Fix missing safe outputs in GITHUB_AW_SAFE_OUTPUTS_CONFIG

[Copilot]

The GITHUB_AW_SAFE_OUTPUTS_CONFIG environment variable was missing several safe output types, causing validation failures during workflow execution. The generateOutputCollectionStep function in pkg/workflow/compiler.go only included a subset of the available safe output types.

Problem

When workflows used create-discussion, create-pull-request-review-comment, or create-security-report safe outputs, the GITHUB_AW_SAFE_OUTPUTS_CONFIG environment variable didn't include these configurations. This caused the output collection step to reject valid output items with "Unexpected output type" errors.

Solution

Added the missing safe output configurations to the generateOutputCollectionStep function:

• create-discussion: Includes enabled: true and respects the max configuration from frontmatter
• create-pull-request-review-comment: Includes enabled: true and respects the max configuration from frontmatter
• create-security-report: Includes enabled: true and respects the max configuration from frontmatter

Before vs After

Before: A workflow with create-discussion would generate:

GITHUB_AW_SAFE_OUTPUTS_CONFIG: "{\"create-issue\":{\"enabled\":true}}"

After: The same workflow now generates:

GITHUB_AW_SAFE_OUTPUTS_CONFIG: "{\"create-discussion\":{\"enabled\":true,\"max\":2}}"

Testing

• Added comprehensive tests in TestSafeOutputsConfigGeneration to validate configuration generation
• Verified manual workflow compilation produces correct environment variables
• All existing tests continue to pass
• Validated with workflows containing multiple safe output types

The fix ensures that all safe output types defined in the SafeOutputsConfig struct are properly handled in the validation configuration, preventing runtime validation errors.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• api.contoso.com
  • Triggering command: /tmp/go-build1567927563/b278/cli.test -test.testlogfile=/tmp/go-build1567927563/b278/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
  • Triggering command: /tmp/go-build2757072128/b278/cli.test -test.testlogfile=/tmp/go-build2757072128/b278/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
  • Triggering command: /tmp/go-build2165124624/b278/cli.test -test.testlogfile=/tmp/go-build2165124624/b278/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.