[safe-output-integrator] test: add fixtures and Go test coverage for ADO/Linear/Jira safe outputs

[github-actions]

Overview

Closed the gap between SafeOutputsConfig and its test/fixture coverage. Found 13 safe-output types with zero coverage in both pkg/cli/workflows/*.md fixtures and pkg/workflow/compiler_safe_outputs_config_test.go (TestAddHandlerManagerConfigEnvVar): all Azure DevOps work-item outputs, all Linear outputs, and all Jira outputs.

Key changes

• 13 new fixtures under pkg/cli/workflows/test-copilot-<type>.md, each with minimal workflow_dispatch frontmatter, engine: copilot, the relevant safe-outputs.<type> block (plus required env/linear-token credentials matching documented patterns), and a short task instructing use of the corresponding tool.
• 13 new table-test cases in compiler_safe_outputs_config_test.go, following the existing style (BaseSafeOutputConfig.Max, expectedKeys in underscore form), covering:
  • ado_create_work_item, ado_update_work_item, ado_comment_on_work_item, ado_assign_work_item, ado_link_work_items, ado_upload_workitem_attachment
  • linear_create_issue, linear_add_comment, linear_update_issue
  • jira_create_issue, jira_update_issue, jira_add_comment, jira_add_label

Coverage analysis details

• Extracted authoritative type list from SafeOutputsConfig struct (pkg/workflow/safe_outputs_config_types.go), excluding config-only keys (jobs, github-app, env, github-token, allowed-domains, allowed-github-references, staged, threat-detection).
• Cross-referenced pkg/workflow/safe_output_handlers.go for handler keys/tool names, safe_outputs_azure_devops.go / linear_safe_outputs.go / jira.go for config struct shapes, and safe_outputs_validation_config.go for DefaultMax values (all 1, except ado_link_work_items = 5).
• All other safe-output types already had both fixture and Go test coverage.

Verification note

⚠️ This sandbox's egress firewall blocks storage.googleapis.com (used for Go module proxy zip downloads), so go build/go test could not be run end-to-end here. I validated instead via:

• gofmt -l on the edited test file (clean, no issues).
• Manual cross-check of every new struct field/type against the actual Go source (CreateWorkItemConfig, LinearCreateIssueConfig, JiraSafeOutputConfig, etc.) and existing table-test entries for the same style.
• Manual review of generated frontmatter against documented examples in docs/src/content/docs/reference/safe-outputs.md.

Please run go test ./pkg/workflow/... -run TestAddHandlerManagerConfigEnvVar and gh aw compile over the new fixtures in CI to confirm.

Next actions

• None outstanding — all 13 missing types (well under the 20/run batch limit) were fully processed in this run.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• storage.googleapis.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "storage.googleapis.com"

See Network Configuration for more information.

Generated by 🔧 Daily Safe Output Integrator · copilot · auto · 139.4 AIC · ⌖ 15.8 AIC · ⊞ 7.6K · ◷

• expires on Sep 5, 2026, 10:58 AM UTC-08:00

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.88.2