feat: support multi-repo wildcard target-repo in safe_outputs job#36657
Conversation
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
Pull request overview
Adds wildcard ("*") support for target-repo in safe-outputs PR/push handlers by teaching the safe_outputs job to check out multiple repositories and by passing a compile-time checkout → path map down to JS handlers so they can operate in the correct subdirectory.
Changes:
- Generate multi-repo checkout + per-directory git-remote configuration in
safe_outputswhentarget-repo: "*"is used. - Inject
checkout_mappinginto safe-outputs handler config for wildcard runs and consume it in JS handlers (with workspace-scan fallbacks). - Update schema/docs and add a Go unit test for checkout mapping injection.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/safe_outputs_patch_workspace.go | Injects checkout_mapping into handler config for wildcard target-repo. |
| pkg/workflow/safe_outputs_config.go | Wires injectCheckoutMapping into compiled handler config env. |
| pkg/workflow/safe_outputs_config_generation.go | Wires injectCheckoutMapping into generated runtime config. |
| pkg/workflow/compiler_safe_outputs_steps.go | Adds multi-repo checkout / git credentialing / per-repo extra-ref fetching for wildcard targets. |
| pkg/workflow/compiler_safe_outputs_config_test.go | Adds test coverage for wildcard checkout mapping injection behavior. |
| pkg/parser/schemas/main_workflow_schema.json | Documents target-repo: "*" wildcard support in schema descriptions. |
| docs/src/content/docs/reference/safe-outputs-pull-requests.md | Documents cross-repo wildcard behavior and expectations. |
| actions/setup/js/push_to_pull_request_branch.cjs | Uses checkout_mapping to resolve repo checkout directory before scanning workspace. |
| actions/setup/js/create_pull_request.cjs | Uses checkout_mapping and process.chdir() (with restoration) to run git operations in the correct repo directory. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 9/9 changed files
- Comments generated: 4
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
pr-sous-chef: please resolve the active review feedback before merging.
|
|
|
|
|
|
|
dsyme
force-pushed
the
multi-repo-wildcard-safe-outputs
branch
2 times, most recently
from
20b788d to
a37790d
Compare
This comment has been minimized.
This comment has been minimized.
|
🧪 Smoke Multi PR is now testing multiple PR creation... |
|
Pull request created: #36750
|
|
Pull request created: #36751
|
Smoke Test: Multi-PR Creation — Run 26919046997Both pull requests were created successfully:
✅ Multi-PR creation is working correctly.
|
|
✅ Smoke Multi PR successfully created multiple PRs. |
Enable target-repo: "*" to support creating pull requests and pushing to branches across multiple repositories within a single workflow. Changes: - Add buildMultiRepoCheckoutSteps() to generate checkout steps for all repos - Add buildSafeOutputsMultiRepoFetchRefsStep() for multi-repo ref fetching - Add injectCheckoutMapping() to pass repo->path mapping to handlers - Update create_pull_request.cjs with process.chdir() for subdirectory repos - Update push_to_pull_request_branch.cjs with cwd option for git operations - Add findRepoCheckout utility for discovering repo checkouts in workspace - Add wildcard support documentation and schema updates
dsyme
force-pushed
the
multi-repo-wildcard-safe-outputs
branch
from
a37790d to
b6f0a91
Compare
|
✅ smoke-ci: safeoutputs CLI comment + comment-memory run (26920077843)
|
feat: support multi-repo wildcard
target-repoinsafe_outputsjobSummary
Extends the
safe_outputsjob to supporttarget-repo: "*"as a wildcard value increate_pull_requestandpush_to_pull_request_branchhandlers. When the wildcard is used, the agent selects the target repository at runtime, and thesafe_outputsjob automatically checks out all configuredcheckout:repos into subdirectories — enabling PRs to multiple repositories within a single workflow run.What changed and why
New wildcard checkout pipeline (
pkg/workflow/)compiler_safe_outputs_steps.gobuildMultiRepoCheckoutSteps()— whentarget-repo == "*", emitsactions/checkoutsteps for each non-wiki cross-repo entry withrepository:,path:,token:,fetch-depth:, sparse checkout, and per-subdirectory Git credential configuration. Also addsbuildSafeOutputsMultiRepoFetchRefsStep()for fetch-refs steps viagit -C.safe_outputs_patch_workspace.goinjectCheckoutMapping()builds amap[string]string(lowercaserepo/slug→ relative path) fromdata.CheckoutConfigsand injects it ascheckout_mappinginto the handler config whentarget-repo == "*". Skips wiki entries and guards against empty fields.safe_outputs_config.goinjectCheckoutMapping()during config construction.safe_outputs_config_generation.goinjectCheckoutMapping()during config generation.Fast-path checkout lookup in JS action (
actions/setup/js/)push_to_pull_request_branch.cjstarget-repois set, first consultsconfig.checkout_mapping(keyed by lowercase slug, resolved againstGITHUB_WORKSPACE) before falling back to the existingfindRepoCheckout()workspace scan.create_pull_request.cjsfinallyblock to restore the original working directory (process.chdir(originalCwd)) after multi-repo subdirectory operations usingrepoCwd; includes related refactors for patch size validation and workflow-id marker injection.Schema & docs
pkg/parser/schemas/main_workflow_schema.jsontarget-repofield descriptions in both handlers to document the"*"wildcard and its requirement forcheckout:configs withpath:.docs/.../safe-outputs-pull-requests.mdtarget-repo: "*"wildcard semantics and multi-repo checkout behaviour.Tests
compiler_safe_outputs_config_test.go: AddedTestInjectCheckoutMappingForWildcardTargetRepowith four sub-tests covering wildcard injection, non-wildcard skip, wiki exclusion, and unrelated handler skip.Behaviour before → after
target-repo: "org/repo"target-repo: "*"checkout:repos (non-wiki) checked out into subdirectories;checkout_mappinginjected for fast resolution in JS actionsTesting notes
TestInjectCheckoutMappingForWildcardTargetReposub-tests cover the mapping construction logic including edge cases (wiki exclusion, wrong handler, non-wildcard target).target-repo: "*"with at least twocheckout:entries withpath:defined.