:31:1) from shell heredocs + direct node invocation to actions/github-script with JSON payloads passed as environment variables.

Problem

The step was using:

Shell heredocs to write tools_meta.json and validation.json to disk
Direct node ${RUNNER_TEMP}/gh-aw/actions/generate_safe_outputs_tools.cjs invocation

This caused failures (exit code 1 from the node invocation) and is fragile due to direct node invocation.

Changes

`actions/setup/js/generate_safe_outputs_tools.cjs`

Refactored from a top-level standalone script to an exported async function main()
Added support for GH_AW_TOOLS_META_JSON env var: if set, writes the JSON content to tools_meta.json before processing (replaces heredoc)
Added support for GH_AW_VALIDATION_JSON env var: if set, writes the JSON content to validation.json (replaces heredoc)
Replaced process.exit(1) with throw new Error() (actions/github-script handles it properly)
Added require.main === module guard for backward-compatible standalone node execution
Maintained all existing behavior for direct node execution (all 10 vitest tests pass)

`pkg/workflow/mcp_setup_generator.go`

Replaced the heredoc + node invocation step with an actions/github-script step
JSON payloads (toolsMetaJSON, validationConfigJSON) are embedded as YAML literal block scalar env vars (GH_AW_TOOLS_META_JSON, GH_AW_VALIDATION_JSON)
Uses the standard generateGitHubScriptWithRequire("generate_safe_outputs_tools.cjs") pattern

`pkg/workflow/safe_outputs_tools_meta_integration_test.go`

Updated extractToolsMetaFromLockFile to find GH_AW_TOOLS_META_JSON: | env var instead of heredoc delimiter
Updated assertions to check for env var instead of heredoc patterns

Lock files

All 181 workflow .lock.yml files recompiled with the new step format

Generated YAML (before → after)

Before:

- name: Write Safe Outputs Tools
  run: |
    cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/tools_meta.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_META_abc123_EOF'
    {"description_suffixes":{...},...}
    GH_AW_SAFE_OUTPUTS_TOOLS_META_abc123_EOF
    cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_abc123_EOF'
    {...}
    GH_AW_SAFE_OUTPUTS_VALIDATION_abc123_EOF
    node ${RUNNER_TEMP}/gh-aw/actions/generate_safe_outputs_tools.cjs

After:

- name: Write Safe Outputs Tools
  env:
    GH_AW_TOOLS_META_JSON: |
      {"description_suffixes":{...},...}
    GH_AW_VALIDATION_JSON: |
      {...}
  uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
  with:
    script: |
      const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
      setupGlobals(core, github, context, exec, io);
      const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_safe_outputs_tools.cjs');
      await main();

✨ PR Review Safe Output Test - Run 24035225148

💥 [THE END] — Illustrated by Smoke Claude · ● 229.8K · ◷

…SON env vars - Refactor generate_safe_outputs_tools.cjs to export main() function and support GH_AW_TOOLS_META_JSON / GH_AW_VALIDATION_JSON env var payloads - Update mcp_setup_generator.go to generate actions/github-script step instead of heredoc + node invocation - Update integration test to parse tools_meta from env var instead of heredoc - Recompile all 181 workflow lock files Agent-Logs-Url: https://github.com/github/gh-aw/sessions/fb0ab97d-a4d2-4950-b3b7-0112a2c60381 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-04-06T13:22:58Z

Hey @Copilot 👋 — great work on refactoring the "Write Safe Outputs Tools" step! Replacing the fragile shell heredoc + direct node invocation with a clean actions/github-script approach (with JSON payloads via env vars) is a solid improvement in both reliability and maintainability. The PR is well-structured and follows established codebase patterns beautifully.

This PR looks ready for maintainer review:

✅ Focused — single, coherent change (the step refactor) with all 181 lock files correctly recompiled as a natural consequence.
✅ Well described — clear Problem / Changes / Before-After YAML sections make the intent immediately obvious.
✅ Tests updated — safe_outputs_tools_meta_integration_test.go is updated to reflect the new env var pattern, and the PR notes all 10 vitest tests continue to pass.
✅ Follows process — authored via Copilot coding agent with @pelikhan assigned for review, exactly as the contribution guidelines prescribe.

One note: the PR is currently in draft state — when you're happy with the implementation, mark it ready for review so @pelikhan can take a final pass. 🚀

Contribution check result: 🟢 Aligned — lgtm

Generated by Contribution Check · ● 1.8M · ◷

Copilot

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

github-actions · 2026-04-06T14:13:49Z

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

github-actions · 2026-04-06T14:13:50Z

✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready.

github-actions · 2026-04-06T14:13:56Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-04-06T14:14:00Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-04-06T14:16:49Z

Agent Container Tool Check

Tool	Status	Version
bash	✅	5.2.21
sh	✅	available
git	✅	2.53.0
jq	✅	1.7
yq	✅	v4.52.5
curl	✅	8.5.0
gh	✅	2.89.0
node	✅	v20.20.2
python3	✅	3.12.3
go	✅	1.24.13
java	✅	21.0.10
dotnet	✅	10.0.201

Result: 12/12 tools available ✅

Overall Status: PASS

🔧 Tool validation by Agent Container Smoke Test · ● 232K · ◷

github-actions · 2026-04-06T14:22:19Z

@Copilot @pelikhan — smoke test §24035225161 results:

Test	Status
GitHub MCP reads	✅
mcpscripts-gh CLI	✅
Serena MCP	⚠️ skipped
Playwright	❌ permission issue
Web fetch	✅
File I/O + bash	✅
Discussion comment	✅
Build gh-aw	✅
Discussion creation	✅
Workflow dispatch	✅
PR review	✅

Overall: ⚠️ PARTIAL PASS (10/11 operational tests passed; Playwright env issue)

📰 BREAKING: Report filed by Smoke Copilot · ● 1.6M · ◷

github-actions

This PR cleanly replaces fragile heredoc + direct node invocation with actions/github-script and env var JSON payloads. The refactoring is well-structured: generate_safe_outputs_tools.cjs gains a proper exported main(), error handling uses throw instead of process.exit(1), and the test updates correctly reflect the new GH_AW_TOOLS_META_JSON pattern. Nice work!

📰 BREAKING: Report filed by Smoke Copilot · ● 1.6M

github-actions · 2026-04-06T14:22:20Z

actions/setup/js/generate_safe_outputs_tools.cjs

+if (require.main === module) {
+  main().catch(err => {
+    process.exit(1);
+  });
 }


Good refactor — exporting main and guarding with require.main === module preserves backward compatibility while enabling actions/github-script integration. The throw new Error(msg) pattern also lets the caller handle failures cleanly instead of process.exit(1).

github-actions · 2026-04-06T14:22:20Z

pkg/workflow/mcp_setup_generator.go

+		fmt.Fprintf(yaml, "        uses: %s\n", GetActionPin("actions/github-script"))
+		yaml.WriteString("        with:\n")
+		yaml.WriteString("          script: |\n")
+		yaml.WriteString(generateGitHubScriptWithRequire("generate_safe_outputs_tools.cjs"))

 		// Note: The MCP server entry point (mcp-server.cjs) is now copied by actions/setup


Using YAML literal block scalar env vars instead of heredocs is a cleaner approach — no randomized delimiters needed, and actions/github-script handles the JSON payload safely. This should resolve the fragile heredoc + direct node invocation issue.

github-actions · 2026-04-06T14:22:47Z

Smoke Test 24035225148 — PARTIAL

Core (#1–12): ✅✅✅✅✅❌✅✅✅✅✅✅
PR Review (#13–19): ✅✅✅⚠️✅✅⚠️

❌ #6 Tavily: rate limited (429)
⚠️ #16 Resolve thread: skipped (no threads)
⚠️ #19 Close PR: skipped (no test PR)

💥 [THE END] — Illustrated by Smoke Claude · ● 229.8K · ◷

github-actions

💥 Automated smoke test review - all systems nominal!

💥 [THE END] — Illustrated by Smoke Claude · ● 229.8K

github-actions · 2026-04-06T14:22:50Z

.github/workflows/agent-performance-analyzer.lock.yml

+            {
+              "description_suffixes": {
+                "add_comment": " CONSTRAINTS: Maximum 10 comment(s) can be added.",
+                "create_discussion": " CONSTRAINTS: Maximum 2 discussion(s) can be created.",


The migration from run: | heredoc to actions/github-script with JSON env vars is a clean approach. Consider adding a comment to document why JSON env vars are preferred over heredoc for future maintainers.

github-actions · 2026-04-06T14:22:50Z

.github/workflows/agent-persona-explorer.lock.yml

+          GH_AW_TOOLS_META_JSON: |
+            {
+              "description_suffixes": {
+                "create_discussion": " CONSTRAINTS: Maximum 1 discussion(s) can be created. Discussions will be created in category \"agent-research\"."


Consistent pattern with other lock files - good to see the migration is applied uniformly across all workflows. The GH_AW_TOOLS_META_JSON and GH_AW_VALIDATION_JSON env var approach improves readability.

github-actions · 2026-04-06T14:23:11Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

Copilot AI assigned Copilot and pelikhan Apr 6, 2026

Copilot created this pull request from a session on behalf of pelikhan April 6, 2026 11:56 View session

Copilot finished work on behalf of pelikhan April 6, 2026 11:56

Copilot AI requested a review from pelikhan April 6, 2026 11:56

This was referenced Apr 6, 2026

[PR Triage Report] PR Triage Report - 2026-04-06 #24880

Closed

Smoke Test: Copilot - 24032487186 #24886

Closed

github-actions bot added the lgtm label Apr 6, 2026

github-actions bot mentioned this pull request Apr 6, 2026

[Contribution Check Report] Contribution Check Report — 2026-04-06 #24804

Closed

pelikhan marked this pull request as ready for review April 6, 2026 13:39

Copilot AI review requested due to automatic review settings April 6, 2026 13:39

Copilot AI reviewed Apr 6, 2026

View reviewed changes

pelikhan added the smoke label Apr 6, 2026

github-actions bot removed the smoke label Apr 6, 2026

github-actions bot mentioned this pull request Apr 6, 2026

Smoke Test: Copilot - 24035225161 #24898

Closed

github-actions bot added the smoke-copilot label Apr 6, 2026

github-actions bot reviewed Apr 6, 2026

View reviewed changes

github-actions bot mentioned this pull request Apr 6, 2026

Smoke Test: Claude - 24035225148 #24900

Closed

github-actions bot added the smoke-claude label Apr 6, 2026

github-actions bot reviewed Apr 6, 2026

View reviewed changes

pelikhan merged commit 41a92e7 into main Apr 6, 2026
301 of 303 checks passed

pelikhan deleted the copilot/update-compiler-actions-github-script branch April 6, 2026 14:24

Conversation

Copilot AI commented Apr 6, 2026 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Problem

Changes

actions/setup/js/generate_safe_outputs_tools.cjs

pkg/workflow/mcp_setup_generator.go

pkg/workflow/safe_outputs_tools_meta_integration_test.go

Lock files

Generated YAML (before → after)

Uh oh!

github-actions bot commented Apr 6, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 6, 2026

Uh oh!

github-actions bot commented Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 6, 2026

Agent Container Tool Check

Uh oh!

github-actions bot commented Apr 6, 2026

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Apr 6, 2026

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Apr 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Apr 6, 2026 •

edited by github-actions bot

Loading

`actions/setup/js/generate_safe_outputs_tools.cjs`

`pkg/workflow/mcp_setup_generator.go`

`pkg/workflow/safe_outputs_tools_meta_integration_test.go`

github-actions bot commented Apr 6, 2026 •

edited

Loading

github-actions bot commented Apr 6, 2026 •

edited

Loading

github-actions bot commented Apr 6, 2026 •

edited

Loading