From 3f70f3707a9c2e12d443bbf4aebbc4c83aeb833d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 24 Aug 2026 18:58:46 +0000
Subject: [PATCH 01/14] Initial plan
From 1dff1e50a2001b5b33ebc20167553da51b032e0b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 24 Aug 2026 19:10:58 +0000
Subject: [PATCH 02/14] Validate pre-created PR branch before checkout
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
.github/workflows/q.lock.yml | 34 ++++++++++++++++--
.../compiler_precreate_pull_request.go | 36 ++++++++++++++++++-
...precreate_pull_request_integration_test.go | 7 ++--
.../compiler_precreate_pull_request_test.go | 8 +++--
pkg/workflow/compiler_safe_outputs_steps.go | 2 +-
pkg/workflow/compiler_yaml_checkout.go | 2 +-
6 files changed, 78 insertions(+), 11 deletions(-)
diff --git a/.github/workflows/q.lock.yml b/.github/workflows/q.lock.yml
index 318e64b91bb..346f26cfbf6 100644
--- a/.github/workflows/q.lock.yml
+++ b/.github/workflows/q.lock.yml
@@ -130,7 +130,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -308,6 +308,34 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = `gh-aw/pre-created/${context.runId}-${process.env.GITHUB_RUN_ATTEMPT || "1"}`;
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -579,7 +607,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Setup Go for CLI build
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
@@ -2139,7 +2167,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/pkg/workflow/compiler_precreate_pull_request.go b/pkg/workflow/compiler_precreate_pull_request.go
index aa9f98e43b2..8a4c8c8db54 100644
--- a/pkg/workflow/compiler_precreate_pull_request.go
+++ b/pkg/workflow/compiler_precreate_pull_request.go
@@ -4,6 +4,10 @@ import "fmt"
const preCreatePullRequestAppTokenStepID = "pre-create-pull-request-app-token"
+func preCreatedPullRequestBranchRef() string {
+ return "gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}"
+}
+
func isPreCreatePullRequestEnabled(data *WorkflowData) bool {
if data == nil || data.SafeOutputs == nil || data.SafeOutputs.CreatePullRequests == nil || !isPreCreatePullRequestConfigured(data.SafeOutputs.CreatePullRequests) {
return false
@@ -94,9 +98,39 @@ func (c *Compiler) addActivationPreCreatePullRequestStep(ctx *activationJobBuild
" script: |\n",
generateGitHubScriptWithRequire("pre_create_pull_request.cjs"),
)
+ ctx.steps = append(ctx.steps,
+ " - name: Validate pre-created pull request branch\n",
+ " id: validate-pre-created-pull-request\n",
+ fmt.Sprintf(" uses: %s\n", getCachedActionPin("actions/github-script", ctx.data)),
+ " env:\n",
+ " GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}\n",
+ " GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}\n",
+ " with:\n",
+ fmt.Sprintf(" github-token: %s\n", token),
+ " script: |\n",
+ " const expectedBranch = `gh-aw/pre-created/${context.runId}-${process.env.GITHUB_RUN_ATTEMPT || \"1\"}`;\n",
+ " const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || \"\";\n",
+ " if (branch !== expectedBranch) {\n",
+ " throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);\n",
+ " }\n",
+ " const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || \"\", 10);\n",
+ " if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {\n",
+ " throw new Error(\"Pre-created pull request number is invalid\");\n",
+ " }\n",
+ " const { data: pullRequest } = await github.rest.pulls.get({\n",
+ " owner: context.repo.owner,\n",
+ " repo: context.repo.repo,\n",
+ " pull_number: pullNumber,\n",
+ " });\n",
+ " const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();\n",
+ " if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {\n",
+ " throw new Error(\"Pre-created pull request does not target the expected trusted repository branch\");\n",
+ " }\n",
+ " core.setOutput(\"branch\", expectedBranch);\n",
+ )
ctx.outputs["pre_created_pull_request_number"] = "${{ steps.pre-create-pull-request.outputs.pull_request_number }}"
ctx.outputs["pre_created_pull_request_url"] = "${{ steps.pre-create-pull-request.outputs.pull_request_url }}"
- ctx.outputs["pre_created_pull_request_branch"] = "${{ steps.pre-create-pull-request.outputs.branch }}"
+ ctx.outputs["pre_created_pull_request_branch"] = "${{ steps.validate-pre-created-pull-request.outputs.branch }}"
ctx.outputs["pre_created_pull_request_check_run_id"] = "${{ steps.pre-create-pull-request.outputs.check_run_id }}"
}
diff --git a/pkg/workflow/compiler_precreate_pull_request_integration_test.go b/pkg/workflow/compiler_precreate_pull_request_integration_test.go
index cfd3627a203..a88af576c0b 100644
--- a/pkg/workflow/compiler_precreate_pull_request_integration_test.go
+++ b/pkg/workflow/compiler_precreate_pull_request_integration_test.go
@@ -47,11 +47,14 @@ Create a change and open a pull request.
conclusion := extractJobSection(yaml, "conclusion")
assert.Contains(t, activation, "id: pre-create-pull-request")
+ assert.Contains(t, activation, "id: validate-pre-created-pull-request")
assert.Contains(t, activation, "contents: write")
assert.Contains(t, activation, "pull-requests: write")
assert.Contains(t, activation, "checks: write")
- assert.Contains(t, agent, "ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}")
- assert.Contains(t, safeOutputs, "ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}")
+ assert.Contains(t, agent, "ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}")
+ assert.Contains(t, safeOutputs, "ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}")
+ assert.NotContains(t, agent, "ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}")
+ assert.NotContains(t, safeOutputs, "ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}")
assert.Contains(t, safeOutputs, "pre_created_pull_request_number")
assert.Contains(t, conclusion, "complete_pre_created_check_run.cjs")
assert.Contains(t, conclusion, "GH_AW_SAFE_OUTPUT_CREATED_PR_NUMBER")
diff --git a/pkg/workflow/compiler_precreate_pull_request_test.go b/pkg/workflow/compiler_precreate_pull_request_test.go
index db14b0cf832..f0ae585ab66 100644
--- a/pkg/workflow/compiler_precreate_pull_request_test.go
+++ b/pkg/workflow/compiler_precreate_pull_request_test.go
@@ -28,10 +28,12 @@ func TestBuildActivationJobPreCreatesPullRequest(t *testing.T) {
assert.NotContains(t, steps, "name: Checkout repository")
assert.Contains(t, steps, "id: pre-create-pull-request")
assert.Contains(t, steps, "pre_create_pull_request.cjs")
+ assert.Contains(t, steps, "id: validate-pre-created-pull-request")
+ assert.Contains(t, steps, "Pre-created pull request does not target the expected trusted repository branch")
assert.Contains(t, job.Permissions, "contents: write")
assert.Contains(t, job.Permissions, "pull-requests: write")
assert.Contains(t, job.Permissions, "checks: write")
- assert.Equal(t, "${{ steps.pre-create-pull-request.outputs.branch }}", job.Outputs["pre_created_pull_request_branch"])
+ assert.Equal(t, "${{ steps.validate-pre-created-pull-request.outputs.branch }}", job.Outputs["pre_created_pull_request_branch"])
}
func TestBuildConclusionJobCompletesPreCreatedCheck(t *testing.T) {
@@ -76,13 +78,13 @@ func TestBuildConclusionJobPassesNoOpCommentToPreCreatedCheck(t *testing.T) {
func TestPreCreatePullRequestCheckoutOverride(t *testing.T) {
manager := NewCheckoutManager(nil)
- manager.SetDefaultRefOverride("${{ needs.activation.outputs.pre_created_pull_request_branch }}")
+ manager.SetDefaultRefOverride(preCreatedPullRequestBranchRef())
steps := strings.Join(manager.GenerateDefaultCheckoutStep(false, "", func(action string) string {
return action + "@sha"
}), "")
- assert.Contains(t, steps, "ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}")
+ assert.Contains(t, steps, "ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}")
}
func TestValidatePreCreatePullRequest(t *testing.T) {
diff --git a/pkg/workflow/compiler_safe_outputs_steps.go b/pkg/workflow/compiler_safe_outputs_steps.go
index bca6e554c7d..3839fc7941e 100644
--- a/pkg/workflow/compiler_safe_outputs_steps.go
+++ b/pkg/workflow/compiler_safe_outputs_steps.go
@@ -35,7 +35,7 @@ func (c *Compiler) buildSharedPRCheckoutSteps(data *WorkflowData) []string {
// Build the same CheckoutManager the agent job builds from the workflow's checkout: config.
checkoutMgr := NewCheckoutManager(data.CheckoutConfigs)
if isPreCreatePullRequestEnabled(data) {
- checkoutMgr.SetDefaultRefOverride("${{ needs.activation.outputs.pre_created_pull_request_branch }}")
+ checkoutMgr.SetDefaultRefOverride(preCreatedPullRequestBranchRef())
}
// Unlike the agent job, the safe_outputs job performs git fetch/push against the
diff --git a/pkg/workflow/compiler_yaml_checkout.go b/pkg/workflow/compiler_yaml_checkout.go
index b93436be0c1..6a2f83ee002 100644
--- a/pkg/workflow/compiler_yaml_checkout.go
+++ b/pkg/workflow/compiler_yaml_checkout.go
@@ -39,7 +39,7 @@ func (c *Compiler) generateInitialAndCheckoutSteps(yaml *strings.Builder, data *
// Build a CheckoutManager with any user-configured checkouts
checkoutMgr := NewCheckoutManager(data.CheckoutConfigs)
if isPreCreatePullRequestEnabled(data) {
- checkoutMgr.SetDefaultRefOverride("${{ needs.activation.outputs.pre_created_pull_request_branch }}")
+ checkoutMgr.SetDefaultRefOverride(preCreatedPullRequestBranchRef())
}
// Propagate the platform (host) repo resolved by the activation job so that
From d54f2665ca00f598eebe51c40a6c2a6861f570d7 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 24 Aug 2026 19:14:42 +0000
Subject: [PATCH 03/14] Fix pre-created PR validation script generation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
.github/workflows/q.lock.yml | 3 ++-
pkg/workflow/compiler_precreate_pull_request.go | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/.github/workflows/q.lock.yml b/.github/workflows/q.lock.yml
index 346f26cfbf6..57e1a4917e5 100644
--- a/.github/workflows/q.lock.yml
+++ b/.github/workflows/q.lock.yml
@@ -314,10 +314,11 @@ jobs:
env:
GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = `gh-aw/pre-created/${context.runId}-${process.env.GITHUB_RUN_ATTEMPT || "1"}`;
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
if (branch !== expectedBranch) {
throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
diff --git a/pkg/workflow/compiler_precreate_pull_request.go b/pkg/workflow/compiler_precreate_pull_request.go
index 8a4c8c8db54..9931b3b5b5e 100644
--- a/pkg/workflow/compiler_precreate_pull_request.go
+++ b/pkg/workflow/compiler_precreate_pull_request.go
@@ -105,10 +105,11 @@ func (c *Compiler) addActivationPreCreatePullRequestStep(ctx *activationJobBuild
" env:\n",
" GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}\n",
" GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}\n",
+ fmt.Sprintf(" GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: %s\n", preCreatedPullRequestBranchRef()),
" with:\n",
fmt.Sprintf(" github-token: %s\n", token),
" script: |\n",
- " const expectedBranch = `gh-aw/pre-created/${context.runId}-${process.env.GITHUB_RUN_ATTEMPT || \"1\"}`;\n",
+ " const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || \"\";\n",
" const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || \"\";\n",
" if (branch !== expectedBranch) {\n",
" throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);\n",
From 0958c1490c3f8b51c80dd28ea1b05968d73801eb Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 24 Aug 2026 20:12:49 +0000
Subject: [PATCH 04/14] Plan refactor precreate validation javascript
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
.github/workflows/avenger.lock.yml | 35 +++++++++++++++++--
.github/workflows/ci-coach.lock.yml | 35 +++++++++++++++++--
.github/workflows/cloclo.lock.yml | 35 +++++++++++++++++--
.../workflows/code-scanning-fixer.lock.yml | 35 +++++++++++++++++--
.github/workflows/code-simplifier.lock.yml | 35 +++++++++++++++++--
...aily-agent-of-the-day-blog-writer.lock.yml | 35 +++++++++++++++++--
.../daily-architecture-diagram.lock.yml | 35 +++++++++++++++++--
...strostylelite-markdown-spellcheck.lock.yml | 35 +++++++++++++++++--
.../daily-caveman-optimizer.lock.yml | 35 +++++++++++++++++--
.../workflows/daily-code-debt-aider.lock.yml | 35 +++++++++++++++++--
.../daily-community-attribution.lock.yml | 35 +++++++++++++++++--
...ly-compiler-threat-spec-optimizer.lock.yml | 35 +++++++++++++++++--
.github/workflows/daily-doc-healer.lock.yml | 35 +++++++++++++++++--
.github/workflows/daily-doc-updater.lock.yml | 35 +++++++++++++++++--
.../daily-documentation-diagram.lock.yml | 35 +++++++++++++++++--
.../daily-elixir-credo-snippet-audit.lock.yml | 35 +++++++++++++++++--
.../daily-go-test-parallelizer.lock.yml | 35 +++++++++++++++++--
.../daily-go-test-stubs-aider.lock.yml | 35 +++++++++++++++++--
.../daily-rendering-scripts-verifier.lock.yml | 35 +++++++++++++++++--
.../daily-safe-output-integrator.lock.yml | 35 +++++++++++++++++--
.../daily-safeoutputs-git-simulator.lock.yml | 35 +++++++++++++++++--
...ily-trajectory-grader-implementer.lock.yml | 35 +++++++++++++++++--
.../workflows/daily-workflow-updater.lock.yml | 35 +++++++++++++++++--
.../workflows/daily-yamllint-fixer.lock.yml | 35 +++++++++++++++++--
.github/workflows/dead-code-remover.lock.yml | 35 +++++++++++++++++--
.github/workflows/dependabot-burner.lock.yml | 35 +++++++++++++++++--
.../developer-docs-consolidator.lock.yml | 35 +++++++++++++++++--
.github/workflows/dictation-prompt.lock.yml | 35 +++++++++++++++++--
.github/workflows/eslint-miner.lock.yml | 35 +++++++++++++++++--
.github/workflows/evoskill-evolver.lock.yml | 35 +++++++++++++++++--
.../workflows/functional-pragmatist.lock.yml | 35 +++++++++++++++++--
.../github-mcp-tools-report.lock.yml | 35 +++++++++++++++++--
.../workflows/glossary-maintainer.lock.yml | 35 +++++++++++++++++--
.github/workflows/go-logger.lock.yml | 35 +++++++++++++++++--
.github/workflows/hourly-ci-cleaner.lock.yml | 35 +++++++++++++++++--
.../workflows/instructions-janitor.lock.yml | 35 +++++++++++++++++--
.../workflows/layout-spec-maintainer.lock.yml | 35 +++++++++++++++++--
.github/workflows/linter-miner.lock.yml | 35 +++++++++++++++++--
.github/workflows/purelock.lock.yml | 35 +++++++++++++++++--
.github/workflows/refiner.lock.yml | 35 +++++++++++++++++--
.github/workflows/ruflo-backed-task.lock.yml | 35 +++++++++++++++++--
.../workflows/slide-deck-maintainer.lock.yml | 35 +++++++++++++++++--
.github/workflows/smoke-project.lock.yml | 35 +++++++++++++++++--
.github/workflows/spec-enforcer.lock.yml | 35 +++++++++++++++++--
.github/workflows/spec-extractor.lock.yml | 35 +++++++++++++++++--
.../workflows/technical-doc-writer.lock.yml | 35 +++++++++++++++++--
.github/workflows/tidy.lock.yml | 35 +++++++++++++++++--
.../workflows/ubuntu-image-analyzer.lock.yml | 35 +++++++++++++++++--
.github/workflows/unbloat-docs.lock.yml | 33 +++++++++++++++--
.github/workflows/update-astro.lock.yml | 35 +++++++++++++++++--
.../weekly-blog-post-writer.lock.yml | 35 +++++++++++++++++--
.../weekly-editors-health-check.lock.yml | 35 +++++++++++++++++--
.../weekly-safe-outputs-spec-review.lock.yml | 35 +++++++++++++++++--
53 files changed, 1695 insertions(+), 158 deletions(-)
diff --git a/.github/workflows/avenger.lock.yml b/.github/workflows/avenger.lock.yml
index efd50ed491f..9f368a008ca 100644
--- a/.github/workflows/avenger.lock.yml
+++ b/.github/workflows/avenger.lock.yml
@@ -119,7 +119,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -277,6 +277,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -506,7 +535,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Setup Node.js
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
@@ -2287,7 +2316,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/ci-coach.lock.yml b/.github/workflows/ci-coach.lock.yml
index 2b7db916679..f4c625dc12f 100644
--- a/.github/workflows/ci-coach.lock.yml
+++ b/.github/workflows/ci-coach.lock.yml
@@ -114,7 +114,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -266,6 +266,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -541,7 +570,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Setup Node.js
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
@@ -2388,7 +2417,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/cloclo.lock.yml b/.github/workflows/cloclo.lock.yml
index 4918f998cbd..e7d3a84adcf 100644
--- a/.github/workflows/cloclo.lock.yml
+++ b/.github/workflows/cloclo.lock.yml
@@ -126,7 +126,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -305,6 +305,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -614,7 +643,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Setup Go for CLI build
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
@@ -2639,7 +2668,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/code-scanning-fixer.lock.yml b/.github/workflows/code-scanning-fixer.lock.yml
index 5de16979334..41c075ce943 100644
--- a/.github/workflows/code-scanning-fixer.lock.yml
+++ b/.github/workflows/code-scanning-fixer.lock.yml
@@ -116,7 +116,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -270,6 +270,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -499,7 +528,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -2377,7 +2406,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/code-simplifier.lock.yml b/.github/workflows/code-simplifier.lock.yml
index 41ad4fa625b..d11b02ed021 100644
--- a/.github/workflows/code-simplifier.lock.yml
+++ b/.github/workflows/code-simplifier.lock.yml
@@ -117,7 +117,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -276,6 +276,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -494,7 +523,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Setup Java
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
with:
@@ -2254,7 +2283,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml b/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml
index 5df93254f97..e2c42904c88 100644
--- a/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml
+++ b/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml
@@ -120,7 +120,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -287,6 +287,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -520,7 +549,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Setup Go for CLI build
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
@@ -2537,7 +2566,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/daily-architecture-diagram.lock.yml b/.github/workflows/daily-architecture-diagram.lock.yml
index 89b593b4d6e..98b6719e912 100644
--- a/.github/workflows/daily-architecture-diagram.lock.yml
+++ b/.github/workflows/daily-architecture-diagram.lock.yml
@@ -112,7 +112,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -264,6 +264,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -530,7 +559,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -2506,7 +2535,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml b/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml
index 06bdbdc9453..5faff0ade6f 100644
--- a/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml
+++ b/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml
@@ -110,7 +110,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -269,6 +269,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -526,7 +555,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -2340,7 +2369,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/daily-caveman-optimizer.lock.yml b/.github/workflows/daily-caveman-optimizer.lock.yml
index 462db532f40..4256abb08d7 100644
--- a/.github/workflows/daily-caveman-optimizer.lock.yml
+++ b/.github/workflows/daily-caveman-optimizer.lock.yml
@@ -115,7 +115,7 @@ jobs:
model: ${{ steps.generate_aw_info.outputs.model }}
model_size: ${{ steps.pick-experiment.outputs.model_size }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -281,6 +281,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -546,7 +575,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -2414,7 +2443,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/daily-code-debt-aider.lock.yml b/.github/workflows/daily-code-debt-aider.lock.yml
index 459b520e10b..5864e87c4c5 100644
--- a/.github/workflows/daily-code-debt-aider.lock.yml
+++ b/.github/workflows/daily-code-debt-aider.lock.yml
@@ -111,7 +111,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -262,6 +262,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -468,7 +497,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Setup Python
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
@@ -1748,7 +1777,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/daily-community-attribution.lock.yml b/.github/workflows/daily-community-attribution.lock.yml
index 3b6ead6e386..febae716f9e 100644
--- a/.github/workflows/daily-community-attribution.lock.yml
+++ b/.github/workflows/daily-community-attribution.lock.yml
@@ -115,7 +115,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -281,6 +281,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -552,7 +581,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -2574,7 +2603,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml b/.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml
index 1a60a900abc..3215db9194e 100644
--- a/.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml
+++ b/.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml
@@ -115,7 +115,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -280,6 +280,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -496,7 +525,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -2280,7 +2309,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/daily-doc-healer.lock.yml b/.github/workflows/daily-doc-healer.lock.yml
index 889b6d1a72f..0e51e15053c 100644
--- a/.github/workflows/daily-doc-healer.lock.yml
+++ b/.github/workflows/daily-doc-healer.lock.yml
@@ -119,7 +119,7 @@ jobs:
model: ${{ steps.generate_aw_info.outputs.model }}
model_size: ${{ steps.pick-experiment.outputs.model_size }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -285,6 +285,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -552,7 +581,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -2525,7 +2554,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/daily-doc-updater.lock.yml b/.github/workflows/daily-doc-updater.lock.yml
index f0f4542676d..6e5ceeb0350 100644
--- a/.github/workflows/daily-doc-updater.lock.yml
+++ b/.github/workflows/daily-doc-updater.lock.yml
@@ -116,7 +116,7 @@ jobs:
model: ${{ steps.generate_aw_info.outputs.model }}
model_size: ${{ steps.pick-experiment.outputs.model_size }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -282,6 +282,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -540,7 +569,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -2306,7 +2335,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/daily-documentation-diagram.lock.yml b/.github/workflows/daily-documentation-diagram.lock.yml
index c8074f43815..f3bd2fe64f0 100644
--- a/.github/workflows/daily-documentation-diagram.lock.yml
+++ b/.github/workflows/daily-documentation-diagram.lock.yml
@@ -91,7 +91,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -242,6 +242,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -490,7 +519,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -2200,7 +2229,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/daily-elixir-credo-snippet-audit.lock.yml b/.github/workflows/daily-elixir-credo-snippet-audit.lock.yml
index c2a72ae64f0..872fdd567f0 100644
--- a/.github/workflows/daily-elixir-credo-snippet-audit.lock.yml
+++ b/.github/workflows/daily-elixir-credo-snippet-audit.lock.yml
@@ -104,7 +104,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -267,6 +267,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -482,7 +511,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Setup Elixir
# zizmor: ignore[github_action_from_unverified_creator_used]
uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
@@ -2203,7 +2232,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/daily-go-test-parallelizer.lock.yml b/.github/workflows/daily-go-test-parallelizer.lock.yml
index 614ada66b3c..0a7e2b5364c 100644
--- a/.github/workflows/daily-go-test-parallelizer.lock.yml
+++ b/.github/workflows/daily-go-test-parallelizer.lock.yml
@@ -99,7 +99,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -257,6 +257,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -477,7 +506,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -2251,7 +2280,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/daily-go-test-stubs-aider.lock.yml b/.github/workflows/daily-go-test-stubs-aider.lock.yml
index 9006df4b6d5..984da6e8b54 100644
--- a/.github/workflows/daily-go-test-stubs-aider.lock.yml
+++ b/.github/workflows/daily-go-test-stubs-aider.lock.yml
@@ -111,7 +111,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -262,6 +262,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -468,7 +497,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Setup Python
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
@@ -1748,7 +1777,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/daily-rendering-scripts-verifier.lock.yml b/.github/workflows/daily-rendering-scripts-verifier.lock.yml
index dc866e8bb71..f9fb259d1c8 100644
--- a/.github/workflows/daily-rendering-scripts-verifier.lock.yml
+++ b/.github/workflows/daily-rendering-scripts-verifier.lock.yml
@@ -122,7 +122,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -283,6 +283,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -512,7 +541,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Setup Go for CLI build
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
@@ -2119,7 +2148,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/daily-safe-output-integrator.lock.yml b/.github/workflows/daily-safe-output-integrator.lock.yml
index d2062e84db1..a13a4c8112b 100644
--- a/.github/workflows/daily-safe-output-integrator.lock.yml
+++ b/.github/workflows/daily-safe-output-integrator.lock.yml
@@ -111,7 +111,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -262,6 +262,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -479,7 +508,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -2204,7 +2233,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/daily-safeoutputs-git-simulator.lock.yml b/.github/workflows/daily-safeoutputs-git-simulator.lock.yml
index a4f5ddf28f6..6be2d94ea4e 100644
--- a/.github/workflows/daily-safeoutputs-git-simulator.lock.yml
+++ b/.github/workflows/daily-safeoutputs-git-simulator.lock.yml
@@ -94,7 +94,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -250,6 +250,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -476,7 +505,7 @@ jobs:
with:
persist-credentials: false
fetch-depth: 0
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Fetch additional refs
env:
GH_AW_FETCH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
@@ -2358,7 +2387,7 @@ jobs:
with:
persist-credentials: true
fetch-depth: 0
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Fetch additional refs
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') || (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'push_to_pull_request_branch')
diff --git a/.github/workflows/daily-trajectory-grader-implementer.lock.yml b/.github/workflows/daily-trajectory-grader-implementer.lock.yml
index ff5d245eced..238a40703a0 100644
--- a/.github/workflows/daily-trajectory-grader-implementer.lock.yml
+++ b/.github/workflows/daily-trajectory-grader-implementer.lock.yml
@@ -98,7 +98,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -256,6 +256,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -470,7 +499,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -1915,7 +1944,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/daily-workflow-updater.lock.yml b/.github/workflows/daily-workflow-updater.lock.yml
index d17764da99a..674f866ad1f 100644
--- a/.github/workflows/daily-workflow-updater.lock.yml
+++ b/.github/workflows/daily-workflow-updater.lock.yml
@@ -108,7 +108,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -259,6 +259,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -473,7 +502,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -2166,7 +2195,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/daily-yamllint-fixer.lock.yml b/.github/workflows/daily-yamllint-fixer.lock.yml
index ac387553fae..1a270fed0d3 100644
--- a/.github/workflows/daily-yamllint-fixer.lock.yml
+++ b/.github/workflows/daily-yamllint-fixer.lock.yml
@@ -113,7 +113,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -273,6 +273,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -492,7 +521,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -2260,7 +2289,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/dead-code-remover.lock.yml b/.github/workflows/dead-code-remover.lock.yml
index 1a490ecec88..be7e5cfe589 100644
--- a/.github/workflows/dead-code-remover.lock.yml
+++ b/.github/workflows/dead-code-remover.lock.yml
@@ -114,7 +114,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -267,6 +267,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -499,7 +528,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Setup Go
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
@@ -1950,7 +1979,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/dependabot-burner.lock.yml b/.github/workflows/dependabot-burner.lock.yml
index d2dae3912ba..e39c8c3c1b4 100644
--- a/.github/workflows/dependabot-burner.lock.yml
+++ b/.github/workflows/dependabot-burner.lock.yml
@@ -130,7 +130,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -308,6 +308,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -559,7 +588,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -2412,7 +2441,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/developer-docs-consolidator.lock.yml b/.github/workflows/developer-docs-consolidator.lock.yml
index abf4fc5c031..2ffd325cecb 100644
--- a/.github/workflows/developer-docs-consolidator.lock.yml
+++ b/.github/workflows/developer-docs-consolidator.lock.yml
@@ -117,7 +117,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -275,6 +275,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -514,7 +543,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -2490,7 +2519,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/dictation-prompt.lock.yml b/.github/workflows/dictation-prompt.lock.yml
index 1af10faa3ae..6086674a54e 100644
--- a/.github/workflows/dictation-prompt.lock.yml
+++ b/.github/workflows/dictation-prompt.lock.yml
@@ -109,7 +109,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -259,6 +259,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -474,7 +503,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -2160,7 +2189,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/eslint-miner.lock.yml b/.github/workflows/eslint-miner.lock.yml
index b2a0a74a15d..dc820eb73d0 100644
--- a/.github/workflows/eslint-miner.lock.yml
+++ b/.github/workflows/eslint-miner.lock.yml
@@ -96,7 +96,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -244,6 +244,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -466,7 +495,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Setup Node.js
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
@@ -2186,7 +2215,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/evoskill-evolver.lock.yml b/.github/workflows/evoskill-evolver.lock.yml
index caf2d7e412b..f5a805a898c 100644
--- a/.github/workflows/evoskill-evolver.lock.yml
+++ b/.github/workflows/evoskill-evolver.lock.yml
@@ -96,7 +96,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -245,6 +245,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -466,7 +495,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -2196,7 +2225,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/functional-pragmatist.lock.yml b/.github/workflows/functional-pragmatist.lock.yml
index 4a7e14b3699..aed6ba79a4d 100644
--- a/.github/workflows/functional-pragmatist.lock.yml
+++ b/.github/workflows/functional-pragmatist.lock.yml
@@ -109,7 +109,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -266,6 +266,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -482,7 +511,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -2166,7 +2195,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/github-mcp-tools-report.lock.yml b/.github/workflows/github-mcp-tools-report.lock.yml
index 06462dd5203..13b9916b027 100644
--- a/.github/workflows/github-mcp-tools-report.lock.yml
+++ b/.github/workflows/github-mcp-tools-report.lock.yml
@@ -111,7 +111,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -269,6 +269,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -495,7 +524,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -1944,7 +1973,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/glossary-maintainer.lock.yml b/.github/workflows/glossary-maintainer.lock.yml
index 45edd29e1c9..244c1aa3287 100644
--- a/.github/workflows/glossary-maintainer.lock.yml
+++ b/.github/workflows/glossary-maintainer.lock.yml
@@ -120,7 +120,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -285,6 +285,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -527,7 +556,7 @@ jobs:
with:
persist-credentials: false
fetch-depth: 0
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Merge remote .github folder
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
@@ -2458,7 +2487,7 @@ jobs:
with:
persist-credentials: true
fetch-depth: 0
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/go-logger.lock.yml b/.github/workflows/go-logger.lock.yml
index 48ecf799267..c2c1d39b643 100644
--- a/.github/workflows/go-logger.lock.yml
+++ b/.github/workflows/go-logger.lock.yml
@@ -116,7 +116,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -274,6 +274,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -496,7 +525,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Setup Node.js
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
@@ -2284,7 +2313,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/hourly-ci-cleaner.lock.yml b/.github/workflows/hourly-ci-cleaner.lock.yml
index 2df62c1d62c..005f7e53ee0 100644
--- a/.github/workflows/hourly-ci-cleaner.lock.yml
+++ b/.github/workflows/hourly-ci-cleaner.lock.yml
@@ -117,7 +117,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -274,6 +274,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -502,7 +531,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Merge remote .github folder
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
@@ -2294,7 +2323,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/instructions-janitor.lock.yml b/.github/workflows/instructions-janitor.lock.yml
index 2f7faf5a99a..876a28203c9 100644
--- a/.github/workflows/instructions-janitor.lock.yml
+++ b/.github/workflows/instructions-janitor.lock.yml
@@ -111,7 +111,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -269,6 +269,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -491,7 +520,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -1928,7 +1957,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/layout-spec-maintainer.lock.yml b/.github/workflows/layout-spec-maintainer.lock.yml
index 28c5b6b2011..8f17c4398ae 100644
--- a/.github/workflows/layout-spec-maintainer.lock.yml
+++ b/.github/workflows/layout-spec-maintainer.lock.yml
@@ -112,7 +112,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -269,6 +269,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -483,7 +512,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -1875,7 +1904,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/linter-miner.lock.yml b/.github/workflows/linter-miner.lock.yml
index c02d7104f7d..aafeb242e90 100644
--- a/.github/workflows/linter-miner.lock.yml
+++ b/.github/workflows/linter-miner.lock.yml
@@ -115,7 +115,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -272,6 +272,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -507,7 +536,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -1958,7 +1987,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/purelock.lock.yml b/.github/workflows/purelock.lock.yml
index d5809e6cc7d..5cd7139750f 100644
--- a/.github/workflows/purelock.lock.yml
+++ b/.github/workflows/purelock.lock.yml
@@ -117,7 +117,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -277,6 +277,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -507,7 +536,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -2499,7 +2528,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/refiner.lock.yml b/.github/workflows/refiner.lock.yml
index d32b0fa71e1..530c60cf178 100644
--- a/.github/workflows/refiner.lock.yml
+++ b/.github/workflows/refiner.lock.yml
@@ -131,7 +131,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -299,6 +299,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -538,7 +567,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -2459,7 +2488,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/ruflo-backed-task.lock.yml b/.github/workflows/ruflo-backed-task.lock.yml
index 4fae57830fb..d9d815ebd4a 100644
--- a/.github/workflows/ruflo-backed-task.lock.yml
+++ b/.github/workflows/ruflo-backed-task.lock.yml
@@ -103,7 +103,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -277,6 +277,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -531,7 +560,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Setup Node.js
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
@@ -2089,7 +2118,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/slide-deck-maintainer.lock.yml b/.github/workflows/slide-deck-maintainer.lock.yml
index c56e49dd4c3..d6ce4d13027 100644
--- a/.github/workflows/slide-deck-maintainer.lock.yml
+++ b/.github/workflows/slide-deck-maintainer.lock.yml
@@ -118,7 +118,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -278,6 +278,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -515,7 +544,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Setup Node.js
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
@@ -2043,7 +2072,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/smoke-project.lock.yml b/.github/workflows/smoke-project.lock.yml
index c1b3617451b..0072c267574 100644
--- a/.github/workflows/smoke-project.lock.yml
+++ b/.github/workflows/smoke-project.lock.yml
@@ -124,7 +124,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -303,6 +303,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -595,7 +624,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -2794,7 +2823,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/spec-enforcer.lock.yml b/.github/workflows/spec-enforcer.lock.yml
index b958a8c0b62..070f966c294 100644
--- a/.github/workflows/spec-enforcer.lock.yml
+++ b/.github/workflows/spec-enforcer.lock.yml
@@ -116,7 +116,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -274,6 +274,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -496,7 +525,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -2171,7 +2200,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/spec-extractor.lock.yml b/.github/workflows/spec-extractor.lock.yml
index 9ccfade9ae2..c69fe6f550f 100644
--- a/.github/workflows/spec-extractor.lock.yml
+++ b/.github/workflows/spec-extractor.lock.yml
@@ -113,7 +113,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -264,6 +264,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -493,7 +522,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -1952,7 +1981,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/technical-doc-writer.lock.yml b/.github/workflows/technical-doc-writer.lock.yml
index 06a2b6757f6..1ba2d71ef5d 100644
--- a/.github/workflows/technical-doc-writer.lock.yml
+++ b/.github/workflows/technical-doc-writer.lock.yml
@@ -115,7 +115,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -273,6 +273,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -512,7 +541,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Merge remote .github folder
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
@@ -2462,7 +2491,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/tidy.lock.yml b/.github/workflows/tidy.lock.yml
index 88a0bf29c48..d046e61d850 100644
--- a/.github/workflows/tidy.lock.yml
+++ b/.github/workflows/tidy.lock.yml
@@ -116,7 +116,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -293,6 +293,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -542,7 +571,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -2372,7 +2401,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') || (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'push_to_pull_request_branch')
diff --git a/.github/workflows/ubuntu-image-analyzer.lock.yml b/.github/workflows/ubuntu-image-analyzer.lock.yml
index 92aba39e263..00dd351a366 100644
--- a/.github/workflows/ubuntu-image-analyzer.lock.yml
+++ b/.github/workflows/ubuntu-image-analyzer.lock.yml
@@ -114,7 +114,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -273,6 +273,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -492,7 +521,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -1923,7 +1952,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/unbloat-docs.lock.yml b/.github/workflows/unbloat-docs.lock.yml
index 99f7e615b91..f76cfca83d5 100644
--- a/.github/workflows/unbloat-docs.lock.yml
+++ b/.github/workflows/unbloat-docs.lock.yml
@@ -118,7 +118,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -296,6 +296,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -2340,7 +2369,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/update-astro.lock.yml b/.github/workflows/update-astro.lock.yml
index 28110e90c12..d344094f82a 100644
--- a/.github/workflows/update-astro.lock.yml
+++ b/.github/workflows/update-astro.lock.yml
@@ -114,7 +114,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -273,6 +273,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -500,7 +529,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -1952,7 +1981,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/weekly-blog-post-writer.lock.yml b/.github/workflows/weekly-blog-post-writer.lock.yml
index 960f984fe4e..dd92c77173f 100644
--- a/.github/workflows/weekly-blog-post-writer.lock.yml
+++ b/.github/workflows/weekly-blog-post-writer.lock.yml
@@ -115,7 +115,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -273,6 +273,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -549,7 +578,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Setup Go for CLI build
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
@@ -2574,7 +2603,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/weekly-editors-health-check.lock.yml b/.github/workflows/weekly-editors-health-check.lock.yml
index f182846039b..0e8c9ce814b 100644
--- a/.github/workflows/weekly-editors-health-check.lock.yml
+++ b/.github/workflows/weekly-editors-health-check.lock.yml
@@ -107,7 +107,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -264,6 +264,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -480,7 +509,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -1891,7 +1920,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
index e7ea000ef25..5703872bc48 100644
--- a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
+++ b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
@@ -110,7 +110,7 @@ jobs:
lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
model: ${{ steps.generate_aw_info.outputs.model }}
oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
- pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }}
+ pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }}
pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }}
pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }}
@@ -267,6 +267,35 @@ jobs:
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs'));
await main();
+ - name: Validate pre-created pull request branch
+ id: validate-pre-created-pull-request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}
+ GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}
+ GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+ core.setOutput("branch", expectedBranch);
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -480,7 +509,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
- name: Create gh-aw temp directory
run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
- name: Configure gh CLI for GitHub Enterprise
@@ -1861,7 +1890,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
- ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
+ ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
From 7cb0b3f41841b7f3ba9b46564cd359ce36a3f059 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 24 Aug 2026 20:19:24 +0000
Subject: [PATCH 05/14] Refactor pre-created PR validation script
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
.github/workflows/q.lock.yml | 25 ++---
.../js/validate_pre_created_pull_request.cjs | 29 ++++++
...validate_pre_created_pull_request.test.cjs | 96 +++++++++++++++++++
.../compiler_precreate_pull_request.go | 20 +---
.../compiler_precreate_pull_request_test.go | 2 +-
5 files changed, 133 insertions(+), 39 deletions(-)
create mode 100644 actions/setup/js/validate_pre_created_pull_request.cjs
create mode 100644 actions/setup/js/validate_pre_created_pull_request.test.cjs
diff --git a/.github/workflows/q.lock.yml b/.github/workflows/q.lock.yml
index 57e1a4917e5..e449a15d26e 100644
--- a/.github/workflows/q.lock.yml
+++ b/.github/workflows/q.lock.yml
@@ -318,25 +318,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/actions/setup/js/validate_pre_created_pull_request.cjs b/actions/setup/js/validate_pre_created_pull_request.cjs
new file mode 100644
index 00000000000..12f5ffde1b3
--- /dev/null
+++ b/actions/setup/js/validate_pre_created_pull_request.cjs
@@ -0,0 +1,29 @@
+// @ts-check
+///
+
+async function main() {
+ const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (branch !== expectedBranch) {
+ throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
+ }
+
+ const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+ if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+
+ const { data: pullRequest } = await github.rest.pulls.get({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ });
+ const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+ if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
+ throw new Error("Pre-created pull request does not target the expected trusted repository branch");
+ }
+
+ core.setOutput("branch", expectedBranch);
+}
+
+module.exports = { main };
diff --git a/actions/setup/js/validate_pre_created_pull_request.test.cjs b/actions/setup/js/validate_pre_created_pull_request.test.cjs
new file mode 100644
index 00000000000..a9e691ebb90
--- /dev/null
+++ b/actions/setup/js/validate_pre_created_pull_request.test.cjs
@@ -0,0 +1,96 @@
+// @ts-check
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+describe("validate_pre_created_pull_request", () => {
+ let originalGlobals;
+ let originalEnv;
+
+ beforeEach(() => {
+ originalGlobals = {
+ core: global.core,
+ github: global.github,
+ context: global.context,
+ };
+ originalEnv = { ...process.env };
+
+ global.core = { setOutput: vi.fn(), info: vi.fn(), warning: vi.fn(), debug: vi.fn() };
+ global.context = {
+ repo: { owner: "owner", repo: "repo" },
+ };
+ global.github = {
+ rest: {
+ pulls: {
+ get: vi.fn().mockResolvedValue({
+ data: {
+ head: {
+ ref: "gh-aw/pre-created/123-2",
+ repo: { full_name: "owner/repo" },
+ },
+ base: {
+ repo: { full_name: "owner/repo" },
+ },
+ },
+ }),
+ },
+ },
+ };
+ process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER = "42";
+ process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH = "gh-aw/pre-created/123-2";
+ process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH = "gh-aw/pre-created/123-2";
+ });
+
+ afterEach(() => {
+ global.core = originalGlobals.core;
+ global.github = originalGlobals.github;
+ global.context = originalGlobals.context;
+ vi.resetModules();
+ process.env = originalEnv;
+ });
+
+ it("validates the branch and repository before emitting the trusted branch output", async () => {
+ const { main } = await import("./validate_pre_created_pull_request.cjs");
+ await main();
+
+ expect(global.github.rest.pulls.get).toHaveBeenCalledWith({
+ owner: "owner",
+ repo: "repo",
+ pull_number: 42,
+ });
+ expect(global.core.setOutput).toHaveBeenCalledWith("branch", "gh-aw/pre-created/123-2");
+ });
+
+ it("rejects unexpected branch output without fetching the pull request", async () => {
+ process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH = "attacker";
+ const { main } = await import("./validate_pre_created_pull_request.cjs");
+
+ await expect(main()).rejects.toThrow(/did not match expected workflow branch/);
+ expect(global.github.rest.pulls.get).not.toHaveBeenCalled();
+ expect(global.core.setOutput).not.toHaveBeenCalled();
+ });
+
+ it("rejects invalid pull request numbers", async () => {
+ process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER = "0";
+ const { main } = await import("./validate_pre_created_pull_request.cjs");
+
+ await expect(main()).rejects.toThrow(/pull request number is invalid/);
+ expect(global.github.rest.pulls.get).not.toHaveBeenCalled();
+ });
+
+ it("rejects pull requests outside the expected repository branch", async () => {
+ global.github.rest.pulls.get.mockResolvedValue({
+ data: {
+ head: {
+ ref: "gh-aw/pre-created/123-2",
+ repo: { full_name: "fork/repo" },
+ },
+ base: {
+ repo: { full_name: "owner/repo" },
+ },
+ },
+ });
+ const { main } = await import("./validate_pre_created_pull_request.cjs");
+
+ await expect(main()).rejects.toThrow(/does not target the expected trusted repository branch/);
+ expect(global.core.setOutput).not.toHaveBeenCalled();
+ });
+});
diff --git a/pkg/workflow/compiler_precreate_pull_request.go b/pkg/workflow/compiler_precreate_pull_request.go
index 9931b3b5b5e..dbf3a121e66 100644
--- a/pkg/workflow/compiler_precreate_pull_request.go
+++ b/pkg/workflow/compiler_precreate_pull_request.go
@@ -109,25 +109,7 @@ func (c *Compiler) addActivationPreCreatePullRequestStep(ctx *activationJobBuild
" with:\n",
fmt.Sprintf(" github-token: %s\n", token),
" script: |\n",
- " const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || \"\";\n",
- " const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || \"\";\n",
- " if (branch !== expectedBranch) {\n",
- " throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);\n",
- " }\n",
- " const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || \"\", 10);\n",
- " if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {\n",
- " throw new Error(\"Pre-created pull request number is invalid\");\n",
- " }\n",
- " const { data: pullRequest } = await github.rest.pulls.get({\n",
- " owner: context.repo.owner,\n",
- " repo: context.repo.repo,\n",
- " pull_number: pullNumber,\n",
- " });\n",
- " const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();\n",
- " if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {\n",
- " throw new Error(\"Pre-created pull request does not target the expected trusted repository branch\");\n",
- " }\n",
- " core.setOutput(\"branch\", expectedBranch);\n",
+ generateGitHubScriptWithRequire("validate_pre_created_pull_request.cjs"),
)
ctx.outputs["pre_created_pull_request_number"] = "${{ steps.pre-create-pull-request.outputs.pull_request_number }}"
ctx.outputs["pre_created_pull_request_url"] = "${{ steps.pre-create-pull-request.outputs.pull_request_url }}"
diff --git a/pkg/workflow/compiler_precreate_pull_request_test.go b/pkg/workflow/compiler_precreate_pull_request_test.go
index f0ae585ab66..d672dc31a1d 100644
--- a/pkg/workflow/compiler_precreate_pull_request_test.go
+++ b/pkg/workflow/compiler_precreate_pull_request_test.go
@@ -29,7 +29,7 @@ func TestBuildActivationJobPreCreatesPullRequest(t *testing.T) {
assert.Contains(t, steps, "id: pre-create-pull-request")
assert.Contains(t, steps, "pre_create_pull_request.cjs")
assert.Contains(t, steps, "id: validate-pre-created-pull-request")
- assert.Contains(t, steps, "Pre-created pull request does not target the expected trusted repository branch")
+ assert.Contains(t, steps, "validate_pre_created_pull_request.cjs")
assert.Contains(t, job.Permissions, "contents: write")
assert.Contains(t, job.Permissions, "pull-requests: write")
assert.Contains(t, job.Permissions, "checks: write")
From e821aa061246e28dfa484d02fecd64263276b812 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 24 Aug 2026 20:22:03 +0000
Subject: [PATCH 06/14] Regenerate pre-create validation lockfiles
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
.github/workflows/avenger.lock.yml | 25 +++++--------------
.github/workflows/ci-coach.lock.yml | 25 +++++--------------
.github/workflows/cloclo.lock.yml | 25 +++++--------------
.../workflows/code-scanning-fixer.lock.yml | 25 +++++--------------
.github/workflows/code-simplifier.lock.yml | 25 +++++--------------
...aily-agent-of-the-day-blog-writer.lock.yml | 25 +++++--------------
.../daily-architecture-diagram.lock.yml | 25 +++++--------------
...strostylelite-markdown-spellcheck.lock.yml | 25 +++++--------------
.../daily-caveman-optimizer.lock.yml | 25 +++++--------------
.../workflows/daily-code-debt-aider.lock.yml | 25 +++++--------------
.../daily-community-attribution.lock.yml | 25 +++++--------------
...ly-compiler-threat-spec-optimizer.lock.yml | 25 +++++--------------
.github/workflows/daily-doc-healer.lock.yml | 25 +++++--------------
.github/workflows/daily-doc-updater.lock.yml | 25 +++++--------------
.../daily-documentation-diagram.lock.yml | 25 +++++--------------
.../daily-elixir-credo-snippet-audit.lock.yml | 25 +++++--------------
.../daily-go-test-parallelizer.lock.yml | 25 +++++--------------
.../daily-go-test-stubs-aider.lock.yml | 25 +++++--------------
.../daily-rendering-scripts-verifier.lock.yml | 25 +++++--------------
.../daily-safe-output-integrator.lock.yml | 25 +++++--------------
.../daily-safeoutputs-git-simulator.lock.yml | 25 +++++--------------
...ily-trajectory-grader-implementer.lock.yml | 25 +++++--------------
.../workflows/daily-workflow-updater.lock.yml | 25 +++++--------------
.../workflows/daily-yamllint-fixer.lock.yml | 25 +++++--------------
.github/workflows/dead-code-remover.lock.yml | 25 +++++--------------
.github/workflows/dependabot-burner.lock.yml | 25 +++++--------------
.../developer-docs-consolidator.lock.yml | 25 +++++--------------
.github/workflows/dictation-prompt.lock.yml | 25 +++++--------------
.github/workflows/eslint-miner.lock.yml | 25 +++++--------------
.github/workflows/evoskill-evolver.lock.yml | 25 +++++--------------
.../workflows/functional-pragmatist.lock.yml | 25 +++++--------------
.../github-mcp-tools-report.lock.yml | 25 +++++--------------
.../workflows/glossary-maintainer.lock.yml | 25 +++++--------------
.github/workflows/go-logger.lock.yml | 25 +++++--------------
.github/workflows/hourly-ci-cleaner.lock.yml | 25 +++++--------------
.../workflows/instructions-janitor.lock.yml | 25 +++++--------------
.../workflows/layout-spec-maintainer.lock.yml | 25 +++++--------------
.github/workflows/linter-miner.lock.yml | 25 +++++--------------
.github/workflows/purelock.lock.yml | 25 +++++--------------
.github/workflows/refiner.lock.yml | 25 +++++--------------
.github/workflows/ruflo-backed-task.lock.yml | 25 +++++--------------
.../workflows/slide-deck-maintainer.lock.yml | 25 +++++--------------
.github/workflows/smoke-project.lock.yml | 25 +++++--------------
.github/workflows/spec-enforcer.lock.yml | 25 +++++--------------
.github/workflows/spec-extractor.lock.yml | 25 +++++--------------
.../workflows/technical-doc-writer.lock.yml | 25 +++++--------------
.github/workflows/tidy.lock.yml | 25 +++++--------------
.../workflows/ubuntu-image-analyzer.lock.yml | 25 +++++--------------
.github/workflows/unbloat-docs.lock.yml | 25 +++++--------------
.github/workflows/update-astro.lock.yml | 25 +++++--------------
.../weekly-blog-post-writer.lock.yml | 25 +++++--------------
.../weekly-editors-health-check.lock.yml | 25 +++++--------------
.../weekly-safe-outputs-spec-review.lock.yml | 25 +++++--------------
53 files changed, 318 insertions(+), 1007 deletions(-)
diff --git a/.github/workflows/avenger.lock.yml b/.github/workflows/avenger.lock.yml
index 9f368a008ca..4235ce2a529 100644
--- a/.github/workflows/avenger.lock.yml
+++ b/.github/workflows/avenger.lock.yml
@@ -287,25 +287,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/ci-coach.lock.yml b/.github/workflows/ci-coach.lock.yml
index f4c625dc12f..c99f6cc43f7 100644
--- a/.github/workflows/ci-coach.lock.yml
+++ b/.github/workflows/ci-coach.lock.yml
@@ -276,25 +276,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/cloclo.lock.yml b/.github/workflows/cloclo.lock.yml
index e7d3a84adcf..934683e8cff 100644
--- a/.github/workflows/cloclo.lock.yml
+++ b/.github/workflows/cloclo.lock.yml
@@ -315,25 +315,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/code-scanning-fixer.lock.yml b/.github/workflows/code-scanning-fixer.lock.yml
index 41c075ce943..5c8c7857ff8 100644
--- a/.github/workflows/code-scanning-fixer.lock.yml
+++ b/.github/workflows/code-scanning-fixer.lock.yml
@@ -280,25 +280,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/code-simplifier.lock.yml b/.github/workflows/code-simplifier.lock.yml
index d11b02ed021..e6626552155 100644
--- a/.github/workflows/code-simplifier.lock.yml
+++ b/.github/workflows/code-simplifier.lock.yml
@@ -286,25 +286,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml b/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml
index e2c42904c88..85877c45182 100644
--- a/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml
+++ b/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml
@@ -297,25 +297,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/daily-architecture-diagram.lock.yml b/.github/workflows/daily-architecture-diagram.lock.yml
index 98b6719e912..aa583fea949 100644
--- a/.github/workflows/daily-architecture-diagram.lock.yml
+++ b/.github/workflows/daily-architecture-diagram.lock.yml
@@ -274,25 +274,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml b/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml
index 5faff0ade6f..bc584400b65 100644
--- a/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml
+++ b/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml
@@ -279,25 +279,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/daily-caveman-optimizer.lock.yml b/.github/workflows/daily-caveman-optimizer.lock.yml
index 4256abb08d7..506b15a6ff6 100644
--- a/.github/workflows/daily-caveman-optimizer.lock.yml
+++ b/.github/workflows/daily-caveman-optimizer.lock.yml
@@ -291,25 +291,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/daily-code-debt-aider.lock.yml b/.github/workflows/daily-code-debt-aider.lock.yml
index 5864e87c4c5..3030bf3dd8e 100644
--- a/.github/workflows/daily-code-debt-aider.lock.yml
+++ b/.github/workflows/daily-code-debt-aider.lock.yml
@@ -272,25 +272,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/daily-community-attribution.lock.yml b/.github/workflows/daily-community-attribution.lock.yml
index febae716f9e..3ba10d5c8c6 100644
--- a/.github/workflows/daily-community-attribution.lock.yml
+++ b/.github/workflows/daily-community-attribution.lock.yml
@@ -291,25 +291,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml b/.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml
index 3215db9194e..ba99be547f8 100644
--- a/.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml
+++ b/.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml
@@ -290,25 +290,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/daily-doc-healer.lock.yml b/.github/workflows/daily-doc-healer.lock.yml
index 0e51e15053c..19c1887b17e 100644
--- a/.github/workflows/daily-doc-healer.lock.yml
+++ b/.github/workflows/daily-doc-healer.lock.yml
@@ -295,25 +295,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/daily-doc-updater.lock.yml b/.github/workflows/daily-doc-updater.lock.yml
index 6e5ceeb0350..159753551a2 100644
--- a/.github/workflows/daily-doc-updater.lock.yml
+++ b/.github/workflows/daily-doc-updater.lock.yml
@@ -292,25 +292,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/daily-documentation-diagram.lock.yml b/.github/workflows/daily-documentation-diagram.lock.yml
index f3bd2fe64f0..1a505c8c8ae 100644
--- a/.github/workflows/daily-documentation-diagram.lock.yml
+++ b/.github/workflows/daily-documentation-diagram.lock.yml
@@ -252,25 +252,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/daily-elixir-credo-snippet-audit.lock.yml b/.github/workflows/daily-elixir-credo-snippet-audit.lock.yml
index 872fdd567f0..56d95f80d53 100644
--- a/.github/workflows/daily-elixir-credo-snippet-audit.lock.yml
+++ b/.github/workflows/daily-elixir-credo-snippet-audit.lock.yml
@@ -277,25 +277,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/daily-go-test-parallelizer.lock.yml b/.github/workflows/daily-go-test-parallelizer.lock.yml
index 0a7e2b5364c..acffc4d9dae 100644
--- a/.github/workflows/daily-go-test-parallelizer.lock.yml
+++ b/.github/workflows/daily-go-test-parallelizer.lock.yml
@@ -267,25 +267,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/daily-go-test-stubs-aider.lock.yml b/.github/workflows/daily-go-test-stubs-aider.lock.yml
index 984da6e8b54..261402dface 100644
--- a/.github/workflows/daily-go-test-stubs-aider.lock.yml
+++ b/.github/workflows/daily-go-test-stubs-aider.lock.yml
@@ -272,25 +272,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/daily-rendering-scripts-verifier.lock.yml b/.github/workflows/daily-rendering-scripts-verifier.lock.yml
index f9fb259d1c8..5b50b2b356d 100644
--- a/.github/workflows/daily-rendering-scripts-verifier.lock.yml
+++ b/.github/workflows/daily-rendering-scripts-verifier.lock.yml
@@ -293,25 +293,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/daily-safe-output-integrator.lock.yml b/.github/workflows/daily-safe-output-integrator.lock.yml
index a13a4c8112b..89ca82276d9 100644
--- a/.github/workflows/daily-safe-output-integrator.lock.yml
+++ b/.github/workflows/daily-safe-output-integrator.lock.yml
@@ -272,25 +272,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/daily-safeoutputs-git-simulator.lock.yml b/.github/workflows/daily-safeoutputs-git-simulator.lock.yml
index 6be2d94ea4e..091366e81e5 100644
--- a/.github/workflows/daily-safeoutputs-git-simulator.lock.yml
+++ b/.github/workflows/daily-safeoutputs-git-simulator.lock.yml
@@ -260,25 +260,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/daily-trajectory-grader-implementer.lock.yml b/.github/workflows/daily-trajectory-grader-implementer.lock.yml
index 238a40703a0..e88e558037f 100644
--- a/.github/workflows/daily-trajectory-grader-implementer.lock.yml
+++ b/.github/workflows/daily-trajectory-grader-implementer.lock.yml
@@ -266,25 +266,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/daily-workflow-updater.lock.yml b/.github/workflows/daily-workflow-updater.lock.yml
index 674f866ad1f..00e6369a228 100644
--- a/.github/workflows/daily-workflow-updater.lock.yml
+++ b/.github/workflows/daily-workflow-updater.lock.yml
@@ -269,25 +269,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/daily-yamllint-fixer.lock.yml b/.github/workflows/daily-yamllint-fixer.lock.yml
index 1a270fed0d3..64f23e42d38 100644
--- a/.github/workflows/daily-yamllint-fixer.lock.yml
+++ b/.github/workflows/daily-yamllint-fixer.lock.yml
@@ -283,25 +283,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/dead-code-remover.lock.yml b/.github/workflows/dead-code-remover.lock.yml
index be7e5cfe589..bfec20c8d21 100644
--- a/.github/workflows/dead-code-remover.lock.yml
+++ b/.github/workflows/dead-code-remover.lock.yml
@@ -277,25 +277,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/dependabot-burner.lock.yml b/.github/workflows/dependabot-burner.lock.yml
index e39c8c3c1b4..8c3affd2956 100644
--- a/.github/workflows/dependabot-burner.lock.yml
+++ b/.github/workflows/dependabot-burner.lock.yml
@@ -318,25 +318,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/developer-docs-consolidator.lock.yml b/.github/workflows/developer-docs-consolidator.lock.yml
index 2ffd325cecb..5fe713a6343 100644
--- a/.github/workflows/developer-docs-consolidator.lock.yml
+++ b/.github/workflows/developer-docs-consolidator.lock.yml
@@ -285,25 +285,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/dictation-prompt.lock.yml b/.github/workflows/dictation-prompt.lock.yml
index 6086674a54e..59d1f6fcedd 100644
--- a/.github/workflows/dictation-prompt.lock.yml
+++ b/.github/workflows/dictation-prompt.lock.yml
@@ -269,25 +269,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/eslint-miner.lock.yml b/.github/workflows/eslint-miner.lock.yml
index dc820eb73d0..eaef1a227be 100644
--- a/.github/workflows/eslint-miner.lock.yml
+++ b/.github/workflows/eslint-miner.lock.yml
@@ -254,25 +254,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/evoskill-evolver.lock.yml b/.github/workflows/evoskill-evolver.lock.yml
index f5a805a898c..66bb8ebe3d2 100644
--- a/.github/workflows/evoskill-evolver.lock.yml
+++ b/.github/workflows/evoskill-evolver.lock.yml
@@ -255,25 +255,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/functional-pragmatist.lock.yml b/.github/workflows/functional-pragmatist.lock.yml
index aed6ba79a4d..cbda07fda99 100644
--- a/.github/workflows/functional-pragmatist.lock.yml
+++ b/.github/workflows/functional-pragmatist.lock.yml
@@ -276,25 +276,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/github-mcp-tools-report.lock.yml b/.github/workflows/github-mcp-tools-report.lock.yml
index 13b9916b027..62283380ff3 100644
--- a/.github/workflows/github-mcp-tools-report.lock.yml
+++ b/.github/workflows/github-mcp-tools-report.lock.yml
@@ -279,25 +279,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/glossary-maintainer.lock.yml b/.github/workflows/glossary-maintainer.lock.yml
index 244c1aa3287..8a4fb2a7617 100644
--- a/.github/workflows/glossary-maintainer.lock.yml
+++ b/.github/workflows/glossary-maintainer.lock.yml
@@ -295,25 +295,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/go-logger.lock.yml b/.github/workflows/go-logger.lock.yml
index c2c1d39b643..1cb9f9a5f3d 100644
--- a/.github/workflows/go-logger.lock.yml
+++ b/.github/workflows/go-logger.lock.yml
@@ -284,25 +284,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/hourly-ci-cleaner.lock.yml b/.github/workflows/hourly-ci-cleaner.lock.yml
index 005f7e53ee0..d1606521be5 100644
--- a/.github/workflows/hourly-ci-cleaner.lock.yml
+++ b/.github/workflows/hourly-ci-cleaner.lock.yml
@@ -284,25 +284,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/instructions-janitor.lock.yml b/.github/workflows/instructions-janitor.lock.yml
index 876a28203c9..c23988d2b21 100644
--- a/.github/workflows/instructions-janitor.lock.yml
+++ b/.github/workflows/instructions-janitor.lock.yml
@@ -279,25 +279,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/layout-spec-maintainer.lock.yml b/.github/workflows/layout-spec-maintainer.lock.yml
index 8f17c4398ae..992ce299976 100644
--- a/.github/workflows/layout-spec-maintainer.lock.yml
+++ b/.github/workflows/layout-spec-maintainer.lock.yml
@@ -279,25 +279,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/linter-miner.lock.yml b/.github/workflows/linter-miner.lock.yml
index aafeb242e90..b20fd91c35c 100644
--- a/.github/workflows/linter-miner.lock.yml
+++ b/.github/workflows/linter-miner.lock.yml
@@ -282,25 +282,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/purelock.lock.yml b/.github/workflows/purelock.lock.yml
index 5cd7139750f..33cf6d23973 100644
--- a/.github/workflows/purelock.lock.yml
+++ b/.github/workflows/purelock.lock.yml
@@ -287,25 +287,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/refiner.lock.yml b/.github/workflows/refiner.lock.yml
index 530c60cf178..3c3d2784817 100644
--- a/.github/workflows/refiner.lock.yml
+++ b/.github/workflows/refiner.lock.yml
@@ -309,25 +309,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/ruflo-backed-task.lock.yml b/.github/workflows/ruflo-backed-task.lock.yml
index d9d815ebd4a..b49600e17a3 100644
--- a/.github/workflows/ruflo-backed-task.lock.yml
+++ b/.github/workflows/ruflo-backed-task.lock.yml
@@ -287,25 +287,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/slide-deck-maintainer.lock.yml b/.github/workflows/slide-deck-maintainer.lock.yml
index d6ce4d13027..1446254cc36 100644
--- a/.github/workflows/slide-deck-maintainer.lock.yml
+++ b/.github/workflows/slide-deck-maintainer.lock.yml
@@ -288,25 +288,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/smoke-project.lock.yml b/.github/workflows/smoke-project.lock.yml
index 0072c267574..755473c2567 100644
--- a/.github/workflows/smoke-project.lock.yml
+++ b/.github/workflows/smoke-project.lock.yml
@@ -313,25 +313,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/spec-enforcer.lock.yml b/.github/workflows/spec-enforcer.lock.yml
index 070f966c294..47c83305cf5 100644
--- a/.github/workflows/spec-enforcer.lock.yml
+++ b/.github/workflows/spec-enforcer.lock.yml
@@ -284,25 +284,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/spec-extractor.lock.yml b/.github/workflows/spec-extractor.lock.yml
index c69fe6f550f..d6881d1641c 100644
--- a/.github/workflows/spec-extractor.lock.yml
+++ b/.github/workflows/spec-extractor.lock.yml
@@ -274,25 +274,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/technical-doc-writer.lock.yml b/.github/workflows/technical-doc-writer.lock.yml
index 1ba2d71ef5d..2f493b850f5 100644
--- a/.github/workflows/technical-doc-writer.lock.yml
+++ b/.github/workflows/technical-doc-writer.lock.yml
@@ -283,25 +283,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/tidy.lock.yml b/.github/workflows/tidy.lock.yml
index d046e61d850..d5b90df805b 100644
--- a/.github/workflows/tidy.lock.yml
+++ b/.github/workflows/tidy.lock.yml
@@ -303,25 +303,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/ubuntu-image-analyzer.lock.yml b/.github/workflows/ubuntu-image-analyzer.lock.yml
index 00dd351a366..e65dae59944 100644
--- a/.github/workflows/ubuntu-image-analyzer.lock.yml
+++ b/.github/workflows/ubuntu-image-analyzer.lock.yml
@@ -283,25 +283,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/unbloat-docs.lock.yml b/.github/workflows/unbloat-docs.lock.yml
index f76cfca83d5..3a64059f102 100644
--- a/.github/workflows/unbloat-docs.lock.yml
+++ b/.github/workflows/unbloat-docs.lock.yml
@@ -306,25 +306,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/update-astro.lock.yml b/.github/workflows/update-astro.lock.yml
index d344094f82a..e001bc057e1 100644
--- a/.github/workflows/update-astro.lock.yml
+++ b/.github/workflows/update-astro.lock.yml
@@ -283,25 +283,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/weekly-blog-post-writer.lock.yml b/.github/workflows/weekly-blog-post-writer.lock.yml
index dd92c77173f..a7f75ee51b1 100644
--- a/.github/workflows/weekly-blog-post-writer.lock.yml
+++ b/.github/workflows/weekly-blog-post-writer.lock.yml
@@ -283,25 +283,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/weekly-editors-health-check.lock.yml b/.github/workflows/weekly-editors-health-check.lock.yml
index 0e8c9ce814b..2742fac0e91 100644
--- a/.github/workflows/weekly-editors-health-check.lock.yml
+++ b/.github/workflows/weekly-editors-health-check.lock.yml
@@ -274,25 +274,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
index 5703872bc48..d36abc5f529 100644
--- a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
+++ b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
@@ -277,25 +277,12 @@ jobs:
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
- const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
- if (branch !== expectedBranch) {
- throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
- }
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
- throw new Error("Pre-created pull request number is invalid");
- }
- const { data: pullRequest } = await github.rest.pulls.get({
- owner: context.repo.owner,
- repo: context.repo.repo,
- pull_number: pullNumber,
- });
- const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
- if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {
- throw new Error("Pre-created pull request does not target the expected trusted repository branch");
- }
- core.setOutput("branch", expectedBranch);
+ const path = require('path');
+ const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
+ const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs'));
+ await main();
- name: Check workflow lock file
id: check-lock-file
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
From 7174596666928b442f9c3019f23c11e1d0c4cef4 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 24 Aug 2026 20:41:53 +0000
Subject: [PATCH 07/14] Update safe outputs pre-created PR spec
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
.../reference/safe-outputs-pull-requests.md | 4 +-
.../docs/specs/safe-outputs-specification.md | 39 ++++++++++++++++++-
2 files changed, 40 insertions(+), 3 deletions(-)
diff --git a/docs/src/content/docs/reference/safe-outputs-pull-requests.md b/docs/src/content/docs/reference/safe-outputs-pull-requests.md
index 243536905a6..56d08a39e69 100644
--- a/docs/src/content/docs/reference/safe-outputs-pull-requests.md
+++ b/docs/src/content/docs/reference/safe-outputs-pull-requests.md
@@ -66,7 +66,7 @@ See [Cross-Repository Operations](/gh-aw/reference/cross-repository/) for `targe
`steer` is an experimental option. `gh aw compile` emits an experimental feature warning when a workflow uses it.
:::
-Set `steer: true` to allocate a draft pull request during the activation job, before the agent starts. The activation job creates a run-specific branch from the resolved base branch, opens a draft PR titled `[WIP] : work in progress` (the configured `title-prefix` is inserted after the `[WIP]` marker) whose body explains that the run is still in progress, links to the workflow run, and attaches a check linking back to that run. The agent and `safe_outputs` jobs check out the allocated branch, the eventual `create_pull_request` output updates the existing PR instead of opening another one, and the conclusion job completes the check. When the run ends without any changes (for example with `if-no-changes: ignore`, a `noop` output, or a failure before the safe output runs), the conclusion job closes the pre-created pull request and deletes its branch, so empty placeholders are not left behind.
+Set `steer: true` to allocate a draft pull request during the activation job, before the agent starts. The activation job creates a run-specific workflow-owned branch from the resolved base branch, opens a draft PR titled `[WIP] : work in progress` (the configured `title-prefix` is inserted after the `[WIP]` marker) whose body explains that the run is still in progress, links to the workflow run, and attaches a check linking back to that run. After creation, the activation job validates that the pull request number is valid, that the PR head ref is the expected workflow-owned branch, and that both the head and base repositories are the workflow repository. The agent and `safe_outputs` jobs check out the deterministic workflow-owned branch ref directly, rather than using the activation output as their checkout `ref`. The eventual `create_pull_request` output updates the existing PR instead of opening another one, and the conclusion job completes the check. When the run ends without any changes (for example with `if-no-changes: ignore`, a `noop` output, or a failure before the safe output runs), the conclusion job closes the pre-created pull request and deletes its branch, so empty placeholders are not left behind.
`steer` also lets the agent read user-authored comments and review comments containing the keyword `steer` on that pull request as feedback during the run. Steering enables the GitHub MCP pull request toolset for comment reads, and requires top-level `pull-requests: read` permission. The compiler reports an error instead of adding that permission automatically.
@@ -82,6 +82,8 @@ safe-outputs:
Pre-creation requires a safe-output token with `contents: write`, `pull-requests: write`, and `checks: write`. It supports one same-repository PR per run and cannot be combined with `target-repo`, `head-repo`, `allowed-repos`, `branch-prefix`, `allowed-branches`, `allowed-base-branches`, or `checkout: false`. In [staged mode](/gh-aw/reference/safe-outputs/#staged-mode) no pull request is allocated, because staged runs must not perform API side effects. The allocated pull request is always opened as a draft, regardless of the `draft` setting; when `draft: false` is configured, it is marked ready for review in the safe output phase, once the agent's changes are applied.
+For security, pre-created pull request mode is limited to same-repository operation. The pre-created branch name is derived from trusted workflow run metadata and has the form `gh-aw/pre-created/-` in generated workflows. Downstream jobs must not treat an arbitrary activation output as a trusted checkout ref.
+
### Branch targeting
`base-branch` sets the PR's target branch. Defaults to `github.base_ref` (PR event) or `github.ref_name` (push event). Use `allowed-base-branches` to let the agent pick the target branch at runtime — the agent supplies a `base` value in the tool call and it is accepted only if it matches one of the configured glob patterns.
diff --git a/docs/src/content/docs/specs/safe-outputs-specification.md b/docs/src/content/docs/specs/safe-outputs-specification.md
index 12d0b9ddde5..c9daf95ed0f 100644
--- a/docs/src/content/docs/specs/safe-outputs-specification.md
+++ b/docs/src/content/docs/specs/safe-outputs-specification.md
@@ -7,9 +7,9 @@ sidebar:
# Safe Outputs MCP Gateway Specification
-**Version**: 1.28.5
+**Version**: 1.28.6
**Status**: Working Draft
-**Publication Date**: 2026-08-20
+**Publication Date**: 2026-08-24
**Editor**: GitHub Agentic Workflows Team
**This Version**: [safe-outputs-specification](/gh-aw/specs/safe-outputs-specification/)
**Latest Published Version**: This document
@@ -77,6 +77,10 @@ This specification uses the following terms with precise definitions:
**Cache Poisoning**: A Bell-LaPadula write-up violation where a lower-integrity agent writes data to a shared cache store that is subsequently consumed by a higher-integrity run without provenance verification.
+**Pre-created Pull Request**: A draft pull request allocated during the activation phase before agent execution when `safe-outputs.create-pull-request.steer` is enabled.
+
+**Workflow-Owned Pre-created Branch**: The deterministic branch ref allocated by the workflow for a pre-created pull request. In the reference implementation this ref has the form `gh-aw/pre-created/-` and is derived only from trusted GitHub Actions run metadata.
+
---
## 1. Introduction
@@ -397,6 +401,24 @@ Agent execution context MUST NOT gain access to safe output job credentials thro
accessible_credentials(agent_context, t) ∩ safe_output_credentials = ∅
```
+**Requirement AR5: Pre-created Pull Request Branch Provenance**
+
+When an implementation supports pre-created pull requests, it MUST derive the pre-created branch name from trusted workflow-controlled state. The branch ref MUST be deterministic for the workflow run and MUST NOT be selected from agent-controlled content, pull request comments, event payload branch names, or unvalidated activation outputs.
+
+After creating a pre-created pull request and before exporting branch or pull request metadata to downstream jobs, the activation phase MUST validate all of the following:
+
+1. The branch output exactly equals the expected workflow-owned pre-created branch ref.
+2. The pull request number is a positive safe integer.
+3. The pull request head ref exactly equals the expected workflow-owned pre-created branch ref.
+4. The pull request head repository exactly matches the workflow repository.
+5. The pull request base repository exactly matches the workflow repository.
+
+If any validation fails, the implementation MUST fail the activation phase and MUST NOT allow downstream agent, safe-output, or conclusion jobs to treat the pre-created pull request as trusted workflow state.
+
+Agent and safe-output checkouts for a pre-created pull request MUST use the deterministic workflow-owned branch ref directly. Implementations MUST NOT use `needs.activation.outputs.pre_created_pull_request_branch`, or any equivalent activation output, as the `actions/checkout` `ref` in any privileged checkout step.
+
+*Rationale*: Activation outputs cross a job boundary and may be influenced by implementation defects or compromised action behavior. Recomputing the expected branch ref in each checkout prevents a poisoned activation output from redirecting agent or privileged safe-output execution to an attacker-controlled branch.
+
### 3.2 Threat Model and Mitigations
This specification addresses five primary threat scenarios:
@@ -2428,6 +2450,8 @@ safe-outputs:
9. **Owner-Qualified Head Reference**: When `head-repo` differs from `target-repo`, the created pull request MUST use an owner-qualified head reference identifying the head repository owner and pushed branch. Unqualified same-name branch references MUST NOT be used in fork-backed mode.
10. **Ephemeral Fork Branch Model**: When `head-repo` differs from `target-repo`, implementations SHOULD create or refresh an ephemeral branch in `head-repo` from the resolved upstream base SHA, apply the agent changes, and open the pull request back to the upstream base. Implementations MAY support explicit synchronization of that ephemeral branch with a newer upstream base, but implicit reuse of arbitrary pre-existing fork branches MUST NOT occur.
11. **Summary and Manifest Provenance**: Successful executions MUST record `head_repo` in the safe-output summary and machine-readable manifest.
+12. **Pre-created Pull Request Validation**: When `steer: true` is configured, the activation phase MUST create the draft pull request on a workflow-owned pre-created branch, validate that the created pull request head and base repositories are the workflow repository, and validate that the head ref equals the expected deterministic branch before downstream jobs consume the pull request metadata.
+13. **Pre-created Checkout Reference**: In pre-created pull request mode, the agent job and safe-output job MUST check out the deterministic workflow-owned pre-created branch ref directly. Implementations MUST NOT derive checkout `ref` values from activation outputs such as `pre_created_pull_request_branch`.
**Configuration Parameters**:
@@ -2449,6 +2473,7 @@ safe-outputs:
- `head-github-app`: Optional GitHub App configuration to mint an ephemeral credential for `head-repo` branch writes at runtime. When `head-github-app` is configured, the minted token takes precedence over `head-github-token`. The app installation MUST have `contents: write` on `head-repo`
- `preserve-branch-name`: When `true`, use the agent-supplied branch name verbatim without appending a random salt suffix (default: `false`)
- `recreate-ref`: When `true` (and `preserve-branch-name: true`), allows the handler to force-delete an existing remote branch ref and recreate it from the agent's local HEAD on collision. When `false` (default), an existing remote branch under `preserve-branch-name: true` causes a fallback rather than overwriting the remote ref. Has no effect when `preserve-branch-name: false`. (default: `false`)
+- `steer`: Experimental. When `true`, pre-creates a same-repository draft pull request during activation and allows the agent to read user-authored pull request comments as steering feedback. This mode requires `max: 1`, the default workflow-repository checkout, and a statically knowable base branch; it MUST NOT be combined with `target-repo`, `head-repo`, `allowed-repos`, `branch-prefix`, `allowed-branches`, `allowed-base-branches`, `checkout: false`, or expression-valued staged mode.
**Security Requirements**:
@@ -2458,6 +2483,9 @@ safe-outputs:
- `head-repo` MUST be either the same repository as `target-repo` or an explicitly configured automation-owned fork; arbitrary contributor forks MUST NOT be used as write targets
- Both `target-repo` and `head-repo` MUST be validated against the configured allowlist before any push or pull request API call
- When distinct upstream and head credentials are configured, implementations MUST use the least-privilege head-repository credential only for branch writes and the upstream credential only for upstream pull request management
+- Pre-created pull request branches MUST be validated against the expected workflow-owned branch ref before any downstream privileged checkout or pull request update uses the pre-created pull request metadata.
+- Agent and safe-output checkout steps in pre-created pull request mode MUST use the deterministic workflow-owned branch ref directly and MUST NOT use an activation output as the checkout ref.
+- Pre-created pull request validation MUST confirm that both the head repository and base repository are the workflow repository; fork-backed or cross-repository pre-created pull requests are non-conforming.
**Required Permissions**:
@@ -5501,6 +5529,13 @@ This specification revision aligns with directly relevant `CHANGELOG.md` entries
- **Earlier changelog entry**: status comments were decoupled from default AI reaction behavior; explicit `on.status-comment` configuration is required when status comments are desired.
- **Earlier changelog entry**: `command` trigger was renamed to `slash_command` with deprecation compatibility.
+**Version 1.28.6** (2026-08-24):
+
+- **Specified**: Pre-created pull request branches MUST be validated after creation and before downstream jobs treat them as trusted workflow state.
+- **Specified**: Pre-created pull request validation MUST confirm the expected deterministic branch ref, valid pull request number, workflow-repository head, and workflow-repository base.
+- **Specified**: Agent and safe-output checkouts in pre-created pull request mode MUST use the deterministic workflow-owned branch ref directly rather than activation-output-derived refs.
+- **Updated**: Publication metadata to 1.28.6.
+
**Version 1.28.5** (2026-08-20):
- **Changed**: Default value of the `discussions` field on `hide-comment` inverted from `true` to `false`. The `discussions:write` permission is now opt-in, matching `add-comment`. Set `discussions: true` to hide comments on discussions; omitting the field no longer requests `discussions:write`.
From e066cf24cf95ccf9eed25702274af937c7fa9ab8 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 24 Aug 2026 21:05:01 +0000
Subject: [PATCH 08/14] Support custom precreated PR branch prefix
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
actions/setup/js/pre_create_pull_request.cjs | 12 +++-
.../setup/js/pre_create_pull_request.test.cjs | 27 +++++++++
.../docs/reference/frontmatter-full.md | 4 +-
.../reference/safe-outputs-pull-requests.md | 4 +-
.../docs/specs/safe-outputs-specification.md | 7 ++-
pkg/parser/schemas/main_workflow_schema.json | 2 +-
.../compiler_precreate_pull_request.go | 17 +++++-
...precreate_pull_request_integration_test.go | 7 ++-
.../compiler_precreate_pull_request_test.go | 54 ++++++++++++++++-
pkg/workflow/compiler_safe_outputs_steps.go | 2 +-
pkg/workflow/compiler_yaml_checkout.go | 2 +-
pkg/workflow/create_pull_request.go | 59 ++++++++++++++++++-
12 files changed, 179 insertions(+), 18 deletions(-)
diff --git a/actions/setup/js/pre_create_pull_request.cjs b/actions/setup/js/pre_create_pull_request.cjs
index ff1ccaede66..3fb59e5620c 100644
--- a/actions/setup/js/pre_create_pull_request.cjs
+++ b/actions/setup/js/pre_create_pull_request.cjs
@@ -10,6 +10,16 @@ const { applyTitlePrefix, sanitizeTitle } = require("./sanitize_title.cjs");
const WIP_TITLE_MARKER = "[WIP] ";
const MAX_PULL_REQUEST_TITLE_LENGTH = 256;
const MAX_PRE_CREATED_TITLE_BODY_LENGTH = MAX_PULL_REQUEST_TITLE_LENGTH - WIP_TITLE_MARKER.length;
+const DEFAULT_PRE_CREATED_PULL_REQUEST_BRANCH_PREFIX = "gh-aw/pre-created/";
+
+function getPreCreatedPullRequestBranchPrefix() {
+ const branchPrefix = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH_PREFIX || DEFAULT_PRE_CREATED_PULL_REQUEST_BRANCH_PREFIX;
+ const normalizedBranchPrefix = normalizeBranchName(branchPrefix);
+ if (!normalizedBranchPrefix || normalizedBranchPrefix !== branchPrefix) {
+ throw new Error(`Invalid pre-created pull request branch prefix: "${branchPrefix}"`);
+ }
+ return branchPrefix;
+}
/**
* Best-effort deletion of a pre-allocated branch so a failed allocation does not
@@ -32,7 +42,7 @@ async function deleteBranch(branch) {
async function main() {
const workflowName = process.env.GH_AW_WORKFLOW_NAME || context.workflow || "Agentic workflow";
const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
- const branch = `gh-aw/pre-created/${context.runId}-${process.env.GITHUB_RUN_ATTEMPT || "1"}`;
+ const branch = `${getPreCreatedPullRequestBranchPrefix()}${context.runId}-${process.env.GITHUB_RUN_ATTEMPT || "1"}`;
// Resolve the base branch the eventual pull request will target (configured base-branch,
// otherwise the event-derived branch) so the pre-created branch is forked from the same
diff --git a/actions/setup/js/pre_create_pull_request.test.cjs b/actions/setup/js/pre_create_pull_request.test.cjs
index b38e688a2b9..89b2be6aec9 100644
--- a/actions/setup/js/pre_create_pull_request.test.cjs
+++ b/actions/setup/js/pre_create_pull_request.test.cjs
@@ -53,6 +53,7 @@ describe("pre_create_pull_request", () => {
process.env.GITHUB_RUN_ATTEMPT = "2";
delete process.env.GH_AW_CUSTOM_BASE_BRANCH;
delete process.env.GH_AW_PR_TITLE_PREFIX;
+ delete process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH_PREFIX;
delete process.env.GITHUB_BASE_REF;
});
@@ -112,6 +113,32 @@ describe("pre_create_pull_request", () => {
);
});
+ it("uses the configured branch prefix", async () => {
+ process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH_PREFIX = "signed/";
+ const { main } = await import("./pre_create_pull_request.cjs");
+ await main();
+
+ expect(global.github.rest.git.createRef).toHaveBeenCalledWith(
+ expect.objectContaining({
+ ref: "refs/heads/signed/123-2",
+ })
+ );
+ expect(global.github.rest.pulls.create).toHaveBeenCalledWith(
+ expect.objectContaining({
+ head: "signed/123-2",
+ })
+ );
+ expect(global.core.setOutput).toHaveBeenCalledWith("branch", "signed/123-2");
+ });
+
+ it("rejects invalid configured branch prefixes", async () => {
+ process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH_PREFIX = "bad prefix/";
+ const { main } = await import("./pre_create_pull_request.cjs");
+
+ await expect(main()).rejects.toThrow(/Invalid pre-created pull request branch prefix/);
+ expect(global.github.rest.git.createRef).not.toHaveBeenCalled();
+ });
+
it("sanitizes and truncates the fully assembled title after applying the WIP marker and prefix", async () => {
process.env.GH_AW_PR_TITLE_PREFIX = "[bot] @team ";
process.env.GH_AW_WORKFLOW_NAME = "A".repeat(300);
diff --git a/docs/src/content/docs/reference/frontmatter-full.md b/docs/src/content/docs/reference/frontmatter-full.md
index 7527f13adbe..5a7656f38d6 100644
--- a/docs/src/content/docs/reference/frontmatter-full.md
+++ b/docs/src/content/docs/reference/frontmatter-full.md
@@ -8866,7 +8866,9 @@ safe-outputs:
max: "example-value"
# Optional prefix to prepend to the pull request branch name (e.g. "signed/").
- # Applied before the agent-specified or auto-generated branch name.
+ # Applied before the agent-specified or auto-generated branch name. In steer
+ # mode, this prefix is also used for the workflow-owned pre-created pull request
+ # branch and must be a static valid branch-name prefix.
# (optional)
branch-prefix: "example-value"
diff --git a/docs/src/content/docs/reference/safe-outputs-pull-requests.md b/docs/src/content/docs/reference/safe-outputs-pull-requests.md
index 56d08a39e69..b643ad6eb82 100644
--- a/docs/src/content/docs/reference/safe-outputs-pull-requests.md
+++ b/docs/src/content/docs/reference/safe-outputs-pull-requests.md
@@ -80,9 +80,9 @@ safe-outputs:
steer: true
```
-Pre-creation requires a safe-output token with `contents: write`, `pull-requests: write`, and `checks: write`. It supports one same-repository PR per run and cannot be combined with `target-repo`, `head-repo`, `allowed-repos`, `branch-prefix`, `allowed-branches`, `allowed-base-branches`, or `checkout: false`. In [staged mode](/gh-aw/reference/safe-outputs/#staged-mode) no pull request is allocated, because staged runs must not perform API side effects. The allocated pull request is always opened as a draft, regardless of the `draft` setting; when `draft: false` is configured, it is marked ready for review in the safe output phase, once the agent's changes are applied.
+Pre-creation requires a safe-output token with `contents: write`, `pull-requests: write`, and `checks: write`. It supports one same-repository PR per run and cannot be combined with `target-repo`, `head-repo`, `allowed-repos`, `allowed-branches`, `allowed-base-branches`, or `checkout: false`. In [staged mode](/gh-aw/reference/safe-outputs/#staged-mode) no pull request is allocated, because staged runs must not perform API side effects. The allocated pull request is always opened as a draft, regardless of the `draft` setting; when `draft: false` is configured, it is marked ready for review in the safe output phase, once the agent's changes are applied.
-For security, pre-created pull request mode is limited to same-repository operation. The pre-created branch name is derived from trusted workflow run metadata and has the form `gh-aw/pre-created/-` in generated workflows. Downstream jobs must not treat an arbitrary activation output as a trusted checkout ref.
+For security, pre-created pull request mode is limited to same-repository operation. The pre-created branch name is derived from a static workflow-configured `branch-prefix` plus trusted workflow run metadata. By default, generated workflows use `gh-aw/pre-created/-`; with `branch-prefix: "signed/"`, they use `signed/-`. The prefix must be a static valid branch-name prefix, not a GitHub Actions expression. Downstream jobs must not treat an arbitrary activation output as a trusted checkout ref.
### Branch targeting
diff --git a/docs/src/content/docs/specs/safe-outputs-specification.md b/docs/src/content/docs/specs/safe-outputs-specification.md
index c9daf95ed0f..4c86dea7b63 100644
--- a/docs/src/content/docs/specs/safe-outputs-specification.md
+++ b/docs/src/content/docs/specs/safe-outputs-specification.md
@@ -79,7 +79,7 @@ This specification uses the following terms with precise definitions:
**Pre-created Pull Request**: A draft pull request allocated during the activation phase before agent execution when `safe-outputs.create-pull-request.steer` is enabled.
-**Workflow-Owned Pre-created Branch**: The deterministic branch ref allocated by the workflow for a pre-created pull request. In the reference implementation this ref has the form `gh-aw/pre-created/-` and is derived only from trusted GitHub Actions run metadata.
+**Workflow-Owned Pre-created Branch**: The deterministic branch ref allocated by the workflow for a pre-created pull request. In the reference implementation this ref has the default form `gh-aw/pre-created/-` and MAY use a static workflow-configured branch prefix. The non-prefix suffix is derived only from trusted GitHub Actions run metadata.
---
@@ -403,7 +403,7 @@ Agent execution context MUST NOT gain access to safe output job credentials thro
**Requirement AR5: Pre-created Pull Request Branch Provenance**
-When an implementation supports pre-created pull requests, it MUST derive the pre-created branch name from trusted workflow-controlled state. The branch ref MUST be deterministic for the workflow run and MUST NOT be selected from agent-controlled content, pull request comments, event payload branch names, or unvalidated activation outputs.
+When an implementation supports pre-created pull requests, it MUST derive the pre-created branch name from trusted workflow-controlled state. The branch ref MUST be deterministic for the workflow run and MUST NOT be selected from agent-controlled content, pull request comments, event payload branch names, or unvalidated activation outputs. Implementations MAY allow a static workflow-configured branch prefix; that prefix MUST NOT be derived from runtime expressions or attacker-influenced inputs.
After creating a pre-created pull request and before exporting branch or pull request metadata to downstream jobs, the activation phase MUST validate all of the following:
@@ -2473,7 +2473,7 @@ safe-outputs:
- `head-github-app`: Optional GitHub App configuration to mint an ephemeral credential for `head-repo` branch writes at runtime. When `head-github-app` is configured, the minted token takes precedence over `head-github-token`. The app installation MUST have `contents: write` on `head-repo`
- `preserve-branch-name`: When `true`, use the agent-supplied branch name verbatim without appending a random salt suffix (default: `false`)
- `recreate-ref`: When `true` (and `preserve-branch-name: true`), allows the handler to force-delete an existing remote branch ref and recreate it from the agent's local HEAD on collision. When `false` (default), an existing remote branch under `preserve-branch-name: true` causes a fallback rather than overwriting the remote ref. Has no effect when `preserve-branch-name: false`. (default: `false`)
-- `steer`: Experimental. When `true`, pre-creates a same-repository draft pull request during activation and allows the agent to read user-authored pull request comments as steering feedback. This mode requires `max: 1`, the default workflow-repository checkout, and a statically knowable base branch; it MUST NOT be combined with `target-repo`, `head-repo`, `allowed-repos`, `branch-prefix`, `allowed-branches`, `allowed-base-branches`, `checkout: false`, or expression-valued staged mode.
+- `steer`: Experimental. When `true`, pre-creates a same-repository draft pull request during activation and allows the agent to read user-authored pull request comments as steering feedback. This mode requires `max: 1`, the default workflow-repository checkout, and a statically knowable base branch; it MUST NOT be combined with `target-repo`, `head-repo`, `allowed-repos`, `allowed-branches`, `allowed-base-branches`, `checkout: false`, or expression-valued staged mode. If `branch-prefix` is configured, it MUST be a static valid branch-name prefix.
**Security Requirements**:
@@ -2486,6 +2486,7 @@ safe-outputs:
- Pre-created pull request branches MUST be validated against the expected workflow-owned branch ref before any downstream privileged checkout or pull request update uses the pre-created pull request metadata.
- Agent and safe-output checkout steps in pre-created pull request mode MUST use the deterministic workflow-owned branch ref directly and MUST NOT use an activation output as the checkout ref.
- Pre-created pull request validation MUST confirm that both the head repository and base repository are the workflow repository; fork-backed or cross-repository pre-created pull requests are non-conforming.
+- If a pre-created pull request branch prefix is configurable, the configured prefix MUST be static workflow-controlled configuration and MUST NOT be a runtime expression or selected from attacker-influenced input.
**Required Permissions**:
diff --git a/pkg/parser/schemas/main_workflow_schema.json b/pkg/parser/schemas/main_workflow_schema.json
index a12f33ce937..acce11d1b7d 100644
--- a/pkg/parser/schemas/main_workflow_schema.json
+++ b/pkg/parser/schemas/main_workflow_schema.json
@@ -7471,7 +7471,7 @@
},
"branch-prefix": {
"type": "string",
- "description": "Optional prefix to prepend to the pull request branch name (e.g. \"signed/\"). Applied before the agent-specified or auto-generated branch name."
+ "description": "Optional prefix to prepend to the pull request branch name (e.g. \"signed/\"). Applied before the agent-specified or auto-generated branch name. In steer mode, this prefix is also used for the workflow-owned pre-created pull request branch and must be a static valid branch-name prefix."
},
"require-temporary-id": {
"type": "boolean",
diff --git a/pkg/workflow/compiler_precreate_pull_request.go b/pkg/workflow/compiler_precreate_pull_request.go
index dbf3a121e66..b7389492286 100644
--- a/pkg/workflow/compiler_precreate_pull_request.go
+++ b/pkg/workflow/compiler_precreate_pull_request.go
@@ -3,9 +3,17 @@ package workflow
import "fmt"
const preCreatePullRequestAppTokenStepID = "pre-create-pull-request-app-token"
+const defaultPreCreatedPullRequestBranchPrefix = "gh-aw/pre-created/"
-func preCreatedPullRequestBranchRef() string {
- return "gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}"
+func preCreatedPullRequestBranchPrefix(data *WorkflowData) string {
+ if data != nil && data.SafeOutputs != nil && data.SafeOutputs.CreatePullRequests != nil && data.SafeOutputs.CreatePullRequests.BranchPrefix != "" {
+ return data.SafeOutputs.CreatePullRequests.BranchPrefix
+ }
+ return defaultPreCreatedPullRequestBranchPrefix
+}
+
+func preCreatedPullRequestBranchRef(data *WorkflowData) string {
+ return preCreatedPullRequestBranchPrefix(data) + "${{ github.run_id }}-${{ github.run_attempt }}"
}
func isPreCreatePullRequestEnabled(data *WorkflowData) bool {
@@ -92,6 +100,9 @@ func (c *Compiler) addActivationPreCreatePullRequestStep(ctx *activationJobBuild
if titlePrefix := ctx.data.SafeOutputs.CreatePullRequests.TitlePrefix; titlePrefix != "" {
ctx.steps = append(ctx.steps, fmt.Sprintf(" GH_AW_PR_TITLE_PREFIX: %q\n", titlePrefix))
}
+ if branchPrefix := ctx.data.SafeOutputs.CreatePullRequests.BranchPrefix; branchPrefix != "" {
+ ctx.steps = append(ctx.steps, fmt.Sprintf(" GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH_PREFIX: %q\n", branchPrefix))
+ }
ctx.steps = append(ctx.steps,
" with:\n",
fmt.Sprintf(" github-token: %s\n", token),
@@ -105,7 +116,7 @@ func (c *Compiler) addActivationPreCreatePullRequestStep(ctx *activationJobBuild
" env:\n",
" GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}\n",
" GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}\n",
- fmt.Sprintf(" GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: %s\n", preCreatedPullRequestBranchRef()),
+ fmt.Sprintf(" GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: %s\n", preCreatedPullRequestBranchRef(ctx.data)),
" with:\n",
fmt.Sprintf(" github-token: %s\n", token),
" script: |\n",
diff --git a/pkg/workflow/compiler_precreate_pull_request_integration_test.go b/pkg/workflow/compiler_precreate_pull_request_integration_test.go
index a88af576c0b..f40ca5183f3 100644
--- a/pkg/workflow/compiler_precreate_pull_request_integration_test.go
+++ b/pkg/workflow/compiler_precreate_pull_request_integration_test.go
@@ -26,6 +26,7 @@ permissions:
safe-outputs:
create-pull-request:
steer: true
+ branch-prefix: "signed/"
---
# Pre-create test
@@ -48,11 +49,13 @@ Create a change and open a pull request.
assert.Contains(t, activation, "id: pre-create-pull-request")
assert.Contains(t, activation, "id: validate-pre-created-pull-request")
+ assert.Contains(t, activation, `GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH_PREFIX: "signed/"`)
+ assert.Contains(t, activation, "GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: signed/${{ github.run_id }}-${{ github.run_attempt }}")
assert.Contains(t, activation, "contents: write")
assert.Contains(t, activation, "pull-requests: write")
assert.Contains(t, activation, "checks: write")
- assert.Contains(t, agent, "ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}")
- assert.Contains(t, safeOutputs, "ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}")
+ assert.Contains(t, agent, "ref: signed/${{ github.run_id }}-${{ github.run_attempt }}")
+ assert.Contains(t, safeOutputs, "ref: signed/${{ github.run_id }}-${{ github.run_attempt }}")
assert.NotContains(t, agent, "ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}")
assert.NotContains(t, safeOutputs, "ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}")
assert.Contains(t, safeOutputs, "pre_created_pull_request_number")
diff --git a/pkg/workflow/compiler_precreate_pull_request_test.go b/pkg/workflow/compiler_precreate_pull_request_test.go
index d672dc31a1d..8668e798733 100644
--- a/pkg/workflow/compiler_precreate_pull_request_test.go
+++ b/pkg/workflow/compiler_precreate_pull_request_test.go
@@ -78,7 +78,7 @@ func TestBuildConclusionJobPassesNoOpCommentToPreCreatedCheck(t *testing.T) {
func TestPreCreatePullRequestCheckoutOverride(t *testing.T) {
manager := NewCheckoutManager(nil)
- manager.SetDefaultRefOverride(preCreatedPullRequestBranchRef())
+ manager.SetDefaultRefOverride(preCreatedPullRequestBranchRef(nil))
steps := strings.Join(manager.GenerateDefaultCheckoutStep(false, "", func(action string) string {
return action + "@sha"
@@ -87,6 +87,20 @@ func TestPreCreatePullRequestCheckoutOverride(t *testing.T) {
assert.Contains(t, steps, "ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}")
}
+func TestPreCreatePullRequestCheckoutOverrideUsesConfiguredBranchPrefix(t *testing.T) {
+ data := &WorkflowData{SafeOutputs: &SafeOutputsConfig{
+ CreatePullRequests: &CreatePullRequestsConfig{Steer: true, BranchPrefix: "signed/"},
+ }}
+ manager := NewCheckoutManager(nil)
+ manager.SetDefaultRefOverride(preCreatedPullRequestBranchRef(data))
+
+ steps := strings.Join(manager.GenerateDefaultCheckoutStep(false, "", func(action string) string {
+ return action + "@sha"
+ }), "")
+
+ assert.Contains(t, steps, "ref: signed/${{ github.run_id }}-${{ github.run_attempt }}")
+}
+
func TestValidatePreCreatePullRequest(t *testing.T) {
invalidMax := "2"
tests := []struct {
@@ -139,6 +153,26 @@ func TestValidatePreCreatePullRequest(t *testing.T) {
}},
wantErr: "allowed-base-branches",
},
+ {
+ name: "branch prefix",
+ data: &WorkflowData{SafeOutputs: &SafeOutputsConfig{
+ CreatePullRequests: &CreatePullRequestsConfig{Steer: true, BranchPrefix: "signed/"},
+ }},
+ },
+ {
+ name: "expression branch prefix",
+ data: &WorkflowData{SafeOutputs: &SafeOutputsConfig{
+ CreatePullRequests: &CreatePullRequestsConfig{Steer: true, BranchPrefix: "${{ inputs.branch_prefix }}"},
+ }},
+ wantErr: "requires branch-prefix to be a static string",
+ },
+ {
+ name: "invalid branch prefix",
+ data: &WorkflowData{SafeOutputs: &SafeOutputsConfig{
+ CreatePullRequests: &CreatePullRequestsConfig{Steer: true, BranchPrefix: "bad prefix/"},
+ }},
+ wantErr: "branch-prefix must be a valid git branch prefix",
+ },
{
name: "cross repository",
data: &WorkflowData{SafeOutputs: &SafeOutputsConfig{
@@ -290,6 +324,24 @@ func TestActivationPreCreateStepPassesConfiguredTitlePrefix(t *testing.T) {
assert.Contains(t, steps, `GH_AW_PR_TITLE_PREFIX: "[bot] "`)
}
+func TestActivationPreCreateStepPassesConfiguredBranchPrefix(t *testing.T) {
+ compiler := NewCompiler()
+ data := &WorkflowData{
+ Name: "Pre-create test",
+ MarkdownContent: "# Test",
+ SafeOutputs: &SafeOutputsConfig{
+ CreatePullRequests: &CreatePullRequestsConfig{Steer: true, BranchPrefix: "signed/"},
+ },
+ }
+
+ job, err := compiler.buildActivationJob(data, false, "", "test.lock.yml")
+ require.NoError(t, err)
+
+ steps := strings.Join(job.Steps, "")
+ assert.Contains(t, steps, `GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH_PREFIX: "signed/"`)
+ assert.Contains(t, steps, "GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: signed/${{ github.run_id }}-${{ github.run_attempt }}")
+}
+
func TestActivationPreCreateStepOmitsEmptyTitlePrefix(t *testing.T) {
compiler := NewCompiler()
data := &WorkflowData{
diff --git a/pkg/workflow/compiler_safe_outputs_steps.go b/pkg/workflow/compiler_safe_outputs_steps.go
index 3839fc7941e..dd2313a3e37 100644
--- a/pkg/workflow/compiler_safe_outputs_steps.go
+++ b/pkg/workflow/compiler_safe_outputs_steps.go
@@ -35,7 +35,7 @@ func (c *Compiler) buildSharedPRCheckoutSteps(data *WorkflowData) []string {
// Build the same CheckoutManager the agent job builds from the workflow's checkout: config.
checkoutMgr := NewCheckoutManager(data.CheckoutConfigs)
if isPreCreatePullRequestEnabled(data) {
- checkoutMgr.SetDefaultRefOverride(preCreatedPullRequestBranchRef())
+ checkoutMgr.SetDefaultRefOverride(preCreatedPullRequestBranchRef(data))
}
// Unlike the agent job, the safe_outputs job performs git fetch/push against the
diff --git a/pkg/workflow/compiler_yaml_checkout.go b/pkg/workflow/compiler_yaml_checkout.go
index 6a2f83ee002..1f389c4b6e3 100644
--- a/pkg/workflow/compiler_yaml_checkout.go
+++ b/pkg/workflow/compiler_yaml_checkout.go
@@ -39,7 +39,7 @@ func (c *Compiler) generateInitialAndCheckoutSteps(yaml *strings.Builder, data *
// Build a CheckoutManager with any user-configured checkouts
checkoutMgr := NewCheckoutManager(data.CheckoutConfigs)
if isPreCreatePullRequestEnabled(data) {
- checkoutMgr.SetDefaultRefOverride(preCreatedPullRequestBranchRef())
+ checkoutMgr.SetDefaultRefOverride(preCreatedPullRequestBranchRef(data))
}
// Propagate the platform (host) repo resolved by the activation job so that
diff --git a/pkg/workflow/create_pull_request.go b/pkg/workflow/create_pull_request.go
index 3760b173bc0..0cf31349091 100644
--- a/pkg/workflow/create_pull_request.go
+++ b/pkg/workflow/create_pull_request.go
@@ -2,7 +2,9 @@ package workflow
import (
"errors"
+ "fmt"
"strconv"
+ "strings"
"github.com/github/gh-aw/pkg/logger"
)
@@ -69,8 +71,11 @@ func validatePreCreatePullRequest(data *WorkflowData) error {
if config.TargetRepoSlug != "" || config.HeadRepoSlug != "" || len(config.AllowedRepos) > 0 {
return errors.New("safe-outputs.create-pull-request.steer only supports pull requests in the workflow repository")
}
- if config.BranchPrefix != "" || len(config.AllowedBranches) > 0 {
- return errors.New("safe-outputs.create-pull-request.steer cannot be combined with branch-prefix or allowed-branches")
+ if err := validatePreCreatedPullRequestBranchPrefix(config.BranchPrefix); err != nil {
+ return err
+ }
+ if len(config.AllowedBranches) > 0 {
+ return errors.New("safe-outputs.create-pull-request.steer cannot be combined with allowed-branches")
}
if len(config.AllowedBaseBranches) > 0 {
return errors.New("safe-outputs.create-pull-request.steer cannot be combined with allowed-base-branches because the base branch must be known when the pull request is allocated")
@@ -82,6 +87,56 @@ func validatePreCreatePullRequest(data *WorkflowData) error {
return nil
}
+func validatePreCreatedPullRequestBranchPrefix(prefix string) error {
+ if prefix == "" {
+ return nil
+ }
+ if isExpression(prefix) {
+ return errors.New("safe-outputs.create-pull-request.steer requires branch-prefix to be a static string")
+ }
+ normalized := normalizePreCreatedPullRequestBranchPrefix(prefix)
+ if normalized != prefix || normalized == "" {
+ return fmt.Errorf("safe-outputs.create-pull-request.steer branch-prefix must be a valid git branch prefix; normalized form would be %q", normalized)
+ }
+ return nil
+}
+
+func normalizePreCreatedPullRequestBranchPrefix(prefix string) string {
+ if prefix == "" || strings.TrimSpace(prefix) == "" {
+ return prefix
+ }
+
+ var builder strings.Builder
+ lastDash := false
+ for _, r := range prefix {
+ valid := (r >= 'a' && r <= 'z') ||
+ (r >= 'A' && r <= 'Z') ||
+ (r >= '0' && r <= '9') ||
+ r == '-' ||
+ r == '_' ||
+ r == '/' ||
+ r == '.'
+ if !valid {
+ if !lastDash {
+ builder.WriteByte('-')
+ lastDash = true
+ }
+ continue
+ }
+ if r == '-' && lastDash {
+ continue
+ }
+ builder.WriteRune(r)
+ lastDash = r == '-'
+ }
+
+ normalized := strings.Trim(builder.String(), "-")
+ if len(normalized) > 128 {
+ normalized = normalized[:128]
+ }
+ return strings.TrimRight(normalized, "-")
+}
+
// isPreCreatePullRequestConfigured reports whether the workflow should allocate
// a pull request during activation. steer is the only way to enable pre-creation;
// it pre-creates a draft pull request and lets the agent read feedback from it.
From eea280c722dd4a20dfeb7e4a76df9a6d0a2c9e38 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 24 Aug 2026 21:07:11 +0000
Subject: [PATCH 09/14] Harden precreated branch prefix validation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
actions/setup/js/pre_create_pull_request.cjs | 2 +-
actions/setup/js/pre_create_pull_request.test.cjs | 8 ++++++++
pkg/workflow/compiler_precreate_pull_request_test.go | 7 +++++++
pkg/workflow/create_pull_request.go | 11 +++++++----
4 files changed, 23 insertions(+), 5 deletions(-)
diff --git a/actions/setup/js/pre_create_pull_request.cjs b/actions/setup/js/pre_create_pull_request.cjs
index 3fb59e5620c..aea2db5d2b7 100644
--- a/actions/setup/js/pre_create_pull_request.cjs
+++ b/actions/setup/js/pre_create_pull_request.cjs
@@ -15,7 +15,7 @@ const DEFAULT_PRE_CREATED_PULL_REQUEST_BRANCH_PREFIX = "gh-aw/pre-created/";
function getPreCreatedPullRequestBranchPrefix() {
const branchPrefix = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH_PREFIX || DEFAULT_PRE_CREATED_PULL_REQUEST_BRANCH_PREFIX;
const normalizedBranchPrefix = normalizeBranchName(branchPrefix);
- if (!normalizedBranchPrefix || normalizedBranchPrefix !== branchPrefix) {
+ if (!normalizedBranchPrefix || branchPrefix.trim() === "" || normalizedBranchPrefix !== branchPrefix) {
throw new Error(`Invalid pre-created pull request branch prefix: "${branchPrefix}"`);
}
return branchPrefix;
diff --git a/actions/setup/js/pre_create_pull_request.test.cjs b/actions/setup/js/pre_create_pull_request.test.cjs
index 89b2be6aec9..01a5029df9c 100644
--- a/actions/setup/js/pre_create_pull_request.test.cjs
+++ b/actions/setup/js/pre_create_pull_request.test.cjs
@@ -139,6 +139,14 @@ describe("pre_create_pull_request", () => {
expect(global.github.rest.git.createRef).not.toHaveBeenCalled();
});
+ it("rejects whitespace-only configured branch prefixes", async () => {
+ process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH_PREFIX = " ";
+ const { main } = await import("./pre_create_pull_request.cjs");
+
+ await expect(main()).rejects.toThrow(/Invalid pre-created pull request branch prefix/);
+ expect(global.github.rest.git.createRef).not.toHaveBeenCalled();
+ });
+
it("sanitizes and truncates the fully assembled title after applying the WIP marker and prefix", async () => {
process.env.GH_AW_PR_TITLE_PREFIX = "[bot] @team ";
process.env.GH_AW_WORKFLOW_NAME = "A".repeat(300);
diff --git a/pkg/workflow/compiler_precreate_pull_request_test.go b/pkg/workflow/compiler_precreate_pull_request_test.go
index 8668e798733..f6d534eab93 100644
--- a/pkg/workflow/compiler_precreate_pull_request_test.go
+++ b/pkg/workflow/compiler_precreate_pull_request_test.go
@@ -173,6 +173,13 @@ func TestValidatePreCreatePullRequest(t *testing.T) {
}},
wantErr: "branch-prefix must be a valid git branch prefix",
},
+ {
+ name: "whitespace branch prefix",
+ data: &WorkflowData{SafeOutputs: &SafeOutputsConfig{
+ CreatePullRequests: &CreatePullRequestsConfig{Steer: true, BranchPrefix: " "},
+ }},
+ wantErr: "branch-prefix must be a valid git branch prefix",
+ },
{
name: "cross repository",
data: &WorkflowData{SafeOutputs: &SafeOutputsConfig{
diff --git a/pkg/workflow/create_pull_request.go b/pkg/workflow/create_pull_request.go
index 0cf31349091..0f716a58c7e 100644
--- a/pkg/workflow/create_pull_request.go
+++ b/pkg/workflow/create_pull_request.go
@@ -102,13 +102,19 @@ func validatePreCreatedPullRequestBranchPrefix(prefix string) error {
}
func normalizePreCreatedPullRequestBranchPrefix(prefix string) string {
- if prefix == "" || strings.TrimSpace(prefix) == "" {
+ if prefix == "" {
return prefix
}
+ if strings.TrimSpace(prefix) == "" {
+ return ""
+ }
var builder strings.Builder
lastDash := false
for _, r := range prefix {
+ if builder.Len() >= 128 {
+ continue
+ }
valid := (r >= 'a' && r <= 'z') ||
(r >= 'A' && r <= 'Z') ||
(r >= '0' && r <= '9') ||
@@ -131,9 +137,6 @@ func normalizePreCreatedPullRequestBranchPrefix(prefix string) string {
}
normalized := strings.Trim(builder.String(), "-")
- if len(normalized) > 128 {
- normalized = normalized[:128]
- }
return strings.TrimRight(normalized, "-")
}
From 155e646cc6aa1fd6bea4641cad17b6339e3842e9 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 24 Aug 2026 21:09:15 +0000
Subject: [PATCH 10/14] Clean precreated branch prefix normalizer
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
pkg/workflow/create_pull_request.go | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/pkg/workflow/create_pull_request.go b/pkg/workflow/create_pull_request.go
index 0f716a58c7e..6f7501fcd9d 100644
--- a/pkg/workflow/create_pull_request.go
+++ b/pkg/workflow/create_pull_request.go
@@ -136,8 +136,7 @@ func normalizePreCreatedPullRequestBranchPrefix(prefix string) string {
lastDash = r == '-'
}
- normalized := strings.Trim(builder.String(), "-")
- return strings.TrimRight(normalized, "-")
+ return strings.Trim(builder.String(), "-")
}
// isPreCreatePullRequestConfigured reports whether the workflow should allocate
From dd91e62d88f99db27a90c665fcda184d89e52e32 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 24 Aug 2026 21:11:33 +0000
Subject: [PATCH 11/14] Clarify precreated prefix validation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
pkg/workflow/compiler_precreate_pull_request_test.go | 2 +-
pkg/workflow/create_pull_request.go | 7 +++++--
2 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/pkg/workflow/compiler_precreate_pull_request_test.go b/pkg/workflow/compiler_precreate_pull_request_test.go
index f6d534eab93..77f0c2d7898 100644
--- a/pkg/workflow/compiler_precreate_pull_request_test.go
+++ b/pkg/workflow/compiler_precreate_pull_request_test.go
@@ -178,7 +178,7 @@ func TestValidatePreCreatePullRequest(t *testing.T) {
data: &WorkflowData{SafeOutputs: &SafeOutputsConfig{
CreatePullRequests: &CreatePullRequestsConfig{Steer: true, BranchPrefix: " "},
}},
- wantErr: "branch-prefix must be a valid git branch prefix",
+ wantErr: "branch-prefix must contain valid git branch prefix characters",
},
{
name: "cross repository",
diff --git a/pkg/workflow/create_pull_request.go b/pkg/workflow/create_pull_request.go
index 6f7501fcd9d..3f025a1c63c 100644
--- a/pkg/workflow/create_pull_request.go
+++ b/pkg/workflow/create_pull_request.go
@@ -95,7 +95,10 @@ func validatePreCreatedPullRequestBranchPrefix(prefix string) error {
return errors.New("safe-outputs.create-pull-request.steer requires branch-prefix to be a static string")
}
normalized := normalizePreCreatedPullRequestBranchPrefix(prefix)
- if normalized != prefix || normalized == "" {
+ if normalized == "" {
+ return errors.New("safe-outputs.create-pull-request.steer branch-prefix must contain valid git branch prefix characters")
+ }
+ if normalized != prefix {
return fmt.Errorf("safe-outputs.create-pull-request.steer branch-prefix must be a valid git branch prefix; normalized form would be %q", normalized)
}
return nil
@@ -113,7 +116,7 @@ func normalizePreCreatedPullRequestBranchPrefix(prefix string) string {
lastDash := false
for _, r := range prefix {
if builder.Len() >= 128 {
- continue
+ break
}
valid := (r >= 'a' && r <= 'z') ||
(r >= 'A' && r <= 'Z') ||
From 281333ef470739792b1f20e12691845e8db84287 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 24 Aug 2026 21:13:53 +0000
Subject: [PATCH 12/14] Name precreated prefix length limit
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
pkg/workflow/create_pull_request.go | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/pkg/workflow/create_pull_request.go b/pkg/workflow/create_pull_request.go
index 3f025a1c63c..ce33e652456 100644
--- a/pkg/workflow/create_pull_request.go
+++ b/pkg/workflow/create_pull_request.go
@@ -11,6 +11,10 @@ import (
var createPRLog = logger.New("workflow:create_pull_request")
+// Matches actions/setup/js/normalize_branch_name.cjs so pre-created branch prefix
+// validation and runtime branch construction agree.
+const maxPreCreatedPullRequestBranchPrefixLength = 128
+
var createPRStringOrArrayFields = []string{"reviewers", "team-reviewers", "assignees"}
var createPRExpressionArrayFields = []string{"labels", "allowed-repos", "allowed-base-branches", "allowed-branches"}
@@ -115,7 +119,7 @@ func normalizePreCreatedPullRequestBranchPrefix(prefix string) string {
var builder strings.Builder
lastDash := false
for _, r := range prefix {
- if builder.Len() >= 128 {
+ if builder.Len() >= maxPreCreatedPullRequestBranchPrefixLength {
break
}
valid := (r >= 'a' && r <= 'z') ||
From 1c25d852864c99e2d0b8fbe13f589dd98e1aa1d5 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 24 Aug 2026 22:04:22 +0000
Subject: [PATCH 13/14] Harden pre-created PR validation
Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
---
.../js/validate_pre_created_pull_request.cjs | 8 +++-
...validate_pre_created_pull_request.test.cjs | 4 +-
.../compiler_precreate_pull_request_test.go | 39 +++++++++++++++++++
pkg/workflow/create_pull_request.go | 21 ++++++++++
4 files changed, 68 insertions(+), 4 deletions(-)
diff --git a/actions/setup/js/validate_pre_created_pull_request.cjs b/actions/setup/js/validate_pre_created_pull_request.cjs
index 12f5ffde1b3..7597c37aa3d 100644
--- a/actions/setup/js/validate_pre_created_pull_request.cjs
+++ b/actions/setup/js/validate_pre_created_pull_request.cjs
@@ -8,8 +8,12 @@ async function main() {
throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
}
- const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
- if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+ const pullNumberString = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "";
+ if (!/^[1-9]\d*$/.test(pullNumberString)) {
+ throw new Error("Pre-created pull request number is invalid");
+ }
+ const pullNumber = Number(pullNumberString);
+ if (!Number.isSafeInteger(pullNumber)) {
throw new Error("Pre-created pull request number is invalid");
}
diff --git a/actions/setup/js/validate_pre_created_pull_request.test.cjs b/actions/setup/js/validate_pre_created_pull_request.test.cjs
index a9e691ebb90..536e8bbe76a 100644
--- a/actions/setup/js/validate_pre_created_pull_request.test.cjs
+++ b/actions/setup/js/validate_pre_created_pull_request.test.cjs
@@ -68,8 +68,8 @@ describe("validate_pre_created_pull_request", () => {
expect(global.core.setOutput).not.toHaveBeenCalled();
});
- it("rejects invalid pull request numbers", async () => {
- process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER = "0";
+ it.each(["0", "42junk", "42.0", "042"])("rejects invalid pull request number %s", async pullNumber => {
+ process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER = pullNumber;
const { main } = await import("./validate_pre_created_pull_request.cjs");
await expect(main()).rejects.toThrow(/pull request number is invalid/);
diff --git a/pkg/workflow/compiler_precreate_pull_request_test.go b/pkg/workflow/compiler_precreate_pull_request_test.go
index 77f0c2d7898..ccbbd413a59 100644
--- a/pkg/workflow/compiler_precreate_pull_request_test.go
+++ b/pkg/workflow/compiler_precreate_pull_request_test.go
@@ -180,6 +180,20 @@ func TestValidatePreCreatePullRequest(t *testing.T) {
}},
wantErr: "branch-prefix must contain valid git branch prefix characters",
},
+ {
+ name: "reserved ref branch prefix",
+ data: &WorkflowData{SafeOutputs: &SafeOutputsConfig{
+ CreatePullRequests: &CreatePullRequestsConfig{Steer: true, BranchPrefix: "refs/heads/"},
+ }},
+ wantErr: "branch-prefix must form a valid git branch ref",
+ },
+ {
+ name: "ambiguous branch prefix",
+ data: &WorkflowData{SafeOutputs: &SafeOutputsConfig{
+ CreatePullRequests: &CreatePullRequestsConfig{Steer: true, BranchPrefix: "foo//"},
+ }},
+ wantErr: "branch-prefix must form a valid git branch ref",
+ },
{
name: "cross repository",
data: &WorkflowData{SafeOutputs: &SafeOutputsConfig{
@@ -201,6 +215,31 @@ func TestValidatePreCreatePullRequest(t *testing.T) {
}
}
+func TestValidatePreCreatedPullRequestBranchPrefix(t *testing.T) {
+ tests := map[string]struct {
+ prefix string
+ wantErr bool
+ }{
+ "valid": {prefix: "signed/"},
+ "leading slash": {prefix: "/", wantErr: true},
+ "double slash": {prefix: "foo//", wantErr: true},
+ "double dot": {prefix: "..", wantErr: true},
+ "dot component": {prefix: ".foo/", wantErr: true},
+ "reserved ref": {prefix: "refs/heads/", wantErr: true},
+ "lock component": {prefix: "foo/.lock/", wantErr: true},
+ }
+
+ for name, tt := range tests {
+ t.Run(name, func(t *testing.T) {
+ if tt.wantErr {
+ require.Error(t, validatePreCreatedPullRequestBranchPrefix(tt.prefix))
+ } else {
+ require.NoError(t, validatePreCreatedPullRequestBranchPrefix(tt.prefix))
+ }
+ })
+ }
+}
+
func TestValidatePreCreatePullRequestSteerPermissions(t *testing.T) {
tests := []struct {
name string
diff --git a/pkg/workflow/create_pull_request.go b/pkg/workflow/create_pull_request.go
index ce33e652456..766b79c641b 100644
--- a/pkg/workflow/create_pull_request.go
+++ b/pkg/workflow/create_pull_request.go
@@ -105,9 +105,30 @@ func validatePreCreatedPullRequestBranchPrefix(prefix string) error {
if normalized != prefix {
return fmt.Errorf("safe-outputs.create-pull-request.steer branch-prefix must be a valid git branch prefix; normalized form would be %q", normalized)
}
+ if !isValidPreCreatedPullRequestBranch(prefix + "1-1") {
+ return errors.New("safe-outputs.create-pull-request.steer branch-prefix must form a valid git branch ref")
+ }
return nil
}
+func isValidPreCreatedPullRequestBranch(branch string) bool {
+ if branch == "" ||
+ strings.HasPrefix(branch, "refs/") ||
+ strings.HasPrefix(branch, "-") ||
+ strings.HasSuffix(branch, ".") ||
+ strings.Contains(branch, "//") ||
+ strings.Contains(branch, "..") ||
+ strings.Contains(branch, "@{") {
+ return false
+ }
+ for component := range strings.SplitSeq(branch, "/") {
+ if component == "" || strings.HasPrefix(component, ".") || strings.HasSuffix(component, ".lock") {
+ return false
+ }
+ }
+ return true
+}
+
func normalizePreCreatedPullRequestBranchPrefix(prefix string) string {
if prefix == "" {
return prefix
From 0e2fc401145efa4edf6790178a3395b671315166 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 24 Aug 2026 22:07:00 +0000
Subject: [PATCH 14/14] Fail closed on missing PR branch
Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
---
.../js/validate_pre_created_pull_request.cjs | 3 ++
...validate_pre_created_pull_request.test.cjs | 28 +++++++++++++++++++
2 files changed, 31 insertions(+)
diff --git a/actions/setup/js/validate_pre_created_pull_request.cjs b/actions/setup/js/validate_pre_created_pull_request.cjs
index 7597c37aa3d..10b0be9ee00 100644
--- a/actions/setup/js/validate_pre_created_pull_request.cjs
+++ b/actions/setup/js/validate_pre_created_pull_request.cjs
@@ -4,6 +4,9 @@
async function main() {
const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+ if (!expectedBranch) {
+ throw new Error("Expected pre-created pull request branch is not set");
+ }
if (branch !== expectedBranch) {
throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`);
}
diff --git a/actions/setup/js/validate_pre_created_pull_request.test.cjs b/actions/setup/js/validate_pre_created_pull_request.test.cjs
index 536e8bbe76a..b2e204c09cc 100644
--- a/actions/setup/js/validate_pre_created_pull_request.test.cjs
+++ b/actions/setup/js/validate_pre_created_pull_request.test.cjs
@@ -68,6 +68,16 @@ describe("validate_pre_created_pull_request", () => {
expect(global.core.setOutput).not.toHaveBeenCalled();
});
+ it("rejects a missing expected branch without fetching the pull request", async () => {
+ process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH = "";
+ process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH = "";
+ const { main } = await import("./validate_pre_created_pull_request.cjs");
+
+ await expect(main()).rejects.toThrow(/expected pre-created pull request branch is not set/i);
+ expect(global.github.rest.pulls.get).not.toHaveBeenCalled();
+ expect(global.core.setOutput).not.toHaveBeenCalled();
+ });
+
it.each(["0", "42junk", "42.0", "042"])("rejects invalid pull request number %s", async pullNumber => {
process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER = pullNumber;
const { main } = await import("./validate_pre_created_pull_request.cjs");
@@ -93,4 +103,22 @@ describe("validate_pre_created_pull_request", () => {
await expect(main()).rejects.toThrow(/does not target the expected trusted repository branch/);
expect(global.core.setOutput).not.toHaveBeenCalled();
});
+
+ it("rejects pull requests without a head repository", async () => {
+ global.github.rest.pulls.get.mockResolvedValue({
+ data: {
+ head: {
+ ref: "gh-aw/pre-created/123-2",
+ repo: null,
+ },
+ base: {
+ repo: { full_name: "owner/repo" },
+ },
+ },
+ });
+ const { main } = await import("./validate_pre_created_pull_request.cjs");
+
+ await expect(main()).rejects.toThrow(/does not target the expected trusted repository branch/);
+ expect(global.core.setOutput).not.toHaveBeenCalled();
+ });
});