Fix create_pull_request in safe-outputs container by installing git

[Copilot]

The safe-outputs MCP server runs in node:lts-alpine which lacks git. The create_pull_request tool fails when generating patches because git commands cannot execute in the container.

Changes

• New shell wrapper (actions/setup/sh/start_safe_outputs_mcp.sh):

  • Installs git via apk add --no-cache git
  • Configures git user identity (github-actions[bot])
  • Marks $GITHUB_WORKSPACE as safe directory
  • Execs MCP server

• Updated MCP configuration (pkg/workflow/mcp-config-builtin.go):

  • Changed container entrypoint: node → sh
  • Updated entrypointArgs to invoke shell wrapper
  • Applied to both JSON (Claude/Custom) and TOML (Codex) formats

• Recompiled workflows (133 files):

  • All safe-outputs MCP server configs now use shell wrapper

• Updated smoke-copilot workflow to test the fix:

  • Added create-pull-request safe-output configuration
  • Added test requirement to create poem file in poems/ directory and generate PR
  • Created poems/ directory structure for automated test outputs
  • Validates that create-pull-request works correctly with git in container

Example

Before:

"safeoutputs": {
  "container": "node:lts-alpine",
  "entrypoint": "node",
  "entrypointArgs": ["/opt/gh-aw/safeoutputs/mcp-server.cjs"]
}

After:

"safeoutputs": {
  "container": "node:lts-alpine",
  "entrypoint": "sh",
  "entrypointArgs": ["/opt/gh-aw/actions/start_safe_outputs_mcp.sh"]
}

The wrapper ensures git is available and properly configured before the MCP server processes create_pull_request requests. The smoke-copilot workflow now validates this functionality by creating test pull requests with poem files.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>safe-output create-pull-request is failing</issue_title>
<issue_description>Since we moved safe-outputs in its own container, it fails to invoke git properly to generate the patch that create-pull-request uses. We need to make sure that the safe-outputs has the user workspace mounted, git is properly configured in the container.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes safe-output create-pull-request is failing #11115

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[pelikhan]

@copilot update smoke-copilot to create a pull request with a new poem under "poems/*.md"

[Copilot]

@copilot update smoke-copilot to create a pull request with a new poem under "poems/*.md"

Updated smoke-copilot workflow to test create-pull-request functionality by creating a poem in poems/smoke-test-{run_id}.md. The workflow now:

• Creates a new test requirement (add cli flag to guard dropping a agentic workflow instructinos file #6) to generate a creative poem about GitHub Actions
• Commits the poem file
• Creates a pull request with the poem content
• Added safe-output configuration for create-pull-request with labels [smoke-copilot, automated-poem]
• Created the poems/ directory structure

Changes in commit d035824.