Add experimental gated merge-pull-request safe-output with policy-driven merge enforcement#27193
Open
Add experimental gated merge-pull-request safe-output with policy-driven merge enforcement#27193
merge-pull-request safe-output with policy-driven merge enforcement#27193Conversation
…ding Agent-Logs-Url: https://github.com/github/gh-aw/sessions/31a07f1a-cfce-42d7-9fb2-5db24724d231 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/31a07f1a-cfce-42d7-9fb2-5db24724d231 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot created this pull request from a session on behalf of
pelikhan
April 19, 2026 13:44
View session
pelikhan
reviewed
Apr 19, 2026
| */ | ||
| async function getPullRequestWithMergeability(githubClient, owner, repo, pullNumber) { | ||
| let pr = null; | ||
| for (let i = 0; i < 3; i++) { |
Contributor
Author
There was a problem hiding this comment.
Updated in 355be65: switched mergeability retrieval to withRetry(...) with an explicit mergeability-pending retry condition and improved fallback error chaining.
Collaborator
|
@copilot must enforce that the base branch is not a protected branch or the default branch |
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/2b89cfe4-e6fd-4edf-ac73-d8ad50a84640 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/2b89cfe4-e6fd-4edf-ac73-d8ad50a84640 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Implemented in 355be65: added extensive logging throughout Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Collaborator
|
@copilot use withRetry for every graphql call |
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/b1124194-bc78-4fea-a403-2bc920b62c05 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/b1124194-bc78-4fea-a403-2bc920b62c05 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Implemented in a194986: Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Collaborator
|
@copilot use w3c-spec-writer to update safe-outputs specification |
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/88afb2b1-7be3-42a1-be22-0271d7ec255e Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Implemented in d4e226e: all GraphQL calls in Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/32fbbe57-499c-444c-8898-4a778723de9f Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Implemented in d9ccab5: updated the W3C-style safe-outputs specification with a new Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Collaborator
|
@copilot add tests to enforce spec |
Contributor
Author
Implemented in 47b7e59: updated the safe-outputs specification to explicitly state merge_pull_request refuses merges to the repository default branch, and added tests enforcing that requirement (spec enforcement plus runtime default-branch detection coverage). No UI changes (no screenshot applicable).
Implemented in 47b7e59 and 7f6709d: merge_pull_request now handles temporary IDs for pull_request_number via resolved temporary-id mappings, including validation/error handling, and includes dedicated unit tests for resolved and unresolved temporary IDs. No UI changes (no screenshot applicable). Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
This was referenced Apr 19, 2026
This comment has been minimized.
This comment has been minimized.
Collaborator
|
Merge main and recompile. And add @copilot. |
…l-request-safe-output Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/b234fb4f-e045-4207-b31f-b67ab0d8b247 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
@copilot completed in 902c7c3 and ea2daf4: merged Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
This comment has been minimized.
This comment has been minimized.
1 similar comment
Contributor
|
Hey One item flagged during automated contribution check:
If you'd like a hand verifying and documenting the license, you can assign this prompt to your coding agent: Warning The following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "pypi.org"See Network Configuration for more information.
|
Collaborator
|
@copilot merge main, mark as experimental, recompile |
…l-request-safe-output Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/c4404723-239f-49a4-a2b5-227c03e4fd68 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
@copilot completed in fbb8f81 and 0a80997: merged Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Copilot
AI
changed the title
Add gated
Add experimental gated Apr 20, 2026
merge-pull-request safe-output with policy-driven merge enforcementmerge-pull-request safe-output with policy-driven merge enforcement
Contributor
|
✅ Smoke CI completed successfully! |
Contributor
Collaborator
|
@copilot review all comments, make sure import agentic workflow can contribute this safe output |
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/5bd8b7a6-57df-4bf1-9507-8b8f9014f4c3 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
@copilot completed in 411dbff: reviewed all comments and fixed import merging so imported agentic workflows can contribute Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR introduces a new
safe-outputs.merge-pull-requestcapability that only merges PRs when repository, review, CI, branch, label, and file-scope gates pass. It extends the existing safe-output model (compiler + runtime) without introducing a separate execution path.Frontmatter + compiler integration
merge-pull-requesttoSafeOutputsConfigand extraction flow.required-labelsallowed-labelsallowed-branchesallowed-filesprotected-filesrequired-labelsandallowed-labels.Schema + tool contract updates
main_workflow_schema.jsonto supportsafe-outputs.merge-pull-request.merge_pull_requesttool schema to both safe-output tool catalogs:actions/setup/js/safe_outputs_tools.jsonpkg/workflow/js/safe_outputs_tools.jsonmerge_pull_requestpayload fields.allowed-labelssemantics in schema/docs to exact label names (not glob patterns).pull_request_numbersupport for temporary-ID based resolution in merge flow semantics.Runtime handler + gating logic
actions/setup/js/merge_pull_request.cjsand registered it in the safe-output handler manager.allowed-files/protected-filesfile gating (protected match blocks)withRetry(...)withRetry(...)allowed-labelsuses exact label matching (no glob matching).pull_request_numberusing resolved safe-output temporary-ID mappings, with explicit unresolved-ID error paths.Experimental status
merge-pull-requestas experimental (compiler warning + docs updates).Import compatibility fix
safe-outputs.merge-pull-request.