Fix safe-output updates for fork pull request branches

[dsyme]

Summary

• record the triggering pull request's trusted head repository alongside its branch, ref, SHA, base repository, and PR number
• forward that metadata through both the MCP gateway and nested safeoutputs containers so push_to_pull_request_branch can generate incremental patches from the fetched PR head
• reject contributor-fork pushes during the agent's safe-output call when head-repo does not authorize the fork, including when a PAT may have write access
• tell the agent not to retry an unsupported push and to report the proposed code through add_comment or report_incomplete
• add JS, renderer, compiler, integration, and WASM golden coverage for the full metadata path and fork policy

Root cause

The checkout step recorded the fetched PR head before agent commits, and patch generation knew how to consume that baseline. However, the generated MCP gateway command and nested safeoutputs server configuration did not forward the recorded metadata. Inside the safeoutputs container, incremental patch generation therefore fell back to origin/<branch>, which does not exist for a contributor-fork branch.

This change propagates the trusted baseline across both container boundaries. It also records and propagates the actual PR head repository so MCP-time validation can distinguish an authorized fork destination from the base repository.

Fork authorization

Credentials and destination authorization remain separate. A github-token or PAT supplies credentials, but it does not authorize an arbitrary contributor fork. The workflow must explicitly configure safe-outputs.push-to-pull-request-branch.head-repo for that fork.

When the triggering PR belongs to an unconfigured contributor fork, the safe-output call now fails before persisting a patch or bundle. The existing privileged apply-time validation remains in place as defense in depth.

Validation

Targeted validation completed:

• renderer tests for JSON and TOML safeoutputs configuration
• gateway command and full workflow-compilation tests for both container boundaries
• integration test for safeoutputs MCP runtime paths
• JS tests for baseline persistence, configured-fork acceptance, and PAT-only rejection at MCP and apply time
• push outcome and reporting tests
• WASM golden tests and regenerated compiler fixtures

Live validation in fsprojects/Paket confirmed:

• run 33074154008 generated and persisted the incremental patch/bundle from the recorded fork baseline
• run 33076542465 completed the memory and reporting path successfully

Fixes #56115

[Copilot]

Pull request overview

Forwards recorded PR-head baseline metadata through MCP container boundaries so safe outputs can update fork PR branches.

Changes:

• Passes baseline variables into the MCP gateway and nested safeoutputs containers.
• Adds JSON, TOML, and workflow-compilation regression checks.
• Adds a patch changeset.

Show a summary per file

File	Description
.changeset/patch-forward-pr-head-baseline-to-safeoutputs.md	Documents the patch behavior.
pkg/workflow/mcp_setup_gateway.go	Forwards metadata into the gateway container.
pkg/workflow/mcp_renderer_builtin.go	Adds metadata to JSON and TOML safeoutputs configurations.
pkg/workflow/mcp_setup_generator_test.go	Tests compiled workflow forwarding.
pkg/workflow/mcp_renderer_test.go	Tests JSON and TOML rendering.
pkg/workflow/mcp_gateway_mount_policy_test.go	Tests gateway environment flags.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 6/6 changed files
• Comments generated: 2
• Review effort level: Balanced

[dsyme]

Live validation against fsprojects/Paket PR #4321:

• Run https://github.com/fsprojects/Paket/actions/runs/33074154008 compiled from this branch and propagated all five GH_AW_PR_HEAD_BASE_* values through both container boundaries. The safeoutputs MCP handler used the recorded fork-PR baseline d98e779eaf8e556d1045164f4bba9438d1cceeb5, generated the incremental patch and bundle, and persisted a terminal push_to_pull_request_branch item. This confirms the bug fixed by this PR.
• The downstream handler then correctly rejected the actual write because PR [refactor] 🔧 Semantic Function Clustering Analysis: Code Organization Refactoring Opportunities #4321 is headed from contributor fork Desarc/Paket, while Paket has no configured head-repo or fork-write credential. Arbitrary contributor-fork writes remain forbidden by the existing specification; this is separate from baseline generation.
• After Paket migrated repo memory to its updated schema, run https://github.com/fsprojects/Paket/actions/runs/33076542465 completed all jobs successfully. The agent emitted report_incomplete for the known external-fork credential limitation, safe_outputs processed it successfully, memory validation reported notes.json conforms to schema, and push_repo_memory plus conclusion reporting succeeded.

Targeted validation after merging current main:

• renderer/gateway and formal RS-05a Go tests
• TestSafeOutputsMCPContainerUsesRuntimePaths with integration tag
• make test-wasm-golden
• make fmt
• git diff --check

All passed. Merge commit: 9f5e27f64e.

[dsyme]

Follow-up on contributor-fork error handling (093aeb9551):

The early MCP rejection now occurs only when the apply-time handler is guaranteed to reject the same operation under the existing destination policy: the trusted PR head repository differs from the base repository and does not match configured head-repo.

A github-token/PAT alone does not bypass this check. The PAT may technically have write access, but head-repo is the explicit repository authorization boundary; without it, the downstream handler rejects before any git operation. The error now says this directly and tells the agent to configure the exact head-repo with matching credentials, or report the proposed code via add_comment/report_incomplete.

Paired tests cover both layers with a PAT present:

• MCP handler rejects the unconfigured fork without persisting a doomed push.
• Apply-time handler independently rejects the identical configuration before git.
• An exact configured head-repo remains accepted and persisted.

Focused validation passed: checkout head-repo export, safe-output baseline/fork guard, all 5 apply-time fork cases, renderer/gateway tests, compile-level integration test, WASM goldens, formatting, and git diff --check.

[gh-aw-bot]

@copilot
Please follow through on the remaining review feedback and then run the pr-finisher skill.

Open review threads with follow-up already posted:

• Copilot: Fix safe-output updates for fork pull request branches #56341 (comment)
• Copilot: Fix safe-output updates for fork pull request branches #56341 (comment)

Failed checks to address:

• impacted-go-tests: https://github.com/github/gh-aw/actions/runs/33079181460/job/98541500076
• Unit tests (A-C): https://github.com/github/gh-aw/actions/runs/33079181460/job/98541879490
• Unit tests (D-G): https://github.com/github/gh-aw/actions/runs/33079181460/job/98541879646
• Unit tests (S-Z and other): https://github.com/github/gh-aw/actions/runs/33079181460/job/98541879422

I also attempted a branch refresh where allowed. After addressing the above, please run the pr-finisher skill.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 18.6 AIC · ⌖ 8.23 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot
Please follow through on the remaining review feedback and then run the pr-finisher skill.
...

Both review threads were already resolved (dsyme's replies in 1ce1b30 / 093aeb9 addressed the TOML expectation and WASM golden regeneration), so no further action was needed there.

The CI failures traced to a single root cause: TestCompileWorkflow_AllManifestContainersArePinned failing because the branch was missing upstream's MCP container image pin bump (ghcr.io/github/gh-aw-mcpg:v0.4.12, ghcr.io/github/github-mcp-server:v1.11.0), which had already been fixed on main in #56345/#56346. Merged current main into this branch (clean, no conflicts) and recompiled all workflow .lock.yml files (also picking up the GH_AW_PR_HEAD_REPO forwarding from 093aeb9 that hadn't been recompiled yet).

Validated: targeted renderer/gateway tests, full make test-unit, make test-wasm-golden, make fmt, and git diff --check all pass.