Fix: close_issue and add_labels handlers ignore target-repo config

[Copilot]

close_issue.cjs and add_labels.cjs were hardcoded to context.repo, preventing cross-repository operations despite target-repo being correctly compiled into GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG.

Changes

Adopt repo_helpers.cjs pattern (already used in add_comment.cjs):

• Import resolveTargetRepoConfig and resolveAndValidateRepo
• Extract defaultTargetRepo and allowedRepos from config at handler initialization
• Validate target repository per message
• Replace hardcoded repo references:
  • close_issue: context.repo.owner/repo → repoParts.owner/repo
  • add_labels: ...context.repo → owner: repoParts.owner, repo: repoParts.repo

Test coverage:

• 17 tests for close_issue.cjs (new file)
• 5 additional cross-repo tests for add_labels.cjs

Example

safe-outputs:
  close-issue:
    target: "*"
    target-repo: "microsoft/vscode"
    allowed-repos: ["github/gh-aw"]

Previously: handlers ignored config, operated only on workflow's repository
Now: handlers resolve target repo from config or message's repo field

Original prompt

---

This section details on the original issue you should resolve

<issue_title>close_issue and add_labels safe output handlers do not support target-repo for cross-repository operations</issue_title>
<issue_description>🤖 AI generated bug report

Summary

The close_issue.cjs and add_labels.cjs safe output handlers are hardcoded to context.repo, which means they always operate on the repository where the workflow runs. The target-repo frontmatter config compiles correctly and is passed to the handler via GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG, but the handlers never read it.

This prevents cross-repository workflows (e.g., a workflow in org/engineering that closes issues or adds labels in org/product).

Expected Behavior

When target-repo is configured in frontmatter:

Note: My scenario ideally uses allowed-repos here, as we have a single repo that houses operations on many repos.

safe-outputs:
  close-issue:
    target: "*"
    target-repo: "microsoft/vscode"
  add-labels:
    target: "*"
    target-repo: "microsoft/vscode"

The handlers should resolve the target repository from config (and/or from the agent's repo field in the message).

Actual Behavior

• add_labels.cjs uses ...context.repo at line 109
• close_issue.cjs uses context.repo.owner / context.repo.repo at lines 140, 176, 181
• Both ignore the target-repo value in the handler config

The config is correctly passed at runtime — visible in the GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG env var:

{
  "add_labels": {
    "allowed": ["~spam"],
    "max": 1,
    "target": "*",
    "target-repo": "benvillalobos/gh-aw-test-target"
  }
}

But neither handler reads config["target-repo"].

Working Reference Implementation

add_comment.cjs already supports target-repo correctly using repo_helpers.cjs:

const { resolveTargetRepoConfig, resolveAndValidateRepo } = require("./repo_helpers.cjs");
// ...
const { defaultTargetRepo, allowedRepos } = resolveTargetRepoConfig(config);
// ...
const repoResult = resolveAndValidateRepo(item, defaultTargetRepo, allowedRepos, "comment");

The same pattern can be applied to close_issue.cjs and add_labels.cjs.

Reproduction

1. Create a workflow with target-repo set to an external repo
2. Trigger the workflow and have the agent call add_labels or close_issue on an issue in the external repo
3. The safe output job fails with Not Found because it tries to operate on context.repo instead of the target repo

Example failed run: https://github.com/benvillalobos/gh-aw-test/actions/runs/21918590680/job/63292710318

Relevant log output:

Adding 1 labels to issue github/gh-aw#277977: ["~spam"]
Failed to add labels: Not Found
Failed to close issue github/gh-aw#277977: Not Found

Issue github/gh-aw#277977 exists in microsoft/vscode, but the handler looked in benvillalobos/gh-aw-test.

Documentation Reference

The Safe Outputs docs and individual sections for close-issue and add-labels both show target-repo as a supported field.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes close_issue and add_labels safe output handlers do not support target-repo for cross-repository operations #15027

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

Fixes cross-repository safe-output behavior by making the close_issue and add_labels handlers honor the compiled target-repo / allowed_repos configuration (via the existing repo_helpers.cjs resolution/validation pattern already used by add_comment).

Changes:

• Update close_issue.cjs and add_labels.cjs to resolve/validate the target repository per message using resolveTargetRepoConfig + resolveAndValidateRepo, and to issue API calls against the resolved owner/repo instead of context.repo.
• Add comprehensive new unit tests for close_issue (new test file) and extend add_labels tests to cover cross-repo behavior (config default target-repo, message repo override, allowed-repos enforcement, bare repo qualification).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
actions/setup/js/close_issue.cjs	Uses repo_helpers.cjs to honor target-repo / allowed_repos and routes REST calls to resolved owner/repo.
actions/setup/js/add_labels.cjs	Same repo resolution/validation; replaces ...context.repo with resolved owner/repo for label operations and logging.
actions/setup/js/close_issue.test.cjs	Adds a full test suite including cross-repo scenarios and allowed-repos enforcement.
actions/setup/js/add_labels.test.cjs	Adds targeted tests validating the new cross-repo behavior and validation rules.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.