Enable copy-project safe output by default for campaign orchestrators

[Copilot]

✅ Complete: Enable copy-project Safe Output for Campaign Orchestrators

Campaigns now use safe outputs by default for both:

• ✅ copy-project from githubnext "[TEMPLATE: Agentic Campaign]" (https://github.com/orgs/githubnext/projects/74)
• ✅ create-project-status-update (already enabled)

Changes Made

1. Campaign Orchestrator Configuration (pkg/campaign/orchestrator.go)

Added CopyProjects to SafeOutputsConfig in BuildOrchestrator:

• Default source-project: Uses constants.DefaultCampaignTemplateProjectURL
• Max: 1 (typically used once per campaign)
• Inherits custom GitHub token from campaign spec if provided

2. Constants (pkg/constants/constants.go)

Added DefaultCampaignTemplateProjectURL constant:

• Type: URL
• Value: https://github.com/orgs/githubnext/projects/74
• Documents the template project reference

3. Safe Outputs Config Generation (pkg/workflow/safe_outputs_config_generation.go)

• Added copy-project to config map generation (lines 177-181)
• Added copy-project to enabled tools list (lines 511-513)

4. Campaign Orchestrator Rendering (pkg/cli/compile_orchestrator.go)

Added copy-project rendering in renderGeneratedCampaignOrchestratorMarkdown:

• Renders source-project, target-owner, and github-token in generated frontmatter
• Matches format used for other safe outputs

5. Tests (pkg/campaign/orchestrator_test.go)

Added TestBuildOrchestrator_CopyProjectSafeOutput:

• Verifies copy-project enabled by default with template source
• Verifies custom GitHub token properly configured

Verification

Compiled .github/workflows/file-size-reduction-project71.campaign.lock.yml demonstrates complete implementation:

Config generated:

{"copy_project":{"max":1},...}

Step generated:

- name: Copy Project
  id: copy_project
  if: contains(needs.agent.outputs.output_types, 'copy_project')
  env:
    GH_AW_COPY_PROJECT_SOURCE: "https://github.com/orgs/githubnext/projects/74"
  with:
    github-token: ${{ secrets.GH_AW_PROJECT_GITHUB_TOKEN }}
  script: |
    const { main } = require('/tmp/gh-aw/actions/copy_project.cjs');
    await main();

Frontmatter generated:

safe-outputs:
  copy-project:
    max: 1
    source-project: https://github.com/orgs/githubnext/projects/74
    github-token: ${{ secrets.GH_AW_PROJECT_GITHUB_TOKEN }}

Test Results

✅ All campaign tests pass (37/37)
✅ All copy-project tests pass (4/4)
✅ Compiled campaign includes all expected configuration

Note: Some unrelated test failures exist in pkg/workflow trial mode tests, but these are pre-existing and unrelated to the copy-project changes.

Original prompt

Campaigns should (by default/ orchestator) use safe outputs:

• copy-project from githubnext "[TEMPLATE: Agentic Campaign]" https://github.com/orgs/githubnext/projects/74
• create-project-status-update

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.