Conversation
- Create safe_outputs_tools_generation.go with MCP tool definition functions: generateFilteredToolsJSON, generateCustomJobToolDefinition, addRepoParameterIfNeeded, generateDispatchWorkflowTool - Trim safe_outputs_config_generation.go to config-only functions: populateDispatchWorkflowFiles, generateSafeOutputsConfig (486 lines) - Add dedicated test files for both modules: safe_outputs_config_generation_test.go (167 lines) safe_outputs_tools_generation_test.go (232 lines)" Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Refactor safe_outputs_config_generation.go into focused modules
[file-diet] Split safe_outputs_config_generation.go (1092 lines) into focused modules
Feb 19, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This PR refactors safe_outputs_config_generation.go from 1092 lines into two focused modules, improving code maintainability without changing any logic.
Changes:
- Split
safe_outputs_config_generation.gointo two files: one for runtime validation config generation (486 lines) and one for MCP tool definition generation (613 lines) - Created dedicated test files for both modules with comprehensive test coverage
- No logic changes - purely mechanical code reorganization
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
safe_outputs_config_generation.go |
Removed 4 functions moved to tools generation file; updated imports to remove unused dependencies (fmt, sort, stringutil) |
safe_outputs_tools_generation.go |
New file containing 4 moved functions for MCP tool schema generation; includes all necessary imports |
safe_outputs_config_generation_test.go |
New test file covering config generation functions (dispatch workflow, missing tool, mentions, populateDispatchWorkflowFiles edge cases) |
safe_outputs_tools_generation_test.go |
New test file covering tools generation functions (custom job tool definitions, repo parameter injection, dispatch workflow tools, deterministic sorting) |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
pkg/workflow/safe_outputs_config_generation.gohad grown to 1092 lines mixing two distinct concerns: runtime validation config generation and MCP tool definition generation.Split
safe_outputs_config_generation.go(486 lines) — config-only:populateDispatchWorkflowFilesgenerateSafeOutputsConfigsafe_outputs_tools_generation.go(613 lines, new) — MCP tool definitions:generateFilteredToolsJSONgenerateCustomJobToolDefinitionaddRepoParameterIfNeededgenerateDispatchWorkflowToolDedicated test files
safe_outputs_config_generation_test.go— covers dispatch workflow config, missing_tool with issue creation, mentions config, andpopulateDispatchWorkflowFilesedge cases (nil, empty,.lock.ymlpreference)safe_outputs_tools_generation_test.go— covers custom job tool schema generation (type mappings, required fields, default descriptions), repo parameter injection, dispatch workflow tool generation, and deterministic job sorting in filtered outputNo logic changes — purely a mechanical split.
Warning
Firewall rules blocked me from connecting to one or more addresses (expand for details)
I tried to connect to the following addresses, but was blocked by firewall rules:
https://api.github.com/graphql/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GO111MODULE 64/bin/go git rev-�� --show-toplevel go ache/node/24.13.1/x64/bin/node -json GO111MODULE ache/go/1.25.0/x--show-toplevel ache/node/24.13.1/x64/bin/node(http block)/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw git 64/bin/go git conf�� --get remote.origin.url ptables --write ../../../**/*.jsrev-parse 64/bin/go git(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v3/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha g_.a GO111MODULE tartedAt,updatedAt,event,headBranch,headSha,displayTitle GOINSECURE fileutil GOMODCACHE go env 2512-41558/test-2770045852/.github/workflows GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE ortcfg(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE .cfg GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha /test1.md /test2.lock.yml g_.a GOINSECURE GOMOD GOMODCACHE go env runs/20260219-142512-41558/test-go1.25.0 GO111MODULE 1/x64/bin/node l GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha ue.number go /usr/bin/git -json GO111MODULE 64/bin/go git chec�� .github/workflows/test.md go /usr/bin/git -json GO111MODULE 64/bin/go git(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v5/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node /opt�� prettier --check 64/pkg/tool/linux_amd64/vet **/*.ts **/*.json --ignore-path 64/pkg/tool/linu1(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -json l kflow.test GOINSECURE GOMOD GOMODCACHE kflow.test 8214�� -test.paniconexit0(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha GOMODCACHE go /opt/hostedtoolcache/node/24.13.1/x64/bin/node -json GO111MODULE 64/bin/go node /tmp�� /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/audit-workflows.md go /usr/bin/git -json GO111MODULE 64/bin/go git(http block)https://api.github.com/repos/actions/github-script/git/ref/tags/v8/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 1/x64/lib/node_mGOMODCACHE GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE ache/go/1.25.0/xGOMODCACHE GOINSECURE GOMOD GOMODCACHE go env '**/*.ts' '**/*.GOINSECURE GO111MODULE ache/go/1.25.0/xGOMODCACHE GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE ache/go/1.25.0/xGOMODCACHE GOINSECURE GOMOD GOMODCACHE go env '**/*.ts' '**/*.GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/actions/setup-go/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha se 1423939/b127/vet.cfg /opt/hostedtoolcache/go/1.25.0/x/tmp/gh-aw-git-clone-3697711311 GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha 01 GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE %H %ct %D GOMODCACHE go env runs/20260219-142951-53474/test-3569236121/.github/workflows GO111MODULE /home/REDACTED/work/gh-aw/gh-aw/actions/setup/node_modules/.bin/node l GOMOD GOMODCACHE node(http block)https://api.github.com/repos/actions/setup-node/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha SameOutput3829714804/001/stability-test.md GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env 2512-41558/test-2671028610 GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha ithub/workflows/blog-auditor.md GO111MODULE 1/x64/bin/node GOINSECURE %H %ct %D ca6eac743b269d3c--show-toplevel 1/x64/bin/node env -json GO111MODULE ache/node/24.13.1/x64/bin/node GOINSECURE GOMOD GOMODCACHE npx(http block)https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts/usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE cx/AERBTSiwFBTdGremote.origin.url(http block)/usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts/usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go estl�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE /bin/sh(http block)/usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts/usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts/usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go estl�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh(http block)/usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts/usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet(http block)/usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts/usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go estl�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh(http block)/usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE x_amd64/cgo GOINSECURE GOMOD GOMODCACHE x_amd64/cgo env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts/usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh(http block)/usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/workflows/usr/bin/gh gh workflow list --json name,state,path -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.0/xGOMODCACHE GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE go tion�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD erignore go estl�� -json GO111MODULE 64/bin/go Action pins syngit GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999/usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env 2770045852/.github/workflows GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh(http block)/usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/nonexistent/repo/actions/runs/12345/usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node(http block)/usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/owner/repo/actions/workflows/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.0/xGOMODCACHE GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go **/*.json --ignore-path ../../../.pretti-json sh -c npx prettier --wGOINSECURE git /node tierignore x_amd64/vet /usr/bin/git go(http block)/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go **/*.ts **/*.json --ignore-path sh -c npx prettier --wGOINSECURE git 64/bin/go tierignore x_amd64/vet /usr/bin/git go(http block)https://api.github.com/repos/owner/repo/contents/file.md/tmp/go-build1821423939/b370/cli.test /tmp/go-build1821423939/b370/cli.test -test.testlogfile=/tmp/go-build1821423939/b370/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.0/xGOMODCACHE GOINSECURE GOMOD GOMODCACHE go(http block)/tmp/go-build1071031815/b370/cli.test /tmp/go-build1071031815/b370/cli.test -test.testlogfile=/tmp/go-build1071031815/b370/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true --show-toplevel go /usr/bin/docker sh -c "prettier" --wriGOINSECURE docker 64/bin/go test/race-image:sh x_amd64/vet /usr/bin/git node(http block)https://api.github.com/repos/test-owner/test-repo/actions/secrets/usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.0/xGOMODCACHE GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name npx prettier --wGOINSECURE git 64/bin/go --show-toplevel go /usr/bin/infocmp-json node /opt�� run format:pkg-json 64/bin/go tierignore x_amd64/link /usr/bin/git /bin/sh(http block)If you need me to access, download, or install something from one of these locations, you can either:
Original prompt
This section details on the original issue you should resolve
<issue_title>[file-diet] Refactor
safe_outputs_config_generation.go(1092 lines) into focused modules</issue_title><issue_description>The file
pkg/workflow/safe_outputs_config_generation.gohas grown to 1092 lines — well above the 800-line healthy threshold — with no dedicated test file. It mixes two distinct concerns that would benefit from separation.Current State
pkg/workflow/safe_outputs_config_generation.gosafe_outputs_test.go,safe_outputs_tools_test.go,dispatch_workflow_test.go, etc.)safe_outputs_config_generation_helpers.go(188 lines — healthy)Full File Analysis
Function Distribution
populateDispatchWorkflowFiles()generateSafeOutputsConfig()generateCustomJobToolDefinition()generateFilteredToolsJSON()addRepoParameterIfNeeded()generateDispatchWorkflowTool()Two Distinct Domains
Domain 1 – Runtime validation config (
generateSafeOutputsConfig,populateDispatchWorkflowFiles): Produces the JSON blob embedded in compiled workflows that the safe-outputs handler reads at runtime to validate tool calls (max counts, allowed labels, target repos, etc.).Domain 2 – MCP tools JSON (
generateFilteredToolsJSON,generateCustomJobToolDefinition,addRepoParameterIfNeeded,generateDispatchWorkflowTool): Produces the JSON array of MCP tool definitions exposed to the AI agent, including dynamic dispatch-workflow tools and custom safe-job tools.Complexity Hotspots
generateSafeOutputsConfig(lines 58–492): 435-line monolithic function with ~35 if-branches, one for each safe-output type. Each branch calls a helper but the accumulation makes the function hard to navigate.addRepoParameterIfNeeded(lines 840–995): 156-line switch statement that duplicatesconfig.AllowedRepos+config.TargetRepoSlugextraction for every tool type. The nestedswitchinside acase(lines 909–963) is a complexity hotspot.Refactoring Strategy
Proposed File Splits
safe_outputs_config_generation.go(keep, trimmed)populateDispatchWorkflowFiles,generateSafeOutputsConfigsafe_outputs_tools_generation.go(new)generateFilteredToolsJSON,generateCustomJobToolDefinition,addRepoParameterIfNeeded,generateDispatchWorkflowToolAdditional Refactoring Opportunities
generateSafeOutputsConfig: Extract the per-output-type config building into small private helpers (similar to what already exists in_helpers.go) to reduce the 435-line function body.addRepoParameterIfNeeded: Replace the largeswitchwith a helpergetRepoConfig(toolName string, safeOutputs *SafeOutputsConfig) (hasAllowedRepos bool, targetRepoSlug string)that uses a map-based dispatch, reducing ~120 lines to ~20.Test Coverage Plan
No dedicated test file currently exists. Add:
safe_outputs_config_generation_test.goTestGenerateSafeOutputsConfig— move/consolidate tests fromsafe_outputs_test.goTestPopulateDispatchWorkflowFiles— unit tests for the pre-pass functionsafe_outputs_tools_generation_test.goTestGenerateFilteredToolsJSON— move/consolidate fromsafe_outputs_tools_test.goTestGenerateCustomJobToolDefinition— unit tests for schema buildingTestAddRepoParameterIfNeeded— parametric tests for each tool typeTestGenerateDispatchWorkflowTool— input type mapping testsImplementation Guidelines
make test-unitpasses after each stepmake lintafter adding test files (watch for unused helpers)make fmtbefore committingAcceptance Criteria
safe_outputs_config_generation.go(1092 lines) into focused modules #16826💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.