Allow workflows to narrow safe-output item schemas by Copilot · Pull Request #63016 · github/gh-aw

Copilot · 2026-09-23T19:13:17Z

Safe-output tools exposed permissive built-in schemas even when workflows required stricter inputs. Invalid calls were therefore rejected only after agent execution, preventing retries and discarding otherwise valid output.

Schema configuration
- Add safe-outputs.add-labels.item-schema.
- Restrict custom schemas to compatible narrowing: object items, supported fields, added requirements, and reduced enum values.
Runtime enforcement
- Merge workflow constraints with the built-in label object schema.
- Use the resulting schema for both MCP tool definitions and call-time validation.
- Preserve built-in constraints such as rationale length limits and unknown-field rejection.
- Report workflow-specific required fields in validation errors.
Documentation
- Document item-schema narrowing.
- Clarify that remove_labels ignores rationale, confidence, and suggest.

safe-outputs:
  add-labels:
    allowed: [bug, enhancement]
    item-schema:
      type: object
      required: [name, confidence]
      additionalProperties: false
      properties:
        name: { type: string }
        confidence: { type: string, enum: [HIGH, MEDIUM, LOW] }
        suggest: { type: boolean }
        rationale: { type: string }

Fixes Allow workflows to narrow safe-output tool schemas (e.g. require per-item fields for add_labels) #62994

Warning

Firewall blocked 4 domains

The following domains were blocked by the firewall during workflow execution:

github.com
proxy.golang.org
registry.npmjs.org
storage.googleapis.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"
    - "proxy.golang.org"
    - "registry.npmjs.org"
    - "storage.googleapis.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 23.7 AIC · ⌖ 8.88 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Copilot review overview

🟡 Changes recommended

Nested rationale length constraints remain unenforced, and retry guidance can suggest payloads rejected by the configured schema.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 2

Open (2)

Nested maxLength constraints are not enforced during validation · New
Hard-coded example can violate the effective schema · New

What changed in this PR

Adds workflow-defined narrowing for add_labels item schemas across compilation, MCP tooling, validation, and documentation.

Changes:

Adds and validates add-labels.item-schema.
Merges workflow constraints into generated MCP schemas.
Improves validation guidance and documents structured label behavior.

File	Description
`pkg/workflow/safe_outputs_handler_registry_issues.go`	Serializes item schemas into handler configuration.
`pkg/workflow/add_labels.go`	Adds the item-schema configuration field.
`pkg/workflow/add_labels_item_schema_test.go`	Tests configuration extraction and serialization.
`pkg/parser/schemas/main_workflow_schema.json`	Defines allowed narrowing syntax.
`pkg/parser/schema_add_labels_item_schema_test.go`	Tests accepted and rejected schemas.
`docs/src/content/docs/reference/safe-outputs.md`	Documents item schemas and removal behavior.
`actions/setup/js/mcp_server_core.cjs`	Passes effective schemas to error formatting.
`actions/setup/js/mcp_scripts_validation.test.cjs`	Tests workflow-specific required fields.
`actions/setup/js/mcp_scripts_validation.cjs`	Formats schema-aware validation errors.
`actions/setup/js/generate_safe_outputs_tools.test.cjs`	Tests schema merging.
`actions/setup/js/generate_safe_outputs_tools.cjs`	Applies narrowed schemas to MCP tools.

+  for (const [name, propertySchema] of Object.entries(configuredProperties)) {
+    properties[name] = { ...(properties[name] ?? {}), ...propertySchema };


        `  ${error.path} must be an object (string shorthand is not supported).`,
        '  Expected: {"name":"bug","rationale":"Why this label applies","confidence":"HIGH"}',
-        "  Required fields: name, rationale, confidence",
+        `  Required fields: ${Array.isArray(requiredFields) ? requiredFields.join(", ") : "name, rationale, confidence"}`,


gh-aw-bot · 2026-09-23T20:03:43Z

@copilot Please move this PR forward.

Open review feedback remains from: copilot-pull-request-reviewer.

Please refresh the branch if needed, address the outstanding review comments, and run the pr-finisher skill before handing back for maintainer review.

Outstanding themes to finish:

enforce nested maxLength constraints during validation
keep schema-aware retry guidance/examples aligned with the effective narrowed schema

Generated by 👨🍳 PR Sous Chef

Warning

Firewall blocked 4 domains

The following domains were blocked by the firewall during workflow execution:

github.com
proxy.golang.org
registry.npmjs.org
storage.googleapis.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"
    - "proxy.golang.org"
    - "registry.npmjs.org"
    - "storage.googleapis.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 23.7 AIC · ⌖ 8.88 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-09-23T20:16:44Z

@copilot Please move this PR forward.

Open review feedback remains from: copilot-pull-request-reviewer....

Both outstanding review themes are addressed in dd15ff1:

validateSchemaNode now enforces string maxLength at any nesting depth, so an over-long labels[0].rationale is rejected at call time (retryable) instead of being truncated later by the handler.
The add_labels shorthand-retry guidance now derives its Expected: example from the effective item schema (schema-narrowed enum values, required booleans, etc.), so the suggested payload always satisfies the configured schema. The legacy example/required list is kept only as a fallback when no schema is supplied.

Tests added for nested maxLength enforcement and schema-derived example generation; make agent-report-progress passes.

@copilot Please move this PR forward.

Open review feedback remains from: copilot-pull-request-reviewer....

Correction: the commit hash is b529a8c (not dd15ff1).

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-09-23T20:57:48Z

Great work on enhancing safe-output schema validation! This PR looks ready for review. You've included comprehensive test coverage (4 test files), updated documentation, and the changes are tightly focused on schema narrowing and enforcement. The implementation properly merges workflow constraints with built-in schemas and validates both MCP tool definitions and runtime calls. Well done!

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

o205451.ingest.us.sentry.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "o205451.ingest.us.sentry.io"

See Network Configuration for more information.

Generated by ✅ Contribution Check · copilot · auto · 50.7 AIC · ⌖ 14.2 AIC · ⊞ 9.2K · ◷

Initial plan

c56833a

Copilot AI assigned Copilot and pelikhan Sep 23, 2026

Copilot started work on behalf of pelikhan September 23, 2026 19:13 View session

Copilot AI linked an issue Sep 23, 2026 that may be closed by this pull request

Allow workflows to narrow safe-output tool schemas (e.g. require per-item fields for add_labels) #62994

Closed

Copilot AI and others added 2 commits September 23, 2026 19:27

Add safe-output item schema narrowing

ca173a0

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Fix item schema type annotations

416c458

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add validation for safe-output tool schemas~~ Allow workflows to narrow safe-output item schemas Sep 23, 2026

Copilot finished work on behalf of pelikhan September 23, 2026 19:33

Copilot AI requested a review from pelikhan September 23, 2026 19:33

pelikhan marked this pull request as ready for review September 23, 2026 19:50

Copilot AI balanced review requested due to automatic review settings September 23, 2026 19:50

Copilot started reviewing on behalf of pelikhan September 23, 2026 19:50 View session

Copilot AI reviewed Sep 23, 2026

View reviewed changes

github-actions Bot mentioned this pull request Sep 23, 2026

[pr-sous-chef] PR Sous Chef run report (2026-09-22) #62773

Closed

Copilot started work on behalf of gh-aw-bot September 23, 2026 20:04 View session

Enforce nested maxLength and schema-aware add_labels guidance

b529a8c

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot September 23, 2026 20:17

Copilot AI requested a review from gh-aw-bot September 23, 2026 20:17

Merge branch 'main' into copilot/allow-narrow-safe-output-schemas

75529d0

Copilot started work on behalf of pelikhan September 23, 2026 20:44 View session

Fix E006 length validation ordering

c2e51ef

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan September 23, 2026 20:57

github-actions Bot mentioned this pull request Sep 23, 2026

[Contribution Check Report] Contribution Check — 2026-09-23 #62837

Closed

pelikhan closed this Sep 23, 2026

github-actions Bot deleted the copilot/allow-narrow-safe-output-schemas branch October 1, 2026 02:14

Navigation Menu

Repository navigation

Allow workflows to narrow safe-output item schemas - #63016

Allow workflows to narrow safe-output item schemas#63016
pelikhan with Copilot wants to merge 6 commits into
mainfrom
copilot/allow-narrow-safe-output-schemas

Copilot AI commented Sep 23, 2026 •

edited by github-actions Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

gh-aw-bot commented Sep 23, 2026

Uh oh!

Copilot AI commented Sep 23, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		for (const [name, propertySchema] of Object.entries(configuredProperties)) {
		properties[name] = { ...(properties[name] ?? {}), ...propertySchema };

Conversation

Copilot AI commented Sep 23, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

gh-aw-bot commented Sep 23, 2026

Uh oh!

Copilot AI commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Sep 23, 2026 •

edited by github-actions Bot

Loading

Copilot AI commented Sep 23, 2026 •

edited

Loading