Remove partial-clone blob filtering from safe-outputs ref fetches

[Copilot]

The safe-outputs push flow was reintroducing --filter=blob:none when fetching additional refs, leaving the repo in a partial-clone state even though this job needs to check out branches and read blobs reliably. This change keeps the shallow fetch behavior but stops suppressing blob transfer for the follow-up fetch.

• Fetch behavior

  • Remove --filter=blob:none from the generated git fetch command in the safe-outputs ref-fetch step.
  • Preserve --depth=<n> so the job still mirrors checkout depth without forcing a full-history fetch.

• Test coverage

  • Update focused workflow-generation tests to assert that safe-outputs fetch steps no longer emit the blob filter.
  • Keep existing expectations around refspecs, job conditions, and depth flags.

• Generated command shape

  git -c "http.extraheader=Authorization: Basic ${header}" fetch origin --depth=20 \
    '+refs/heads/master:refs/remotes/origin/master' \
    '+refs/heads/dsyme/n-plus-1/*:refs/remotes/origin/dsyme/n-plus-1/*'

[github-actions]

Hey @copilot 👋 — thanks for picking up this fix! Removing --filter=blob:none from the safe-outputs fetch step is a solid, well-scoped improvement that addresses the latency and reliability concerns described in the issue.

A couple of things to address before this is ready for review:

• No code changes yet — the PR currently has 0 lines changed (additions + deletions = 0). The actual fix — removing --filter=blob:none from the generated fetch command in the safe-outputs/push job — still needs to be implemented.
• Missing description — once the fix is in, please add a short PR body summarising what was changed and where (e.g. which template, generator, or rendered workflow file was updated), rather than only carrying the original issue text.
• No tests — if there are existing tests for the fetch-command generation or safe-outputs workflow rendering, please add or update a test to assert that --filter=blob:none is absent when filter: '' is set.

If you'd like a hand completing this, you can assign the following prompt to your coding agent:

Fix the safe-outputs/push job so that the generated fetch command does not include --filter=blob:none.

Steps:
1. Find where the fetch command for the safe-outputs push job is generated (likely a template or Go/JS code that builds the git fetch invocation).
2. Remove the --filter=blob:none flag from that generated command. Ensure that when the workflow source specifies `filter: ''`, no --filter flag is emitted at all.
3. Add or update a test that asserts the generated fetch command for the safe-outputs job does NOT contain --filter=blob:none.
4. Update the PR description with a clear summary of what was changed and why.

Generated by ✅ Contribution Check · sonnet46 2.6M · ◷

[Copilot]

Pull request overview

This PR adjusts the safe-outputs workflow generation so that the “fetch additional refs” step no longer performs a blobless/partial-clone fetch (--filter=blob:none), while still mirroring the checkout’s shallow depth via --depth=<n>. This prevents the safe-outputs job from inadvertently leaving the repository in a partial-clone state that can break later operations requiring blob access.

Changes:

• Remove --filter=blob:none from the generated git fetch command used in the safe-outputs “Fetch additional refs” step.
• Keep --depth=<n> behavior to avoid expanding shallow clones during the follow-up ref fetch.
• Update workflow-generation tests to assert the fetch step does not emit --filter=blob:none.

Show a summary per file

File	Description
pkg/workflow/compiler_safe_outputs_steps.go	Removes blob filtering from the safe-outputs additional-ref fetch command while preserving depth mirroring.
pkg/workflow/compiler_safe_outputs_steps_test.go	Updates expectations to ensure generated safe-outputs fetch steps do not include --filter=blob:none.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0