Add allowed-repos support to add-labels and close-issue safe outputs

.github/workflows/smoke-copilot.md

@@ -49,12 +49,14 @@ safe-outputs:
     add-comment:
       hide-older-comments: true
       max: 2
+      allowed-repos: ["github/gh-aw"]
     create-issue:
       expires: 2h
       group: true
       close-older-issues: true
     add-labels:
       allowed: [smoke-copilot]
+      allowed-repos: ["github/gh-aw"]
     remove-labels:
       allowed: [smoke]
     dispatch-workflow:

pkg/parser/schemas/main_workflow_schema.json

@@ -4570,6 +4570,13 @@
                 "target-repo": {
                   "type": "string",
                   "description": "Target repository in format 'owner/repo' for cross-repository operations. Takes precedence over trial target repo settings."
+                },
+                "allowed-repos": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "description": "List of additional repositories in format 'owner/repo' that issues can be closed in. When specified, the agent can use a 'repo' field in the output to specify which repository to close the issue in. The target repository (current or target-repo) is always implicitly allowed."
                 }
               },
               "additionalProperties": false,
@@ -5018,6 +5025,13 @@
                 "github-token": {
                   "$ref": "#/$defs/github_token",
                   "description": "GitHub token to use for this specific output type. Overrides global github-token if specified."
+                },
+                "allowed-repos": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "description": "List of additional repositories in format 'owner/repo' that labels can be added to. When specified, the agent can use a 'repo' field in the output to specify which repository to add labels to. The target repository (current or target-repo) is always implicitly allowed."
                 }
               },
               "additionalProperties": false

pkg/workflow/safe_outputs_config_generation.go

@@ -90,10 +90,19 @@ func generateSafeOutputsConfig(data *WorkflowData) string {
 			)
 		}
 		if data.SafeOutputs.AddComments != nil {
-			safeOutputsConfig["add_comment"] = generateMaxWithTargetConfig(
+			additionalFields := make(map[string]any)
+			// Note: AddCommentsConfig has Target, TargetRepoSlug, AllowedRepos but not embedded SafeOutputTargetConfig
+			// So we need to construct the target config manually
+			targetConfig := SafeOutputTargetConfig{
+				Target:         data.SafeOutputs.AddComments.Target,
+				TargetRepoSlug: data.SafeOutputs.AddComments.TargetRepoSlug,
+				AllowedRepos:   data.SafeOutputs.AddComments.AllowedRepos,
+			}
+			safeOutputsConfig["add_comment"] = generateTargetConfigWithRepos(
+				targetConfig,
 				data.SafeOutputs.AddComments.Max,
 				1, // default max
-				data.SafeOutputs.AddComments.Target,
+				additionalFields,
 			)
 		}
 		if data.SafeOutputs.CreateDiscussions != nil {
@@ -118,11 +127,18 @@ func generateSafeOutputsConfig(data *WorkflowData) string {
 			)
 		}
 		if data.SafeOutputs.CloseIssues != nil {
-			safeOutputsConfig["close_issue"] = generateMaxWithRequiredFieldsConfig(
+			additionalFields := make(map[string]any)
+			if len(data.SafeOutputs.CloseIssues.RequiredLabels) > 0 {
+				additionalFields["required_labels"] = data.SafeOutputs.CloseIssues.RequiredLabels
+			}
+			if data.SafeOutputs.CloseIssues.RequiredTitlePrefix != "" {
+				additionalFields["required_title_prefix"] = data.SafeOutputs.CloseIssues.RequiredTitlePrefix
+			}
+			safeOutputsConfig["close_issue"] = generateTargetConfigWithRepos(
+				data.SafeOutputs.CloseIssues.SafeOutputTargetConfig,
 				data.SafeOutputs.CloseIssues.Max,
 				1, // default max
-				data.SafeOutputs.CloseIssues.RequiredLabels,
-				data.SafeOutputs.CloseIssues.RequiredTitlePrefix,
+				additionalFields,
 			)
 		}
 		if data.SafeOutputs.CreatePullRequests != nil {
@@ -152,10 +168,15 @@ func generateSafeOutputsConfig(data *WorkflowData) string {
 			)
 		}
 		if data.SafeOutputs.AddLabels != nil {
-			safeOutputsConfig["add_labels"] = generateMaxWithAllowedConfig(
+			additionalFields := make(map[string]any)
+			if len(data.SafeOutputs.AddLabels.Allowed) > 0 {
+				additionalFields["allowed"] = data.SafeOutputs.AddLabels.Allowed
+			}
+			safeOutputsConfig["add_labels"] = generateTargetConfigWithRepos(
+				data.SafeOutputs.AddLabels.SafeOutputTargetConfig,
 				data.SafeOutputs.AddLabels.Max,
 				3, // default max
-				data.SafeOutputs.AddLabels.Allowed,
+				additionalFields,
 			)
 		}
 		if data.SafeOutputs.RemoveLabels != nil {

pkg/workflow/safe_outputs_config_generation_helpers.go

@@ -155,3 +155,34 @@ func generateHideCommentConfig(max int, defaultMax int, allowedReasons []string)
 	}
 	return config
 }
+
+// generateTargetConfigWithRepos creates a config with target, target-repo, allowed_repos, and optional fields.
+// Note on naming conventions:
+// - "target-repo" uses hyphen to match frontmatter YAML format (key in config.json)
+// - "allowed_repos" uses underscore to match JavaScript handler expectations (see repo_helpers.cjs)
+// This inconsistency is intentional to maintain compatibility with existing handler code.
+func generateTargetConfigWithRepos(targetConfig SafeOutputTargetConfig, max int, defaultMax int, additionalFields map[string]any) map[string]any {
+	config := generateMaxConfig(max, defaultMax)
+
+	// Add target if specified
+	if targetConfig.Target != "" {
+		config["target"] = targetConfig.Target
+	}
+
+	// Add target-repo if specified (use hyphenated key for consistency with frontmatter)
+	if targetConfig.TargetRepoSlug != "" {
+		config["target-repo"] = targetConfig.TargetRepoSlug
+	}
+
+	// Add allowed_repos if specified (use underscore for consistency with handler code)
+	if len(targetConfig.AllowedRepos) > 0 {
+		config["allowed_repos"] = targetConfig.AllowedRepos
+	}
+
+	// Add any additional fields
+	for key, value := range additionalFields {
+		config[key] = value
+	}
+
+	return config
+}