Document and validate draft: true default for create-pull-request

[Copilot]

Agentic workflows should create draft PRs by default as a security best practice, preventing accidental auto-merge of AI-generated code. The default was already draft: true, but this was implicit and undocumented.

Changes

• Documentation: Updated struct field and code comments to clarify draft: true is the default and explain security rationale
• Validation: Added debug log warning when draft: false is explicitly set (informational only, non-blocking)
• JavaScript: Enhanced comments in create_pull_request.cjs handler to document the default behavior

Example

safe-outputs:
  create-pull-request:
    title-prefix: "[ai] "
    labels: [automation]
    # draft: true is the default - omit or set explicitly
    # Use draft: false only for auto-merge workflows

When compiling workflows with draft: false, debug output now includes:

WARNING: draft: false is explicitly set - agentic workflows should create draft PRs by default

No breaking changes - workflows with explicit draft: false continue to work for intentional auto-merge scenarios.

Original prompt

All agentic workflows using create-pull-request should use draft: true or omit it is the default

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.