Prevent safe-outputs startup regressions in daily workflows

[Copilot]

Three daily workflows (Documentation Healer, Model Inventory Checker, Sentrux Report) kept failing after prior issue closure due to a shared runtime crash in safe-outputs startup (MODULE_NOT_FOUND for safe_outputs_mcp_arguments.cjs). This PR addresses the common failure point instead of workflow-specific symptoms.

• Root-cause correction (shared startup path)

  • Updated actions/setup/sh/start_safe_outputs_server.sh to require safe_outputs_mcp_arguments.cjs in REQUIRED_DEPS.
  • This aligns startup preflight checks with the actual module graph used by safe_outputs_mcp_server_http.cjs.

• Regression guard

  • Added actions/setup/js/start_safe_outputs_server.test.cjs to assert the startup script explicitly includes safe_outputs_mcp_arguments.cjs in dependency validation.
  • Prevents future drift between server imports and startup dependency checks.

• Why this resolves all three failures

  • All three workflows fail in the same safe-outputs initialization stage; fixing the shared setup script removes the common crash condition.

# actions/setup/sh/start_safe_outputs_server.sh
REQUIRED_DEPS=(
  "safe_outputs_mcp_server_http.cjs"
  "safe_outputs_mcp_arguments.cjs"
  "mcp_http_transport.cjs"
  ...
)

---

Generated by 👨‍🍳 PR Sous Chef · 43.8 AIC · ⌖ 5 AIC · ◷

[github-actions]

Hey @pelikhan 👋 — nice detective work tracing the Documentation Healer, Model Inventory, and Sentrux failures back to a single missing entry in REQUIRED_DEPS. The fix in start_safe_outputs_server.sh is clean, and the new start_safe_outputs_server.test.cjs test gives confidence it won't regress.

One thing that would help reviewers before marking this ready:

• Add a prose description — the PR body is a task checklist, but there's no explanation of what the root cause was (missing safe_outputs_mcp_arguments.cjs in REQUIRED_DEPS), why that caused failures in those three specific workflows, or why the GH_AW_TIMEOUT_MINUTES value was propagated to all 156+ lock files as part of this fix. A short paragraph covering those points would make the intent clear to reviewers without them having to diff-read 158 files.

There's also one unchecked task remaining (security/quality validation), so this looks intentionally still in draft — just flagging the description gap for when it's ready to be promoted.

If you'd like a hand, you can assign this prompt to your coding agent:

Update the PR body for PR #37272 in github/gh-aw.

Replace the bare task checklist with a concise prose description followed by the checklist. The description should cover:
1. Root cause: `safe_outputs_mcp_arguments.cjs` was missing from the `REQUIRED_DEPS` array in `actions/setup/sh/start_safe_outputs_server.sh`, causing the safe-outputs MCP server to fail to start for workflows that depend on it (Daily Documentation Healer, Daily Model Inventory Checker, Daily Sentrux Report).
2. Fix: added the missing dependency to `REQUIRED_DEPS` and added a regression test in `actions/setup/js/start_safe_outputs_server.test.cjs`.
3. Scope of lock-file changes: explain why `GH_AW_TIMEOUT_MINUTES` was added to all 156+ `.lock.yml` files (e.g., hardening all workflows against timeout-related failures identified during investigation).
Keep the existing task checklist at the bottom.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• patchdiff.githubusercontent.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "patchdiff.githubusercontent.com"

See Network Configuration for more information.

Generated by ✅ Contribution Check · 762.4 AIC · ⌖ 13.6 AIC · ◷

[Copilot]

Pull request overview

This PR hardens safe-outputs startup by aligning the startup preflight validation with the safe-outputs HTTP server’s runtime module dependencies, preventing MODULE_NOT_FOUND regressions that can break multiple daily workflows that share the same safe-outputs bootstrap path.

Changes:

• Added safe_outputs_mcp_arguments.cjs to the startup script’s REQUIRED_DEPS validation list.
• Added a Vitest unit test asserting the startup script validates safe_outputs_mcp_arguments.cjs before server startup.

Show a summary per file

File	Description
actions/setup/sh/start_safe_outputs_server.sh	Expands preflight dependency validation to cover an additional server dependency.
actions/setup/js/start_safe_outputs_server.test.cjs	Adds a regression test to prevent dependency-check drift in the startup script.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 1

[github-actions]

Refresh the branch and rerun checks, then summarize any remaining blockers.

Generated by 👨‍🍳 PR Sous Chef · 43.8 AIC · ⌖ 5 AIC · ◷