Deduplicate AllowedLabels into a shared embedded safe-output config struct

[Copilot]

AllowedLabels []string was declared identically in 5 safe-output config structs in pkg/workflow, despite shared embeddable filter structs already existing in safe_outputs_parser.go.

Changes

• New shared struct in pkg/workflow/safe_outputs_parser.go holding the single declaration, embedded inline into SafeOutputFilterConfig:

  type SafeOutputAllowedLabelsConfig struct {
      AllowedLabels []string `yaml:"allowed-labels,omitempty"`
  }

• Removed the 5 duplicate declarations, embedding the shared struct instead in CreateIssuesConfig, CreatePullRequestsConfig, CreateDiscussionsConfig, UpdateDiscussionsConfig, and MergePullRequestConfig (where allowed-labels remains a deprecated alias for required-labels).

• Test struct literals updated to the embedded form. All read/write sites (config.AllowedLabels) are untouched — field promotion keeps them valid.

Why a dedicated struct rather than embedding SafeOutputFilterConfig

The issue suggested embedding SafeOutputFilterConfig directly into the 5 structs. That struct also declares title-prefix, which has different semantics in the create-* configs — there it's the prefix applied to created titles, not a filter. Direct embedding would produce a duplicate title-prefix yaml key and silently change parsing. The nested one-field embed satisfies the same goal (declared once, available on SafeOutputFilterConfig) while leaving each config's yaml surface unchanged.

Worth confirming during review: no struct embeds both SafeOutputFilterConfig and SafeOutputAllowedLabelsConfig, which would create an ambiguous selector and duplicate yaml key. A grep over pkg/ shows none currently do.

• Fixes [Code Quality] Add AllowedLabels to shared SafeOutputFilterConfig and embed in 5 duplicated structs #50965

---

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 14.6 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

---

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 9.85 AIC · ⊞ 5.9K · ◷
_{Comment /souschef to run again}

---

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 8.42 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

[Copilot]

Pull request overview

Deduplicates AllowedLabels through a shared embedded configuration while preserving existing YAML behavior.

Changes:

• Adds SafeOutputAllowedLabelsConfig and embeds it in shared filters.
• Replaces five duplicate declarations.
• Updates affected test literals.

Show a summary per file

File	Description
pkg/workflow/safe_outputs_parser.go	Defines shared allowed-label configuration.
pkg/workflow/create_issue.go	Embeds shared configuration.
pkg/workflow/create_pull_request.go	Embeds shared configuration.
pkg/workflow/create_discussion.go	Embeds shared configuration.
pkg/workflow/update_discussion.go	Embeds shared configuration.
pkg/workflow/merge_pull_request.go	Preserves deprecated alias through embedding.
pkg/workflow/safe_outputs_tools_test.go	Updates test literals.
pkg/workflow/safe_outputs_config_generation_test.go	Updates generation test literals.
pkg/workflow/compiler_threat_detection_formal_test.go	Updates validation test literals.
pkg/workflow/compiler_safe_outputs_config_test.go	Updates compiler test literals.
pkg/cli/compile_workflow_processor_test.go	Updates CLI test literals.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 11/11 changed files
• Comments generated: 0
• Review effort level: Balanced

[gh-aw-bot]

@copilot Please triage this PR, refresh the branch if needed, and run the pr-finisher skill before handing back to maintainers.

Branch refresh was requested.

No failed checks are currently reported on the latest head SHA. Please confirm reviewer feedback state and hand back a concise maintainer-ready summary.

Run context: https://github.com/github/gh-aw/actions/runs/31148473746

Generated by 👨🍳 PR Sous Chef
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 14.6 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot Please triage this PR, refresh the branch if needed, and run the pr-finisher skill before handing back to maintainers.

Branch refresh was requested....

4a45496 is still the relevant head for this request. The branch is already refreshed against main, there are no unresolved review threads or bot review comments on the PR, and local make fmt, make lint, make test-unit, make test, and make recompile all passed in this pass. I also checked the latest branch workflow runs and found no failed job logs to triage. Remaining blocker is GitHub’s PR-level blocked state / maintainer approval, not an actionable branch or CI issue from my side.

[gh-aw-bot]

@copilot Please triage this PR, refresh the branch if needed, and run the pr-finisher skill before handing back to maintainers.

No failed checks are currently reported on the latest head SHA. Please confirm reviewer feedback state, summarize any remaining blocker keeping the PR in blocked status, and hand back a concise maintainer-ready summary.

Branch refresh was requested.

Run context: https://github.com/github/gh-aw/actions/runs/31154408939

Generated by 👨🍳 PR Sous Chef
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 9.85 AIC · ⊞ 5.9K · ◷
_{Comment /souschef to run again}

[github-actions]

PR Triage

Category: refactor (dedupe AllowedLabels into shared config struct) · Risk: medium · Score: 52/100 (impact 20, urgency 12, quality 20)

Recommendation: fast_track

Consolidates AllowedLabels handling into an embedded shared safe-output config struct across create_issue/create_discussion/create_pull_request/merge_pull_request/update_discussion — touches safe-outputs config generation, a security-relevant surface. Only 1 automated review comment so far, no explicit approval/changes-requested yet. Recommend expedited human review given safe-outputs config is a critical path.

Generated by 🔧 PR Triage Agent · auto · 55.6 AIC · ⌖ 2.45 AIC · ⊞ 7.9K · ◷

[Copilot]

@copilot Please triage this PR, refresh the branch if needed, and run the pr-finisher skill before handing back to maintainers.

No failed checks are currently reported on the latest head SHA. Pleas...

c057be5 is the current head. The branch is already refreshed against main (base is 69c6ca4, head is the merge commit c057be5), there are no unresolved review threads or bot review comments, and local make fmt, make lint, make test-unit, make test, and make recompile all passed on this refreshed head. I also checked the latest branch runs: the PR reports no failed checks on this SHA, and the newest completed branch workflow runs have no failed jobs to triage. The remaining blocked state is reviewer-side: the PR still has pending requested reviewers (pelikhan, gh-aw-bot) and no approving review, so there is no actionable code or branch blocker left from my side.

[gh-aw-bot]

@copilot Please address the remaining review feedback and run the pr-finisher skill before handing back to maintainers.

Open review items to address:

• reviewers: confirm the current head is maintainer-ready and summarize the remaining blocker keeping the PR in blocked status, if any.
• reviewers: hand back a concise maintainer-ready summary once reviewer feedback state is fully confirmed.

Branch refresh was requested.
Run context: https://github.com/github/gh-aw/actions/runs/31162738791

Generated by 👨🍳 PR Sous Chef · gpt54
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 16.4 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot Please address the remaining review feedback and run the pr-finisher skill before handing back to maintainers.

Open review items to address:...

c057be5 is maintainer-ready from my side. The branch is already refreshed against main (head c057be5 includes base 69c6ca4), there are no unresolved review threads or bot review comments, and I reran local make fmt, make lint, TEST_UNIT_RUN_FULL=1 make test-unit, make test, and make recompile successfully on this head. For CI triage, the latest branch runs show no failed jobs to fix locally; the CWI/CGO runs on c057be5 are action_required but have no failed job logs, and the only active check at the moment is this current copilot run. The remaining blocked state is reviewer-side: requested reviewers pelikhan and gh-aw-bot are still pending, and there is no approving review yet.

[gh-aw-bot]

@copilot Please address the remaining review feedback and run the pr-finisher skill before handing back to maintainers.

Open review items to address:

• reviewers: confirm the current head is maintainer-ready and summarize the remaining blocker keeping the PR in blocked status, if any.
• reviewers: hand back a concise maintainer-ready summary once reviewer feedback state is fully confirmed.

Branch refresh was requested.
Run context: https://github.com/github/gh-aw/actions/runs/31170865483

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 9.92 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot Please address the remaining review feedback and run the pr-finisher skill before handing back to maintainers.

Open review items to address:...

c057be5 is still maintainer-ready from my side. The branch is already refreshed against main (head c057be5 includes base 69c6ca4), there are no unresolved review threads or bot review comments, and I reran local make fmt, make lint, TEST_UNIT_RUN_FULL=1 make test-unit, make test, and make recompile successfully on this head. For CI triage, the latest branch runs still show no failed jobs to fix locally; the CWI and CGO runs on c057be5 remain action_required but return no failed job logs, and the only current check activity is this in-progress copilot run. The remaining blocked state is reviewer-side: requested reviewers pelikhan and gh-aw-bot are still pending, and there is still no approving review yet.

[gh-aw-bot]

@copilot Please triage this PR, refresh the branch if needed, and run the pr-finisher skill before handing back to maintainers.

No failed checks are currently reported on the latest head SHA. Please confirm reviewer feedback state and hand back a concise maintainer-ready summary.

Branch refresh was requested.

Run context: https://github.com/github/gh-aw/actions/runs/31173041415

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 4.04 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot Please triage this PR, refresh the branch if needed, and run the pr-finisher skill before handing back to maintainers.

No failed checks are currently reported on the latest head SHA. Pleas...

c057be5 is maintainer-ready from my side.

• ✅ Reviews — no unresolved review threads or bot review comments; the only review on the PR is the zero-finding Copilot overview.
• ✅ Checks (local) — make fmt, make lint, TEST_UNIT_RUN_FULL=1 make test-unit, make test, and make recompile all passed locally on c057be5, and the working tree is still clean afterward.
• ❓ Checks (CI) — GitHub currently shows no failed checks on c057be5; the only active check is this in-progress copilot run. I also inspected the prior CWI/CGO runs on this SHA and GitHub reports no failed job logs for either, so there is no actionable CI failure to fix locally. CI on the agent-verified head remains observational until a maintainer re-triggers it.
• ✅ Mergeable — branch refresh is not needed; the PR head is still c057be5 against base 69c6ca4, and the remaining blocked state is reviewer-side, not branch-side.

Actions taken: verified current PR review state, inspected latest branch workflow runs/logs, reran the full local validation suite, and confirmed no repo changes were introduced in this pass.

Hand-off: CI must be re-triggered by a maintainer if fresh GitHub signals are required before merge.
Still needed: reviewer approval from the pending requested reviewers (pelikhan, gh-aw-bot).

[gh-aw-bot]

@copilot Please triage this PR, refresh the branch if needed, and run the pr-finisher skill before handing back to maintainers.

No failed checks are currently reported on the latest head SHA. Please confirm reviewer feedback state and hand back a concise maintainer-ready summary.

Branch refresh was requested.
Run context: https://github.com/github/gh-aw/actions/runs/31174860863

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10.4 AIC · ⊞ 5.9K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot Please triage this PR, refresh the branch if needed, and run the pr-finisher skill before handing back to maintainers.

No failed checks are currently reported on the latest head SHA. Pleas...

c057be5 is still maintainer-ready from my side.

• ✅ Reviews — there are still no unresolved review threads or bot review comments; the only review on the PR remains the zero-finding Copilot overview.
• ✅ Checks (local) — the current head is unchanged since the prior validation pass, and that same c057be5 head passed make fmt, make lint, TEST_UNIT_RUN_FULL=1 make test-unit, make test, and make recompile locally with a clean working tree afterward.
• ❓ Checks (CI) — GitHub currently shows no failed checks on c057be5; the only active check is this in-progress copilot run. I also rechecked the prior CWI/CGO runs on this SHA and GitHub still reports no failed job logs for either, so there is no actionable CI failure to fix locally. CI on the agent-verified head remains observational until a maintainer re-triggers it.
• ✅ Mergeable — branch refresh is still not needed; the PR head is c057be5 against base 69c6ca4, and the remaining blocked state is reviewer-side, not branch-side.

Actions taken: rechecked current PR/reviewer state, reconfirmed the branch head and clean local status, and re-inspected the latest branch workflow/check state for actionable failures.

Hand-off: CI must be re-triggered by a maintainer if fresh GitHub signals are required before merge.
Still needed: reviewer approval from the pending requested reviewers (pelikhan, gh-aw-bot).

[gh-aw-bot]

@copilot Please triage this PR, refresh the branch if needed, and run the pr-finisher skill before handing back to maintainers.

No failed checks are currently reported on the latest head SHA. Please confirm reviewer feedback state and hand back a concise maintainer-ready summary.

Branch refresh was requested.
Run context: https://github.com/github/gh-aw/actions/runs/31178251696

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 8.42 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot Please triage this PR, refresh the branch if needed, and run the pr-finisher skill before handing back to maintainers.

No failed checks are currently reported on the latest head SHA. Pleas...

c057be5 is still maintainer-ready from my side.

• ✅ Reviews — there are still no unresolved review threads or bot review comments; the only review on the PR remains the zero-finding Copilot overview.
• ✅ Checks (local) — the head is still unchanged since the prior validation pass, and that same c057be5 head already passed make fmt, make lint, TEST_UNIT_RUN_FULL=1 make test-unit, make test, and make recompile locally with a clean working tree afterward.
• ❓ Checks (CI) — GitHub currently shows no failed checks on c057be5; the only active check is this in-progress copilot run. I also rechecked the prior CWI/CGO runs on this SHA and GitHub still reports no failed job logs for either, so there is no actionable CI failure to fix locally. CI on the agent-verified head remains observational until a maintainer re-triggers it.
• ✅ Mergeable — branch refresh is still not needed; the PR head is c057be5 against base 69c6ca4, and the remaining blocked state is reviewer-side, not branch-side.

Actions taken: rechecked current PR/reviewer state, reconfirmed the branch head and clean local status, and re-inspected the latest branch workflow/check state for actionable failures.

Hand-off: CI must be re-triggered by a maintainer if fresh GitHub signals are required before merge.
Still needed: reviewer approval from the pending requested reviewers (pelikhan, gh-aw-bot).

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.86.1