Add support for importing safe-outputs from shared agentic workflows

[Copilot]

• Understand the existing codebase structure
• Create MergeSafeOutputs function in imports.go to merge safe-output configurations from imports
• Add conflict detection for overlapping safe-output types (create-issue, create-discussion, etc.)
• Integrate merge function into compiler.go
• Add test cases for safe-outputs import functionality
• Add test cases for conflict detection
• Run build and linting to validate changes
• Run code review and address feedback
• Run CodeQL security checks
• Run agent-finish to verify all workflows compile
• Extract safe-output type keys from embedded JSON schema instead of hardcoding
• Add support for importing safe-output meta fields (allowed-domains, staged, env, github-token, max-patch-size, runs-on)

Summary

This PR adds support for importing safe-outputs (like create-issue, add-comment, create-discussion, etc.) and meta fields from shared agentic workflows using the imports: field.

Changes

• pkg/parser/schema.go: Added GetSafeOutputTypeKeys() function to extract safe output type keys from the embedded main workflow schema, filtering out meta-configuration fields
• pkg/workflow/imports.go:
  • Updated to use parser.GetSafeOutputTypeKeys() instead of a hardcoded list, with caching for performance
  • Added support for importing meta fields: allowed-domains, staged, env, github-token, max-patch-size, runs-on
  • Updated merge logic to include configs with only meta fields (not just safe output types)
• pkg/workflow/compiler.go: Integrated merge into workflow parsing pipeline
• pkg/workflow/safe_outputs_import_test.go: Comprehensive tests for import and conflict scenarios, including meta field tests
• pkg/parser/schema_test.go: Added test for GetSafeOutputTypeKeys()

Usage

Shared workflow (shared-config.md):

---
safe-outputs:
  create-issue:
    title-prefix: "[shared] "
    labels: [imported]
  allowed-domains:
    - "example.com"
  staged: true
  github-token: "${{ secrets.CUSTOM_TOKEN }}"
  max-patch-size: 2048
  runs-on: "ubuntu-22.04"
---

Main workflow:

---
on: issues
imports:
  - ./shared-config.md
---

Conflict handling

If the same safe-output type is defined in both main and imported workflow:

safe-outputs conflict: 'create-issue' is defined in both the main workflow and an imported workflow

Note: Main workflow values take precedence over imported values for meta fields.

Original prompt

Add support for importing safe-outputs from shared agentic workflows. If a conflict is found while importing, fail the compilation.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[pelikhan]

@copilot can you mine these keys from of an the embedded main JSON schema?

[Copilot]

Added GetSafeOutputTypeKeys() in pkg/parser/schema.go that parses the embedded main_workflow_schema.json and extracts safe-output type keys dynamically. Meta-configuration fields (allowed-domains, staged, env, github-token, app, max-patch-size, jobs, runs-on) are filtered out. Results are cached using sync.Once for performance. Commit: 1c94c28

[pelikhan]

@copilot also allow import safe output meta fields

[Copilot]

Pull request overview

This PR adds support for importing safe-output configurations (such as create-issue, add-comment, create-discussion) from shared agentic workflows using the imports: field. The implementation extracts safe output type keys dynamically from the embedded JSON schema rather than hardcoding them, and includes conflict detection to prevent the same safe-output type from being defined in multiple locations.

Key changes:

• Dynamic schema-based safe output type extraction for maintainability
• Conflict detection between main and imported safe-output configurations
• Comprehensive test coverage for import scenarios and edge cases

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
pkg/parser/schema.go	Adds GetSafeOutputTypeKeys() function to extract safe output type keys from the embedded main workflow schema, filtering out meta-configuration fields like allowed-domains, staged, and env
pkg/parser/schema_test.go	Adds comprehensive test for GetSafeOutputTypeKeys() verifying correct extraction of safe output types and exclusion of meta fields
pkg/workflow/imports.go	Implements MergeSafeOutputs() with conflict detection, uses schema-extracted keys with caching, includes hasSafeOutputType() and mergeSafeOutputConfig() helper functions
pkg/workflow/compiler.go	Integrates safe-outputs merging into the workflow parsing pipeline after processing other imports
pkg/workflow/safe_outputs_import_test.go	Provides comprehensive integration and unit tests covering import scenarios, conflict detection (main vs import, import vs import), and multi-workflow imports
docs/src/content/docs/labs.mdx	Adds entry for "Daily Fact About gh-aw" workflow (appears unrelated to the PR's core purpose)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.

[pelikhan]

@copilot the safe-outputs content in app-config.md should also be importable (the app field)

[Copilot]

@copilot also allow import safe output meta fields

Added support for importing safe-output meta fields: allowed-domains, staged, env, github-token, max-patch-size, and runs-on. Main workflow values take precedence over imported values. Commit: d5580e8

[Copilot]

@copilot the safe-outputs content in app-config.md should also be importable (the app field)

The app field in safe-outputs is already importable and working. The implementation was added in earlier commits via mergeAppFromIncludedConfigs in safe_outputs_app.go. The tests in pkg/workflow/safe_outputs_app_import_test.go verify this functionality - TestSafeOutputsAppImport, TestSafeOutputsAppImportOverride, and TestSafeOutputsAppImportStepGeneration all pass. You can import shared/app-config.md into any workflow using the standard imports syntax.

[github-actions]

✅ Agentic Changeset Generator completed successfully.