Add `disclosure-header` message for AI authorship disclosure in safe-outputs by Copilot · Pull Request #44497 · github/gh-aw

Copilot · 2026-07-09T05:34:46Z

Every workflow using safe-outputs under a maintainer PAT currently needs to repeat the same AI authorship boilerplate string across all 20+ workflows. This adds a first-class disclosure-header opt-in that prepends a built-in AI authorship notice to every safe-output body (issues, comments, PRs, discussions).

Changes

Go (SafeOutputMessagesConfig): New DisclosureHeader string field with yaml:"disclosure-header" / json:"disclosureHeader" tags. Parser handles both bool (true → sentinel "true") and custom string.
JS (messages_header.cjs): New getDisclosureHeader() alongside getBodyHeader(). When value is "true", renders the built-in DEFAULT_DISCLOSURE_HEADER; otherwise renders the value as a template.
4 handlers (create_issue, add_comment, create_discussion, create_pull_request): Inject disclosure header after any threat-detection caution and before body-header.
JSON schema (main_workflow_schema.json): disclosure-header as oneOf: [boolean, string] with explicit ordering docs.

Usage

safe-outputs:
  messages:
    disclosure-header: true   # built-in default
    # or
    disclosure-header: "> 🤖 Custom notice by [{workflow_name}]({run_url})."

Default text:

🤖 Automated content — generated by the Workflow workflow. The account owner did not write or review this content personally.

Body ordering (top → bottom): threat-detection caution → disclosure-header → body-header → agent content → footer.

Generated by 👨‍🍳 PR Sous Chef · 10.4 AIC · ⌖ 5.15 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Adds a new `disclosure-header` configuration option to `safe-outputs.messages` that prepends an AI authorship disclosure to every message body (issues, comments, pull requests, discussions). - Set `disclosure-header: true` to use the built-in default text: "> 🤖 **Automated content** — generated by the [{workflow_name}]({run_url}) workflow. The account owner did **not** write or review this content personally." - Set `disclosure-header: "<template>"` to use a custom template string - Supports `{workflow_name}` and `{run_url}` placeholders The disclosure header is inserted after any threat-detection caution alert and before any `body-header` and the main body content. Closes #38566 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-07-09T11:01:51Z

🔍 Design Decision Gate 🏗️ is checking for design decision records on this pull request...

Copilot

Pull request overview

Note

Copilot couldn't run its full agentic review because no GitHub Actions runner was available. Make sure your repository has a runner available to run Copilot's review, or add a copilot-setup-steps.yml file specifying one with the runs-on attribute. See the docs for more details.

Adds an opt-in disclosure-header safe-outputs message that prepends an AI authorship notice (default or custom template) to generated issue/comment/PR/discussion bodies, reducing boilerplate across workflows.

Changes:

Extend Go safe-outputs messages config to parse/serialize disclosure-header (bool → sentinel "true" or custom string).
Add JavaScript getDisclosureHeader() + default built-in disclosure text, and re-export via messages.cjs.
Inject disclosure header into multiple handlers and document the new option in the workflow JSON schema; add unit tests (Go + JS).

Show a summary per file

File	Description
pkg/workflow/safe_outputs_messages_test.go	Adds Go tests for parsing + JSON serialization of `disclosure-header`.
pkg/workflow/safe_outputs_messages_config.go	Implements Go parsing for `disclosure-header` (bool/string).
pkg/workflow/safe_outputs_config_types.go	Adds `DisclosureHeader` field + tags to messages config type.
pkg/parser/schemas/main_workflow_schema.json	Documents + validates `disclosure-header` in schema via `oneOf` boolean/string.
actions/setup/js/messages_header.test.cjs	Adds JS tests for `getDisclosureHeader()` + default template constant.
actions/setup/js/messages_header.cjs	Implements `DEFAULT_DISCLOSURE_HEADER` + `getDisclosureHeader()`.
actions/setup/js/messages.cjs	Re-exports `getDisclosureHeader`.
actions/setup/js/create_pull_request.cjs	Injects disclosure header into PR body assembly.
actions/setup/js/create_issue.cjs	Injects disclosure header into issue body assembly.
actions/setup/js/create_discussion.cjs	Injects disclosure header into discussion body assembly.
actions/setup/js/add_comment.cjs	Injects disclosure header into comment prefix assembly.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 11/11 changed files
Comments generated: 5
Review effort level: Low

Copilot · 2026-07-09T14:15:23Z

+  describe("getDisclosureHeader", () => {
+    it("returns empty string when disclosure-header is not configured", () => {
+      const result = getDisclosureHeader({ workflowName: WORKFLOW, runUrl: RUN_URL });
+      expect(result).toBe("");
+    });


Fixed in 259ec46. actions/setup/js/messages_header.test.cjs now clears GH_AW_SAFE_OUTPUT_MESSAGES in beforeEach, so getDisclosureHeader tests are isolated and order-independent.

Copilot · 2026-07-09T14:15:23Z

+function getDisclosureHeader(ctx) {
+  const messages = getMessages();
+  if (!messages?.disclosureHeader) {
+    return "";
+  }
+
+  const templateContext = toSnakeCase(ctx);
+  const template = messages.disclosureHeader === "true" ? DEFAULT_DISCLOSURE_HEADER : messages.disclosureHeader;
+  return renderTemplate(template, templateContext);
+}


Addressed in 259ec46. getDisclosureHeader() now normalizes disclosureHeader values: boolean true and sentinel string use the default template, string values are rendered, and non-string/falsey values return an empty header.

Copilot · 2026-07-09T14:15:23Z

+    // Inject disclosure header before body header (unshifted after, so it appears first)
+    const disclosureHeader = getDisclosureHeader({ workflowName, runUrl });
+    if (disclosureHeader) {
+      bodyLines.unshift(...disclosureHeader.split("\n"), "");
+    }


Updated in 259ec46. The inline comment was clarified to match the actual flow: disclosure-header is unshifted after body-header in code order but appears above it in output due to prepend semantics (same adjustment applied where this pattern appears).

Copilot · 2026-07-09T14:15:23Z

+                {
+                  "type": "boolean",
+                  "description": "Set to true to prepend the built-in AI authorship disclosure header to every message body (issues, comments, pull requests, discussions). The default text states the content was automatically generated and was not written or reviewed by the account owner personally."
+                },


Handled in 259ec46. The schema/docs now explicitly define boolean false as disabling disclosure-header, removing ambiguity while keeping boolean input support.

Copilot · 2026-07-09T14:15:23Z

+	if dh, exists := messagesMap["disclosure-header"]; exists {
+		switch v := dh.(type) {
+		case bool:
+			if v {
+				config.DisclosureHeader = "true"
+			}
+		case string:
+			config.DisclosureHeader = v
+		}
+	}


Implemented in 259ec46. Introduced named sentinel constants and reused them in Go/JS parsing and disclosure-header rendering paths to avoid magic-string drift across languages.

pelikhan · 2026-07-09T11:50:41Z

/matt

github-actions · 2026-07-09T11:51:37Z

🧠 Matt Pocock Skills Reviewer failed during the skills-based review.

gh-aw-bot · 2026-07-09T12:23:14Z

@copilot please run the pr-finisher skill, address unresolved review feedback, and rerun checks once the branch update settles.

Unresolved review feedback to address first:

copilot-pull-request-reviewer review feedback remains open.

Run: https://github.com/github/gh-aw/actions/runs/29016118662

Generated by 👨‍🍳 PR Sous Chef · 10.4 AIC · ⌖ 5.15 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-07-09T13:08:31Z

@copilot please run the pr-finisher skill, address unresolved review feedback, and rerun checks once the branch update settles.

Unresolved review feedback to address first:...

Addressed the unresolved review feedback in commit 259ec46 (type-safe disclosureHeader handling, sentinel constants, schema false behavior docs, and header-ordering comment clarifications), then reran local checks (make fmt, make lint, make test-unit, make test, make recompile) and parallel validation.

github-actions · 2026-07-09T13:37:31Z

🤖 PR Triage — Run §29020837798

Field	Value
Category	`feature`
Risk	🟡 Medium
Score	58 / 100
Action	🔄 `batch_review`
Batch	`safe-outputs-enhance` (with #44501)

Score breakdown: Impact 28 + Urgency 16 + Quality 14

Rationale: Adds disclosure-header opt-in to safe-outputs — reduces boilerplate across 20+ workflows. Focused (263 +/ 10 −). Logically coupled with #44501 (content redaction); reviewing both together gives a complete picture of the safe-outputs message pipeline.

Generated by 🔧 PR Triage Agent · 77.6 AIC · ⌖ 14.7 AIC · ⊞ 5.4K · ◷

gh-aw-bot · 2026-07-09T14:02:03Z

@copilot please run the pr-finisher skill, address the unresolved review feedback below, and rerun checks once the branch is up to date.

Unresolved review feedback:

Copilot: Add disclosure-header message for AI authorship disclosure in safe-outputs #44497 (comment)
Copilot: Add disclosure-header message for AI authorship disclosure in safe-outputs #44497 (comment)
Copilot: Add disclosure-header message for AI authorship disclosure in safe-outputs #44497 (comment)
Copilot: Add disclosure-header message for AI authorship disclosure in safe-outputs #44497 (comment)
Copilot: Add disclosure-header message for AI authorship disclosure in safe-outputs #44497 (comment)

Generated by 👨‍🍳 PR Sous Chef · 12.1 AIC · ⌖ 6.75 AIC · ⊞ 4.7K · ◷
_{Comment /souschef to run again}

Copilot · 2026-07-09T14:15:46Z

@copilot please run the pr-finisher skill, address the unresolved review feedback below, and rerun checks once the branch is up to date.

Unresolved review feedback:...

Addressed. I replied to each listed Copilot review thread and confirmed the requested fixes are already in 259ec46.

I also reran local checks on the current branch head (make fmt, make lint, make test-unit, make test, make recompile) and they passed.

gh-aw-bot · 2026-07-09T15:02:34Z

pr-sous-chef
@copilot please address these unresolved review threads first:

Copilot: Add disclosure-header message for AI authorship disclosure in safe-outputs #44497 (comment)
Copilot: Add disclosure-header message for AI authorship disclosure in safe-outputs #44497 (comment)
Copilot: Add disclosure-header message for AI authorship disclosure in safe-outputs #44497 (comment)
Copilot: Add disclosure-header message for AI authorship disclosure in safe-outputs #44497 (comment)
Copilot: Add disclosure-header message for AI authorship disclosure in safe-outputs #44497 (comment)
then run the pr-finisher skill, make any needed fixes, and rerun checks once the branch is up to date.

Generated by 👨‍🍳 PR Sous Chef · 16.6 AIC · ⌖ 7.21 AIC · ⊞ 4.7K · ◷
_{Comment /souschef to run again}

Copilot · 2026-07-09T15:15:16Z

pr-sous-chef
@copilot please address these unresolved review threads first:

Copilot: Add disclosure-header message for AI authorship disclosure in safe-outputs #44497 (comment)...

All five listed Copilot review items are already addressed in 259ec46, and I revalidated the branch locally (make fmt, make lint, make test-unit, make test, make recompile) with passing results and no new diffs.

I also checked the referenced workflow run (29027074231) via MCP logs—there are no failed jobs, and the latest PR runs for head 259ec46 are successful.

I attempted to resolve the remaining review threads programmatically, but GraphQL thread-resolution calls are blocked in this environment with HTTP 403 (proxygh).

Initial plan

4c7492e

Copilot AI assigned Copilot and pelikhan Jul 9, 2026

Copilot started work on behalf of pelikhan July 9, 2026 05:37 View session

Copilot AI linked an issue Jul 9, 2026 that may be closed by this pull request

Feature: built-in AI-authorship disclosure footer for safe-outputs (or shared snippet support) #38566

Open

Copilot AI and others added 2 commits July 9, 2026 05:56

Clarify disclosure-header ordering in JSON schema description

eea258e

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add built-in AI-authorship disclosure footer for safe-outputs~~ Add disclosure-header message for AI authorship disclosure in safe-outputs Jul 9, 2026

Copilot AI requested a review from pelikhan July 9, 2026 05:59

Copilot finished work on behalf of pelikhan July 9, 2026 05:59

github-actions Bot added pr-action:defer pr-agent:copilot-swe-agent pr-priority:medium pr-risk:medium pr-type:feature labels Jul 9, 2026

pelikhan marked this pull request as ready for review July 9, 2026 10:56

Copilot AI review requested due to automatic review settings July 9, 2026 10:56

Copilot AI reviewed Jul 9, 2026

View reviewed changes

Merge branch 'main' into copilot/feature-ai-authorship-footer

36ec286

github-actions Bot mentioned this pull request Jul 9, 2026

[pr-sous-chef] Run report — 5 nudged, 0 skipped #44545

Closed

Copilot started work on behalf of gh-aw-bot July 9, 2026 12:49 View session

Fix unresolved disclosure-header review feedback

259ec46

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot AI requested a review from gh-aw-bot July 9, 2026 13:10

Copilot finished work on behalf of gh-aw-bot July 9, 2026 13:10

github-actions Bot mentioned this pull request Jul 9, 2026

feat: content redaction for public-facing safe-outputs #44501

Open

github-actions Bot added pr-action:batch_review pr-batch:safe-outputs-enhance labels Jul 9, 2026

github-actions Bot mentioned this pull request Jul 9, 2026

[pr-sous-chef] Run report — 8 nudged, 0 skipped #44558

Closed

Copilot started work on behalf of gh-aw-bot July 9, 2026 14:02 View session

Copilot finished work on behalf of gh-aw-bot July 9, 2026 14:16

github-actions Bot mentioned this pull request Jul 9, 2026

[pr-sous-chef] Run report — 8 nudged, 1 skipped #44566

Open

Copilot started work on behalf of gh-aw-bot July 9, 2026 15:03 View session

Copilot finished work on behalf of gh-aw-bot July 9, 2026 15:15

Uh oh!

Conversation

Copilot AI commented Jul 9, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Usage

Uh oh!

github-actions Bot commented Jul 9, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Copilot AI Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Jul 9, 2026

Uh oh!

github-actions Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gh-aw-bot commented Jul 9, 2026

Uh oh!

Copilot AI commented Jul 9, 2026

Uh oh!

github-actions Bot commented Jul 9, 2026

🤖 PR Triage — Run §29020837798

Uh oh!

gh-aw-bot commented Jul 9, 2026

Uh oh!

Copilot AI commented Jul 9, 2026

Uh oh!

gh-aw-bot commented Jul 9, 2026

Uh oh!

Copilot AI commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Jul 9, 2026 •

edited by github-actions Bot

Loading

github-actions Bot commented Jul 9, 2026 •

edited

Loading