fix: forward GH_AW_INPUT_* to MCP container env for dynamic safe-outputs config by Copilot · Pull Request #48099 · github/gh-aw

Copilot · 2026-07-26T03:25:23Z

Since v0.80.0, the safe-outputs MCP server runs in a Docker container with a filtered -e allowlist. GH_AW_INPUT_* vars were never added to that allowlist, so ${GH_AW_INPUT_BASE_BRANCH}-style placeholders in config.json remain unresolved inside the container — causing create_pull_request to fail with No remote refs available for merge-base calculation when using any dynamic safe-outputs field like base-branch: ${{ inputs.base_branch }}.

Changes

`pkg/workflow/mcp_setup_generator.go`

New extractSafeOutputsInputEnvVars(safeOutputConfig) — extracts all GH_AW_INPUT_* name→expression pairs referenced by the safe-outputs config and passes them to generateMCPGatewaySetup.

`pkg/workflow/mcp_setup_gateway.go`

writeMCPGatewayStepEnv now also emits GH_AW_INPUT_*: ${{ inputs.* }} in the Start MCP Gateway step env: block, so the runner process holds the values when docker run is invoked.
New appendMCPGatewaySafeOutputsInputEnvFlags appends -e GH_AW_INPUT_* to the docker run command so the container inherits those values.

The compiled output now looks like:

# Start MCP Gateway step
env:
  ...
  GH_AW_INPUT_BASE_BRANCH: ${{ inputs.base_branch }}   # ← new

# docker run command
... -e GH_AW_INPUT_BASE_BRANCH ...                     # ← new

`actions/setup/js/safe_outputs_config.cjs`

New collectUnresolvedInputPlaceholders() detects and logs any ${GH_AW_INPUT_*} that remains unresolved at load-time, so failures surface with a clear message instead of a cryptic merge-base error.

`pkg/workflow/safe_outputs_dynamic_allowed_repos_test.go`

Existing test updated: asserts GH_AW_INPUT_* appears in both the Generate Safe Outputs Config and Start MCP Gateway step env blocks, and that -e GH_AW_INPUT_* is present in the docker run command.
New TestSafeOutputsDynamicBaseBranchPassedToMCPContainer regression test for the exact issue scenario (base-branch: ${{ inputs.base_branch }}).

Fixes [ARC/DinD] safe-outputs: dynamic base-branch unresolved — GH_AW_INPUT_* not passed to MCP container #47795

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 22.4 AIC · ⌖ 9.38 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 13.6 AIC · ⌖ 7.58 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 17.5 AIC · ⌖ 7.28 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 28.5 AIC · ⌖ 13 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

run: https://github.com/github/gh-aw/actions/runs/30207935610

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 23.3 AIC · ⌖ 7.77 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Run: https://github.com/github/gh-aw/actions/runs/30221620246

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.7 AIC · ⌖ 7.23 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Run: https://github.com/github/gh-aw/actions/runs/30223671533

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 12.5 AIC · ⌖ 7.96 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Run: https://github.com/github/gh-aw/actions/runs/30224763533

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 9.68 AIC · ⌖ 9.81 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Run: https://github.com/github/gh-aw/actions/runs/30228781602

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 11.4 AIC · ⌖ 8.55 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Run: https://github.com/github/gh-aw/actions/runs/30230557448

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 4.62 AIC · ⌖ 7.86 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Run: https://github.com/github/gh-aw/actions/runs/30233154470

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 13 AIC · ⌖ 7.3 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Run: https://github.com/github/gh-aw/actions/runs/30236419434

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10.2 AIC · ⌖ 8.79 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Run: https://github.com/github/gh-aw/actions/runs/30240308794

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 23.9 AIC · ⌖ 8.09 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 15.3 AIC · ⌖ 8.16 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

…uts config Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

Fixes dynamic safe-output inputs by forwarding GH_AW_INPUT_* variables toward the MCP runtime and improving unresolved-placeholder diagnostics.

Changes:

Extracts and forwards input-derived safe-output environment variables.
Adds runtime diagnostics and regression coverage.
Updates release metadata and workflow skill references.

Show a summary per file

File	Description
`pkg/workflow/mcp_setup_generator.go`	Extracts safe-output input variables.
`pkg/workflow/mcp_setup_gateway.go`	Forwards variables to the outer gateway container.
`actions/setup/js/safe_outputs_config.cjs`	Logs unresolved input placeholders.
`pkg/workflow/safe_outputs_dynamic_allowed_repos_test.go`	Adds compilation regression assertions.
`.github/skills/agentic-workflows/SKILL.md`	Adds the release-workflow reference.
`.changeset/fix-safe-outputs-dynamic-input-mcp-container.md`	Documents the patch.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 6/6 changed files
Comments generated: 2
Review effort level: Medium

github-actions · 2026-07-26T04:05:11Z

✅ Test Quality Sentinel completed test quality analysis.

github-actions · 2026-07-26T04:05:13Z

✅ PR Code Quality Reviewer completed the code quality review.

github-actions · 2026-07-26T04:05:23Z

✅ Design Decision Gate 🏗️ completed the design decision gate check.

github-actions · 2026-07-26T04:05:55Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

github-actions · 2026-07-26T04:09:53Z

🧪 Test Quality Sentinel Report

✅ Test Quality Score: 100/100 — Excellent

Analyzed 3 test(s): 3 design, 0 implementation, 0 violation(s).

📊 Metrics (3 tests)

Metric	Value
Analyzed	3 (Go: 3, JS: 0)
✅ Design	3 (100%)
⚠️ Implementation	0 (0%)
Edge/error coverage	3 (100%)
Duplicate clusters	0
Inflation	No
🚨 Violations	0

Test	File	Classification	Issues
`TestSafeOutputsConfigUsesWorkflowInputEnvVarsForDynamicAllowedRepos`	`safe_outputs_dynamic_allowed_repos_test.go`	design_test / behavioral_contract	None
`TestSafeOutputsConfigPreservesSecretPlaceholdersOnDisk`	`safe_outputs_dynamic_allowed_repos_test.go`	design_test / behavioral_contract	None
`TestSafeOutputsDynamicBaseBranchPassedToMCPContainer`	`safe_outputs_dynamic_allowed_repos_test.go`	design_test / behavioral_contract	None

Verdict

✅ passed. 0% implementation tests (threshold: 30%). All three tests enforce end-to-end behavioral contracts: correct env var injection into compiled YAML, single-quoted heredoc quoting to prevent shell expansion, and -e forwarding to the MCP gateway container. Each test includes both positive and negative regex assertions with descriptive failure messages.

🧪 Test quality analysis by Test Quality Sentinel · sonnet46 · 22.3 AIC · ⌖ 7.9 AIC · ⊞ 8.1K · ◷
_{Comment /review to run again}

github-actions

✅ Test Quality Sentinel: 100/100. 0% implementation tests (threshold: 30%).

github-actions

The fix is correct and well-implemented. The root cause (GH_AW_INPUT_* vars missing from the docker -e allowlist) is clearly identified and addressed at both the compiler level (Go) and with appropriate diagnostic logging (JS). Tests are updated and a focused regression test added.

Two pre-existing review comments cover the remaining gaps:

Nested-container forwarding (inner containers do not inherit -e vars from the outer MCP gateway)
Missing JS unit-test coverage for the new unresolved-placeholder warning path

No additional blocking issues found.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 21.4 AIC · ⌖ 4.51 AIC · ⊞ 5K

…container

github-actions · 2026-07-26T04:11:29Z

Design Decision Gate - ADR Required

This PR makes significant changes to core business logic (144 new lines in pkg/workflow/ and actions/setup/js/) but does not have a linked Architecture Decision Record (ADR).

Draft ADR committed: docs/adr/48099-forward-gh-aw-input-vars-to-mcp-gateway-container.md -- review and complete it before merging.

This PR cannot merge until an ADR is linked in the PR body.

What to do next

Review the draft ADR committed to your branch -- it was generated from the PR diff
Complete the missing sections -- add context the AI could not infer, refine the decision rationale, and list real alternatives you considered
Commit the finalized ADR to docs/adr/ on your branch
Reference the ADR in this PR body by adding a line such as:

ADR: ADR-48099: Forward GH_AW_INPUT_* Vars to MCP Gateway Container

Once an ADR is linked in the PR body, this gate will re-run and verify the implementation matches the decision.

Why ADRs Matter

ADRs create a searchable, permanent record of why the codebase looks the way it does. Future contributors (and your future self) will thank you.

Michael Nygard ADR Format Reference

An ADR must contain these four sections to be considered complete:

Context -- What is the problem? What forces are at play?
Decision -- What did you decide? Why?
Alternatives Considered -- What else could have been done?
Consequences -- What are the trade-offs (positive and negative)?

All ADRs are stored in docs/adr/ as Markdown files numbered by PR number.

🏗️ ADR gate enforced by Design Decision Gate 🏗️ · sonnet46 · 56.8 AIC · ⌖ 13 AIC · ⊞ 8.5K · ◷
_{Comment /review to run again}

github-actions

REQUEST_CHANGES — one medium correctness issue must be fixed before merging.

Blocking issue

The new collectUnresolvedInputPlaceholders diagnostic in safe_outputs_config.cjs only logs and continues. Since resolveEnvPlaceholders uses ?? match as its fallback, an unresolved ${GH_AW_INPUT_BASE_BRANCH} is preserved verbatim in the parsed config. The safe-outputs MCP server then receives the literal placeholder as the base_branch value — the same broken behavior the PR is fixing — just with a warning attached. The check needs to throw after logging so the failure is explicit rather than silent.

Other observations (non-blocking)

The Go changes are correct: -e VARNAME (without =value) is the standard Docker pattern for inheriting a value from the host process environment, and the step env: block supplies that value on the runner. The approach is sound.
extractSafeOutputsInputEnvVars correctly filters to GH_AW_INPUT_* keys; the nil-on-empty return is consistent with the rest of the codebase.
The regression test TestSafeOutputsDynamicBaseBranchPassedToMCPContainer is well-structured and covers the exact failure scenario.

🔎 Code quality review by PR Code Quality Reviewer · sonnet46 · 52.1 AIC · ⌖ 4.74 AIC · ⊞ 5.7K
_{Comment /review to run again}

github-actions

Skills-Based Review 🧠

Applied /diagnosing-bugs and /tdd — the fix is well-targeted and accompanied by a solid regression test. One issue worth addressing before merge.

📋 Key Themes & Highlights

Key Themes

Diagnostic severity: the new collectUnresolvedInputPlaceholders warning is emitted at server.debug level, which is suppressed in normal runs — it won't help anyone diagnose a misconfigured deployment where this code path is actually reached
Test coverage gap (noted in existing review): safe_outputs_config.test.cjs has no coverage for the new collectUnresolvedInputPlaceholders path
Container scope concern (noted in existing review): the MCP gateway container forwarding only helps the outer gateway; worth confirming the safe-outputs server actually reads env vars from the container context it runs in

Positive Highlights

✅ Clean extraction of extractSafeOutputsInputEnvVars — single responsibility, easy to test
✅ Regression test TestSafeOutputsDynamicBaseBranchPassedToMCPContainer covers the exact failure scenario end-to-end
✅ Updated test assertions now verify both step env AND docker -e flags — the right invariants to protect
✅ Good inline comments explaining why each piece is necessary
✅ Changeset entry accurately describes the impact

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 30.8 AIC · ⌖ 4.7 AIC · ⊞ 6.7K
_{Comment /matt to run again}

gh-aw-bot · 2026-07-27T01:52:00Z

@copilot please run the pr-finisher skill, address unresolved review feedback and any failing checks, then rerun the relevant checks once the branch is ready for maintainer review.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 4.62 AIC · ⌖ 7.86 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Copilot · 2026-07-27T02:00:16Z

@copilot please run the pr-finisher skill, address unresolved review feedback and any failing checks, then rerun the relevant checks once the branch is ready for maintainer review.

...

No new actionable items. Current state (branch HEAD c3608ed):

✅ Reviews — all 4 review threads are resolved (is_resolved: true via API)
✅ Checks (local) — make fmt and make lint pass; TEST_UNIT_RUN_FULL=1 make test-unit passed on prior session
❓ Checks (CI) — a new copilot check run (30230799313) is currently in progress. Prior completed runs all succeeded. CI on the agent's HEAD is unverified until a human re-triggers the other required checks.
❌ Mergeable — still blocked due to the stale CHANGES_REQUESTED review (4780931179) from the PR Code Quality Reviewer bot submitted against old commit 313f7c9. The underlying issue it flagged (silent continuation without throw) was fixed in 40cc205. This review can only be cleared by a maintainer dismissing it or by a new /review run re-evaluating the current HEAD.

Nothing further is actionable from the agent side. A maintainer must dismiss the stale CHANGES_REQUESTED review or trigger /review to get a fresh evaluation against the fixed code.

gh-aw-bot · 2026-07-27T02:58:31Z

@copilot please run the pr-finisher skill, update the branch if GitHub allows it, and move this PR toward merge readiness.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 13 AIC · ⌖ 7.3 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Copilot · 2026-07-27T03:05:04Z

@copilot please run the pr-finisher skill, update the branch if GitHub allows it, and move this PR toward merge readiness.

...

Branch is already up to date with main (0 commits behind). No new review threads since the last pass. Current state:

✅ Reviews — all 4 inline threads resolved; branch is at c3608ed
✅ Checks (local) — make fmt, make lint, TEST_UNIT_RUN_FULL=1 make test-unit all pass
❓ Checks (CI) — CI on this HEAD is unverified by the agent; all prior Addressing comment runs completed with success
❌ Mergeable — blocked by stale CHANGES_REQUESTED review 4780931179 (PR Code Quality Reviewer bot, against old commit 313f7c9). The issue it flagged was fixed in 40cc205. Only a maintainer can clear this by commenting /review on the PR to trigger a fresh evaluation, or dismissing the stale review via the GitHub UI.

gh-aw-bot · 2026-07-27T04:18:42Z

@copilot please run the pr-finisher skill and move this PR toward merge readiness. The branch appears up to date, but the PR is still blocked by stale change-request reviews from github-actions; if all review threads are actually resolved, summarize that clearly and prepare the PR for maintainer cleanup or re-review.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/30236419434

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10.2 AIC · ⌖ 8.79 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Copilot · 2026-07-27T04:29:58Z

@copilot please run the pr-finisher skill and move this PR toward merge readiness. The branch appears up to date, but the PR is still blocked by stale change-request reviews from github-actions; i...

PR Finisher pass complete. Current state (branch HEAD c3608ed):

✅ Reviews — all 4 inline review threads are is_resolved: true (r3651692896, r3651692910, r3651724189, r3651725169). The stale CHANGES_REQUESTED review (4780931179) from github-actions[bot] was submitted against old commit 313f7c9; the issues it raised were fully addressed in commits 276a6bd and 40cc205. Only a maintainer can dismiss this review or trigger /review to get a fresh evaluation against the current HEAD.
✅ Checks (local) — make fmt, make lint, and make test-unit all pass on HEAD c3608ed.
❓ Checks (CI) — stale after agent push; CI on this HEAD is unverified until a human re-triggers it. All prior Addressing comment copilot runs completed successfully.
❌ Mergeable — blocked solely by the stale CHANGES_REQUESTED review (4780931179). No code conflicts; branch is 0 commits behind main.

Actions taken this pass: no code changes needed — validated local checks only.

Hand-off: A maintainer must either comment /review on the PR to trigger a fresh evaluation against the fixed code, or dismiss review 4780931179 via the GitHub UI. CI must also be re-triggered (close/reopen or workflow_dispatch) before merge.

gh-aw-bot · 2026-07-27T05:46:35Z

@copilot please run the pr-finisher skill and verify whether this PR now only needs maintainer cleanup of the stale blocking review, or whether any fresh code/review issue remains on the current head.

Recent context:

branch appears up to date
all previously discussed inline threads appear resolved from prior agent replies
reviewDecision still shows CHANGES_REQUESTED, so please restate the smallest remaining maintainer action set clearly

Generated by 👨🍳 PR Sous Chef

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 23.9 AIC · ⌖ 8.09 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Copilot · 2026-07-27T05:51:39Z

@copilot please run the pr-finisher skill and verify whether this PR now only needs maintainer cleanup of the stale blocking review, or whether any fresh code/review issue remains on the current hea...

This PR only needs maintainer cleanup of the stale blocking review. Here's the exact state:

All inline threads resolved (confirmed via API):

Thread	Fix	Status
r3651692896 — nested container forwarding	`mcp_renderer_builtin.go` appends `GH_AW_INPUT_*` to TOML `env_vars` + JSON `env`	✅ `is_resolved: true`
r3651692910 — JS test coverage	Two cases added to `safe_outputs_config.test.cjs`	✅ `is_resolved: true`
r3651724189 — throw on unresolved placeholder	`throw new Error(msg)` added before `resolveEnvPlaceholders`	✅ `is_resolved: true`
r3651725169 — `server.debug` → `server.error`	Changed to `server.error` in `40cc205`	✅ `is_resolved: true`

The only blocker is the stale CHANGES_REQUESTED review 4780931179 from github-actions[bot] (PR Code Quality Reviewer), submitted against old commit 313f7c9. The issue it flagged (silent continuation without throw) was fixed in commit 40cc205. This review cannot be dismissed by the agent.

Smallest maintainer action set:

Comment /review on the PR to trigger a fresh Code Quality Reviewer evaluation against the current HEAD — this will supersede the stale CHANGES_REQUESTED and unblock merge.
Re-trigger CI (close/reopen PR or workflow_dispatch) since agent pushes do not trigger workflows.

No fresh code issues remain on the current HEAD c3608ed. Local make fmt, make lint, and make test-unit all pass.

gh-aw-bot · 2026-07-27T07:01:21Z

@copilot please run the pr-finisher skill, address the unresolved review threads below, and summarize whether this PR now only needs maintainer cleanup of stale blocking reviews.

Unresolved feedback to close out (newest first):

github-actions[bot]: fix: forward GH_AW_INPUT_* to MCP container env for dynamic safe-outputs config #48099 (comment)
github-actions[bot]: fix: forward GH_AW_INPUT_* to MCP container env for dynamic safe-outputs config #48099 (comment)
Copilot: fix: forward GH_AW_INPUT_* to MCP container env for dynamic safe-outputs config #48099 (comment)
Copilot: fix: forward GH_AW_INPUT_* to MCP container env for dynamic safe-outputs config #48099 (comment)

If all review threads are actually resolved already, say so clearly so maintainers can dismiss stale blocking reviews.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 15.3 AIC · ⌖ 8.16 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Copilot · 2026-07-27T07:06:14Z

@copilot please run the pr-finisher skill, address the unresolved review threads below, and summarize whether this PR now only needs maintainer cleanup of stale blocking reviews.

Unresolved feedbac...

All four threads are already is_resolved: true (confirmed via API):

Thread	Code fix	Resolved
r3651692896 — nested container forwarding	`mcp_renderer_builtin.go` appends `GH_AW_INPUT_*` to TOML `env_vars` + JSON `env` (commit `276a6bd`)	✅
r3651692910 — JS test coverage	Two cases added to `safe_outputs_config.test.cjs` (commit `ec6280d`)	✅
r3651724189 — throw on unresolved placeholder	`throw new Error(msg)` before `resolveEnvPlaceholders` (commit `40cc205`)	✅
r3651725169 — `server.debug` → `server.error`	Changed to `server.error` (commit `40cc205`)	✅

This PR only needs maintainer cleanup of the stale CHANGES_REQUESTED review 4780931179 (PR Code Quality Reviewer bot, submitted against old commit 313f7c9). That review's blocking issue was fixed in 40cc205.

Smallest remaining action set for maintainers:

Comment /review to trigger a fresh Code Quality Reviewer run against the current HEAD — this will supersede the stale review and unblock merge.
Re-trigger CI (close/reopen or workflow_dispatch) since agent pushes do not trigger workflows.

done

github-actions · 2026-07-27T07:33:05Z

🤖 PR Triage

Field	Value
Category	bug
Risk	🔴 high
Priority Score	82 / 100
Recommended Action	⚡ fast_track
CI Status	🟡 in-progress (21 pass, 0 fail of 30)

Score breakdown: Impact 42/50 · Urgency 24/30 · Quality 16/20

Rationale: GH_AW_INPUT_* variables never forwarded to Docker MCP container — dynamic safe-outputs config (e.g. ${GH_AW_INPUT_BASE_BRANCH}) broken since v0.80.0. High blast radius: any workflow using GH_AW_INPUT_*-based config in MCP step silently fails. Multiple SWE agent review passes. CI mostly passing.

Run §30246015734

Generated by 🔧 PR Triage Agent · sonnet46 · 36.5 AIC · ⌖ 5.31 AIC · ⊞ 5.7K · ◷

github-actions · 2026-07-27T09:15:21Z

🎉 This pull request is included in a new release.

Release: v0.83.4

Initial plan

3747a5e

Copilot AI assigned Copilot and pelikhan Jul 26, 2026

Copilot started work on behalf of pelikhan July 26, 2026 03:26 View session

Copilot AI linked an issue Jul 26, 2026 that may be closed by this pull request

[ARC/DinD] safe-outputs: dynamic base-branch unresolved — GH_AW_INPUT_* not passed to MCP container #47795

Closed

Copilot AI and others added 2 commits July 26, 2026 03:31

Initial plan for GH_AW_INPUT_* fix in MCP container env allowlist

249df6d

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

fix: forward GH_AW_INPUT_* to MCP container env for dynamic safe-outp…

313f7c9

…uts config Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix dynamic base-branch unresolved for safe-outputs~~ fix: forward GH_AW_INPUT_* to MCP container env for dynamic safe-outputs config Jul 26, 2026

Copilot finished work on behalf of pelikhan July 26, 2026 03:49

Copilot AI requested a review from pelikhan July 26, 2026 03:49

pelikhan marked this pull request as ready for review July 26, 2026 03:49

Copilot AI review requested due to automatic review settings July 26, 2026 03:49

Copilot started reviewing on behalf of pelikhan July 26, 2026 03:50 View session

Copilot AI reviewed Jul 26, 2026

View reviewed changes

Comment thread pkg/workflow/mcp_setup_gateway.go

Comment thread actions/setup/js/safe_outputs_config.cjs

github-actions Bot approved these changes Jul 26, 2026

View reviewed changes

docs: add ADR-48099 for forwarding GH_AW_INPUT_* vars to MCP gateway …

ecdab80

…container

github-actions Bot previously requested changes Jul 26, 2026

View reviewed changes

Comment thread actions/setup/js/safe_outputs_config.cjs

github-actions Bot reviewed Jul 26, 2026

View reviewed changes

Comment thread actions/setup/js/safe_outputs_config.cjs

github-actions Bot added pr-action:fast_track pr-agent:copilot pr-priority:high pr-risk:high pr-type:bug labels Jul 26, 2026

Copilot started work on behalf of gh-aw-bot July 27, 2026 01:52 View session

Copilot finished work on behalf of gh-aw-bot July 27, 2026 02:00

Copilot started work on behalf of gh-aw-bot July 27, 2026 02:59 View session

Copilot finished work on behalf of gh-aw-bot July 27, 2026 03:05

Copilot started work on behalf of gh-aw-bot July 27, 2026 04:19 View session

Copilot finished work on behalf of gh-aw-bot July 27, 2026 04:30

Merge branch 'main' into copilot/resolve-dynamic-base-branch-issue

b697adf

Copilot started work on behalf of gh-aw-bot July 27, 2026 05:47 View session

Copilot finished work on behalf of gh-aw-bot July 27, 2026 05:52

Merge branch 'main' into copilot/resolve-dynamic-base-branch-issue

97c3e00

Copilot started work on behalf of gh-aw-bot July 27, 2026 07:02 View session

Copilot finished work on behalf of gh-aw-bot July 27, 2026 07:06

Merge branch 'main' into copilot/resolve-dynamic-base-branch-issue

084ccf6

pelikhan merged commit 25ea149 into main Jul 27, 2026
35 checks passed

pelikhan deleted the copilot/resolve-dynamic-base-branch-issue branch July 27, 2026 07:34

github-actions Bot mentioned this pull request Jul 27, 2026

Smoke Test: MAI-Code-1-Flash - 30250271731 #48331

Closed

github-actions Bot mentioned this pull request Jul 27, 2026

[docs] Update glossary - weekly full scan #48360

Merged

Uh oh!

Conversation

Copilot AI commented Jul 26, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

pkg/workflow/mcp_setup_generator.go

pkg/workflow/mcp_setup_gateway.go

actions/setup/js/safe_outputs_config.cjs

pkg/workflow/safe_outputs_dynamic_allowed_repos_test.go

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 26, 2026

🧪 Test Quality Sentinel Report

Verdict

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 26, 2026

Design Decision Gate - ADR Required

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Blocking issue

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Key Themes

Positive Highlights

Uh oh!

Uh oh!

gh-aw-bot commented Jul 27, 2026

Uh oh!

Copilot AI commented Jul 27, 2026

Uh oh!

gh-aw-bot commented Jul 27, 2026

Uh oh!

Copilot AI commented Jul 27, 2026

Uh oh!

gh-aw-bot commented Jul 27, 2026

Uh oh!

Copilot AI commented Jul 27, 2026

Uh oh!

gh-aw-bot commented Jul 27, 2026

Uh oh!

Copilot AI commented Jul 27, 2026

Uh oh!

gh-aw-bot commented Jul 27, 2026

Uh oh!

Copilot AI commented Jul 27, 2026

Uh oh!

github-actions Bot commented Jul 27, 2026

🤖 PR Triage

Uh oh!

Uh oh!

github-actions Bot commented Jul 27, 2026

Uh oh!

Copilot AI commented Jul 26, 2026 •

edited by github-actions Bot

Loading

`pkg/workflow/mcp_setup_generator.go`

`pkg/workflow/mcp_setup_gateway.go`

`actions/setup/js/safe_outputs_config.cjs`

`pkg/workflow/safe_outputs_dynamic_allowed_repos_test.go`

github-actions Bot commented Jul 26, 2026 •

edited

Loading

github-actions Bot commented Jul 26, 2026 •

edited

Loading

github-actions Bot commented Jul 26, 2026 •

edited

Loading

github-actions Bot commented Jul 26, 2026 •

edited

Loading