Add gated merge-pull-request safe-output with policy-driven merge enforcement#27193
Open
Add gated merge-pull-request safe-output with policy-driven merge enforcement#27193
merge-pull-request safe-output with policy-driven merge enforcement#27193Conversation
…ding Agent-Logs-Url: https://github.com/github/gh-aw/sessions/31a07f1a-cfce-42d7-9fb2-5db24724d231 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/31a07f1a-cfce-42d7-9fb2-5db24724d231 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot created this pull request from a session on behalf of
pelikhan
April 19, 2026 13:44
View session
pelikhan
reviewed
Apr 19, 2026
| */ | ||
| async function getPullRequestWithMergeability(githubClient, owner, repo, pullNumber) { | ||
| let pr = null; | ||
| for (let i = 0; i < 3; i++) { |
Contributor
Author
There was a problem hiding this comment.
Updated in 355be65: switched mergeability retrieval to withRetry(...) with an explicit mergeability-pending retry condition and improved fallback error chaining.
Collaborator
|
@copilot must enforce that the base branch is not a protected branch or the default branch |
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/2b89cfe4-e6fd-4edf-ac73-d8ad50a84640 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/2b89cfe4-e6fd-4edf-ac73-d8ad50a84640 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Implemented in 355be65: added extensive logging throughout Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Collaborator
|
@copilot use withRetry for every graphql call |
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/b1124194-bc78-4fea-a403-2bc920b62c05 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/b1124194-bc78-4fea-a403-2bc920b62c05 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Implemented in a194986: Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Collaborator
|
@copilot use w3c-spec-writer to update safe-outputs specification |
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/88afb2b1-7be3-42a1-be22-0271d7ec255e Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Implemented in d4e226e: all GraphQL calls in Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/32fbbe57-499c-444c-8898-4a778723de9f Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Implemented in d9ccab5: updated the W3C-style safe-outputs specification with a new Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Collaborator
|
@copilot add tests to enforce spec |
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/8e341bdf-224f-4ff1-b265-5f2cdc3f0355 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Collaborator
|
@copilot merge to default branch is not allowed and should be refused. Update specification and add tests. |
Collaborator
|
@copilot ensure temporary ids are handled. |
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/8e341bdf-224f-4ff1-b265-5f2cdc3f0355 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Collaborator
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/8e341bdf-224f-4ff1-b265-5f2cdc3f0355 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Implemented in 80d176b (with core behavior change in f663f8b): Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/619e2266-55dc-4e30-8ee9-dd5121c508a7 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/619e2266-55dc-4e30-8ee9-dd5121c508a7 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/619e2266-55dc-4e30-8ee9-dd5121c508a7 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Implemented in 47b7e59: updated the safe-outputs specification to explicitly state merge_pull_request refuses merges to the repository default branch, and added tests enforcing that requirement (spec enforcement plus runtime default-branch detection coverage). No UI changes (no screenshot applicable).
Implemented in 47b7e59 and 7f6709d: merge_pull_request now handles temporary IDs for pull_request_number via resolved temporary-id mappings, including validation/error handling, and includes dedicated unit tests for resolved and unresolved temporary IDs. No UI changes (no screenshot applicable). Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
This was referenced Apr 19, 2026
This comment has been minimized.
This comment has been minimized.
Collaborator
|
Merge main and recompile. And add @copilot. |
…l-request-safe-output Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/b234fb4f-e045-4207-b31f-b67ab0d8b247 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
@copilot completed in 902c7c3 and ea2daf4: merged Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
This comment has been minimized.
This comment has been minimized.
1 similar comment
Contributor
|
Hey One item flagged during automated contribution check:
If you'd like a hand verifying and documenting the license, you can assign this prompt to your coding agent: Warning The following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "pypi.org"See Network Configuration for more information.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR introduces a new
safe-outputs.merge-pull-requestcapability that only merges PRs when repository, review, CI, branch, label, and file-scope gates pass. It extends the existing safe-output model (compiler + runtime) without introducing a separate execution path.Frontmatter + compiler integration
merge-pull-requesttoSafeOutputsConfigand extraction flow.required-labelsallowed-labelsallowed-branchesallowed-filesprotected-filesrequired-labelsandallowed-labels.Schema + tool contract updates
main_workflow_schema.jsonto supportsafe-outputs.merge-pull-request.merge_pull_requesttool schema to both safe-output tool catalogs:actions/setup/js/safe_outputs_tools.jsonpkg/workflow/js/safe_outputs_tools.jsonmerge_pull_requestpayload fields.allowed-labelssemantics in schema/docs to exact label names (not glob patterns).pull_request_numbersupport for temporary-ID based resolution in merge flow semantics.Runtime handler + gating logic
actions/setup/js/merge_pull_request.cjsand registered it in the safe-output handler manager.allowed-files/protected-filesfile gating (protected match blocks)withRetry(...)withRetry(...)allowed-labelsuses exact label matching (no glob matching).pull_request_numberusing resolved safe-output temporary-ID mappings, with explicit unresolved-ID error paths.Shared logic reuse
check_runs_helpers.cjs.check_skip_if_check_failing.cjsto consume the shared helper instead of duplicating logic.Permissions + state plumbing
contents:write+pull-requests:writepath).Specification updates
docs/src/content/docs/reference/safe-outputs-specification.md) to include a formalmerge_pull_requesttype section.allowed-labelsdocumentation to exact-match semantics.pull_request_number.Spec enforcement tests
pkg/workflow/safe_outputs_specification_merge_pull_request_test.goto enforce that the spec includes themerge_pull_requesttype section and required policy/permission statements.Runtime tests
actions/setup/js/merge_pull_request.test.cjswith targeted coverage for branch sanitization, protected base-branch policy detection, unsafe base-branch rejection behavior, and exact allowed-label matching behavior (including edge cases).pull_request_number(resolved and unresolved cases).Compiler validation tests
pkg/workflow/safe_outputs_validation_merge_pull_request_test.goto enforce non-empty validation behavior forrequired-labelsandallowed-labels.