Handle GitHub Actions PR creation permission errors with auto-filed issues #11410

Copilot · 2026-01-22T23:34:14Z

Plan: Add error handling for "GitHub actions is not permitted to create or approve pull requests"

Changes Completed

Files Modified

/home/runner/work/gh-aw/gh-aw/actions/setup/js/create_pull_request.cjs - Added error detection and output
/home/runner/work/gh-aw/gh-aw/actions/setup/js/handle_create_pr_error.cjs - NEW: Error handler script (automatically copied by setup.sh)
/home/runner/work/gh-aw/gh-aw/pkg/workflow/create_pull_request.go - Added error_message output
/home/runner/work/gh-aw/gh-aw/pkg/workflow/notify_comment.go - Updated to use require() pattern
24+ workflow .lock.yml files - Recompiled to use new handler

Implementation Details

When create_pull_request fails with permission error:

JavaScript handler detects "GitHub Actions is not permitted to create or approve pull requests"
Sets core.setOutput("error_message", ...) with helpful message and documentation link
Conclusion job reads ${{ needs.create_pull_request.outputs.error_message }}
Calls handle_create_pr_error.cjs using require() pattern (like other handlers)
Creates or updates an issue with step-by-step instructions

Note on setup.sh

The setup.sh script in actions/setup/ automatically copies all .cjs files from actions/setup/js/ to /opt/gh-aw/actions/ at runtime, so no changes to setup.sh were needed.

Original prompt

Update the javascript safe output type handler for create-pull-request such that if the create pull request fails with "GitHub actions is not permitted to create or approve pull requests", register an error message as an output variable such that the conclusion job can file an issue stating the github actions need to be allowed to create pull requests in the repo (+ link to docs)

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Changeset

Type: patch
Description: Handle GitHub Actions PR creation permission errors by emitting an error_message output and adding an auto-filed issue handler with guidance and docs links when Actions cannot create or approve pull requests in the repository.

Ahoy! This treasure was crafted by 🏴‍☠️ Changeset Generator

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

- Modified create_pull_request.cjs to detect "GitHub Actions is not permitted to create or approve pull requests" error - Set error_message output variable when permission error occurs - Added error_message output to create_pull_request job definition - Added conclusion job step to handle permission errors and create tracking issue - Issue includes instructions and documentation link for enabling PR creation permission Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

- Changed from file-based script to inline script in notify_comment.go - Script is now properly embedded in the conclusion job step - All unit tests related to my changes pass - Note: Unrelated TestCodexEngineRenderMCPConfig failure exists in main Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-01-23T01:31:04Z

@copilot move JavaScript to file in actions/setup/js , update setup.sh

- Created handle_create_pr_error.cjs in actions/setup/js/ - Updated notify_comment.go to use require() instead of inline script - Script is automatically copied by setup.sh to /opt/gh-aw/actions/ - Follows same pattern as other handlers like handle_agent_failure.cjs Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-01-23T01:38:45Z

@copilot move JavaScript to file in actions/setup/js , update setup.sh

Done in d5525fe. Created handle_create_pr_error.cjs in actions/setup/js/ and updated notify_comment.go to use the require() pattern. The setup.sh script automatically copies all .cjs files to /opt/gh-aw/actions/ at runtime.

pelikhan · 2026-01-23T01:57:09Z

Recompile with @copilot.

- All workflows with create-pull-request now use handle_create_pr_error.cjs - Changed from inline script to require() pattern across all workflows - 24 workflow lock files updated with the new handler Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-01-23T02:02:38Z

Recompile with @copilot.

Done in 705b87e. Recompiled all 137 workflows - 24 workflows with create-pull-request now use the file-based handle_create_pr_error.cjs handler instead of inline scripts.

github-actions · 2026-01-23T02:06:58Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-01-23T02:07:00Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-01-23T02:07:02Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-01-23T02:07:02Z

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

github-actions · 2026-01-23T02:10:52Z

PR titles reviewed: Add discussion commenting to smoke workflows with explicit instructions, deprecate discussion flag
PR titles reviewed: Correct PR description: YAML context not shell injection in code scanning alert #538
GitHub MCP merged PRs ✅
SafeInputs gh pr list ✅
Serena activate_project ✅
Playwright github title ✅
Tavily search ✅
File write + bash cat ✅
Discussion query + comment ✅
Overall status: PASS

AI generated by Smoke Codex

github-actions · 2026-01-23T02:10:58Z

🎮 GAME OVER? Not quite! The Copilot smoke test agent just popped in to say hi! 👾

We're testing all the things - GitHub MCP, Serena, Playwright, file I/O, bash tools, and of course... visiting your excellent Firewall Escape report!

Your sandbox security work is chef's kiss 🤌 - 40 techniques, 100% novelty, zero escapes. That's some serious defense-in-depth action right there!

Keep up the amazing security testing! 🛡️✨

Beep boop 🤖 - Smoke test agent signing off!

AI generated by Smoke Copilot

github-actions · 2026-01-23T02:10:59Z

Smoke Test: Copilot - PASS ✅

Recent PRs tested:

Add discussion commenting to smoke workflows with explicit instructions, deprecate discussion flag #11360: Add discussion commenting to smoke workflows
Correct PR description: YAML context not shell injection in code scanning alert #538 #11426: Correct PR description: YAML context not shell injection

Test Results:

✅ GitHub MCP
✅ Safe Inputs GH CLI
✅ Serena MCP
✅ Playwright (github.com verified)
✅ File Writing
✅ Bash Tools
✅ Discussion Interaction ([Firewall Escape] Firewall Escape Test Report - Run 21270938220 - January 23, 2026 #11421)

Overall Status: PASS ✅

cc @pelikhan

AI generated by Smoke Copilot

github-actions · 2026-01-23T02:11:13Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-01-23T02:11:31Z

Smoke Test Results - Claude Engine

Overall Status: ✅ PASS

Test	Result
GitHub MCP	✅
Safe Inputs GH CLI	✅
Serena MCP	✅
Playwright	✅
Tavily	✅
File Writing	✅
Bash Tool	✅
Discussion Interaction	✅

PRs Retrieved:

Fix smoke test workflows not removing smoke label #11429 "[WIP] Debug smoke label removal by safe-outputs tool"
docs: Document remove-labels safe output type #11425 "docs: Document remove-labels safe output type"

Run: §21271981674

AI generated by Smoke Claude

Initial plan

7d656c4

Copilot AI assigned Copilot and pelikhan Jan 22, 2026

Copilot started work on behalf of pelikhan January 22, 2026 23:34 View session

Copilot AI and others added 3 commits January 22, 2026 23:39

Initial plan for create-pull-request error handling

332f489

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Update javascript safe output handler for create-pull-request~~ Handle GitHub Actions PR creation permission errors with auto-filed issues Jan 22, 2026

Copilot AI requested a review from pelikhan January 22, 2026 23:59

Copilot finished work on behalf of pelikhan January 22, 2026 23:59

This was referenced Jan 23, 2026

Add discussion commenting to smoke workflows with explicit instructions, deprecate discussion flag #11360

Merged

Smoke Test: Copilot - 21271197457 #11422

Closed

Copilot started work on behalf of pelikhan January 23, 2026 01:31 View session

Copilot finished work on behalf of pelikhan January 23, 2026 01:39

Copilot started work on behalf of pelikhan January 23, 2026 01:57 View session

Copilot finished work on behalf of pelikhan January 23, 2026 02:03

pelikhan added the smoke label Jan 23, 2026

Add changeset [skip-ci]

40623c6

github-actions bot added the smoke-codex label Jan 23, 2026

github-actions bot added the smoke-copilot label Jan 23, 2026

github-actions bot mentioned this pull request Jan 23, 2026

Smoke Test: Copilot - 21271981673 #11430

Closed

github-actions bot mentioned this pull request Jan 23, 2026

Smoke Test: Claude - 21271981674 #11431

Closed

github-actions bot added the smoke-claude label Jan 23, 2026

pelikhan marked this pull request as ready for review January 23, 2026 02:28

pelikhan merged commit c495d9a into main Jan 23, 2026
83 checks passed

pelikhan deleted the copilot/update-js-safe-output-handler branch January 23, 2026 02:28

This was referenced Jan 23, 2026

Smoke Test: Copilot - 21273041218 #11435

Closed

docs: Document remove-labels safe output type #11425

Merged

Smoke Test: Claude - 21273041266 #11436

Closed

[team-status] ☀️ Daily Team Status - January 23, 2026 #11478

Closed

Handle GitHub Actions PR creation permission errors with auto-filed issues #11410

Handle GitHub Actions PR creation permission errors with auto-filed issues #11410

Conversation

Copilot AI commented Jan 22, 2026 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Plan: Add error handling for "GitHub actions is not permitted to create or approve pull requests"

Changes Completed

Files Modified

Implementation Details

Note on setup.sh

Changeset

Uh oh!

pelikhan commented Jan 23, 2026

Uh oh!

Copilot AI commented Jan 23, 2026

Uh oh!

pelikhan commented Jan 23, 2026

Uh oh!

Copilot AI commented Jan 23, 2026

Uh oh!

github-actions bot commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 23, 2026

Uh oh!

github-actions bot commented Jan 23, 2026 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 23, 2026

Uh oh!

github-actions bot commented Jan 23, 2026

Uh oh!

github-actions bot commented Jan 23, 2026

Smoke Test: Copilot - PASS ✅

Uh oh!

github-actions bot commented Jan 23, 2026

Uh oh!

github-actions bot commented Jan 23, 2026

Smoke Test Results - Claude Engine

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Jan 22, 2026 •

edited by agentic-workflows-dev bot

Loading

github-actions bot commented Jan 23, 2026 •

edited

Loading

github-actions bot commented Jan 23, 2026 •

edited

Loading

github-actions bot commented Jan 23, 2026 •

edited by agentic-workflows-dev bot

Loading