Add fork-backed safe-output pull request support (#45909)

Author: Copilot

actions/setup/js/create_pull_request.cjs

@@ -7,6 +7,7 @@ import * as path from "path";
 import * as os from "os";
 
 const require = createRequire(import.meta.url);
+const promptsSourceDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../md");
 
 const { getPatchPathForBranch, getPatchPathForBranchInRepo } = require("./git_patch_utils.cjs");
 const { getBundlePathForBranch, getBundlePathForBranchInRepo } = require("./generate_git_bundle.cjs");
@@ -41,8 +42,19 @@ function cleanupCanonicalTransports() {
   createdTransportPaths.clear();
 }
 
+function copyPromptTemplate(promptsDir, templateName) {
+  fs.copyFileSync(path.join(promptsSourceDir, templateName), path.join(promptsDir, templateName));
+}
+
+function ensureDefaultDisclosureHeaderPrompt() {
+  const promptsDir = path.join(process.env.RUNNER_TEMP || os.tmpdir(), "gh-aw", "prompts");
+  fs.mkdirSync(promptsDir, { recursive: true });
+  copyPromptTemplate(promptsDir, "safe_outputs_disclosure_header.md");
+}
+
 beforeEach(() => {
   cleanupCanonicalTransports();
+  ensureDefaultDisclosureHeaderPrompt();
 });
 afterEach(() => {
   cleanupCanonicalTransports();
@@ -1674,12 +1686,10 @@ describe("create_pull_request - allowed-files strict allowlist", () => {
     pushSignedSpy = vi.spyOn(pushSignedCommitsModule, "pushSignedCommits").mockResolvedValue("bundle-tip");
     const promptsDir = path.join(tempDir, "prompts");
     fs.mkdirSync(promptsDir, { recursive: true });
-    const requestReviewTemplateSrc = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../md/manifest_protection_request_review.md");
-    fs.copyFileSync(requestReviewTemplateSrc, path.join(promptsDir, "manifest_protection_request_review.md"));
-    const requestChangesTemplateSrc = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../md/manifest_protection_request_changes_review.md");
-    fs.copyFileSync(requestChangesTemplateSrc, path.join(promptsDir, "manifest_protection_request_changes_review.md"));
-    const threatWarningTemplateSrc = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../md/threat_warning_request_changes_review.md");
-    fs.copyFileSync(threatWarningTemplateSrc, path.join(promptsDir, "threat_warning_request_changes_review.md"));
+    copyPromptTemplate(promptsDir, "manifest_protection_request_review.md");
+    copyPromptTemplate(promptsDir, "manifest_protection_request_changes_review.md");
+    copyPromptTemplate(promptsDir, "threat_warning_request_changes_review.md");
+    copyPromptTemplate(promptsDir, "safe_outputs_disclosure_header.md");
     process.env.GH_AW_PROMPTS_DIR = promptsDir;
 
     // Clear module cache so globals are picked up fresh
@@ -1882,10 +1892,9 @@ ${diffs}
     const patchPath = writePatch("feature/protected", createPatchWithFiles(".github/aw/instructions.md"));
     const promptsDir = path.join(tempDir, "prompts");
     fs.mkdirSync(promptsDir, { recursive: true });
-    const templateSrc = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../md/manifest_protection_create_pr_fallback.md");
-    fs.copyFileSync(templateSrc, path.join(promptsDir, "manifest_protection_create_pr_fallback.md"));
-    const pushFailedTemplateSrc = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../md/manifest_protection_push_failed_fallback.md");
-    fs.copyFileSync(pushFailedTemplateSrc, path.join(promptsDir, "manifest_protection_push_failed_fallback.md"));
+    copyPromptTemplate(promptsDir, "manifest_protection_create_pr_fallback.md");
+    copyPromptTemplate(promptsDir, "manifest_protection_push_failed_fallback.md");
+    copyPromptTemplate(promptsDir, "safe_outputs_disclosure_header.md");
     process.env.GH_AW_PROMPTS_DIR = promptsDir;
 
     global.github.rest.issues = {
@@ -1922,10 +1931,9 @@ ${diffs}
     fs.writeFileSync(bundlePath, "bundle content");
     const promptsDir = path.join(tempDir, "prompts");
     fs.mkdirSync(promptsDir, { recursive: true });
-    const templateSrc = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../md/manifest_protection_create_pr_fallback.md");
-    fs.copyFileSync(templateSrc, path.join(promptsDir, "manifest_protection_create_pr_fallback.md"));
-    const pushFailedTemplateSrc = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../md/manifest_protection_push_failed_fallback.md");
-    fs.copyFileSync(pushFailedTemplateSrc, path.join(promptsDir, "manifest_protection_push_failed_fallback.md"));
+    copyPromptTemplate(promptsDir, "manifest_protection_create_pr_fallback.md");
+    copyPromptTemplate(promptsDir, "manifest_protection_push_failed_fallback.md");
+    copyPromptTemplate(promptsDir, "safe_outputs_disclosure_header.md");
     process.env.GH_AW_PROMPTS_DIR = promptsDir;
 
     global.github.rest.issues = {
@@ -2851,6 +2859,7 @@ describe("create_pull_request - patch apply fallback to original base commit", (
     fs.mkdirSync(promptsDir, { recursive: true });
     fs.writeFileSync(path.join(promptsDir, "manifest_protection_request_review.md"), "Protected files: {{files}}", "utf8");
     fs.writeFileSync(path.join(promptsDir, "manifest_protection_request_changes_review.md"), "Protected files: {{files}}", "utf8");
+    copyPromptTemplate(promptsDir, "safe_outputs_disclosure_header.md");
     process.env.GH_AW_PROMPTS_DIR = promptsDir;
     global.exec = {
       exec: vi.fn().mockImplementation((cmd, args) => {
@@ -3052,14 +3061,14 @@ describe("create_pull_request - patch apply fallback to original base commit", (
     let renameCalled = false;
     global.exec = {
       exec: vi.fn().mockImplementation((cmd, args) => {
-        const cmdStr = typeof cmd === "string" ? cmd : `${cmd} ${(args || []).join(" ")}`;
+        const cmdStr = `${cmd} ${(args || []).join(" ")}`;
         if (cmdStr.includes("git branch -m")) {
           renameCalled = true;
         }
         return Promise.resolve(0);
       }),
       getExecOutput: vi.fn().mockImplementation((cmd, args) => {
-        const cmdStr = typeof cmd === "string" ? cmd : `${cmd} ${(args || []).join(" ")}`;
+        const cmdStr = `${cmd} ${(args || []).join(" ")}`;
         if (cmdStr.includes("ls-remote --heads origin")) {
           return Promise.resolve({ exitCode: 0, stdout: "abc123\trefs/heads/preserve-me\n", stderr: "" });
         }
@@ -3092,7 +3101,7 @@ describe("create_pull_request - patch apply fallback to original base commit", (
     global.exec = {
       exec: vi.fn().mockResolvedValue(0),
       getExecOutput: vi.fn().mockImplementation((cmd, args) => {
-        const cmdStr = typeof cmd === "string" ? cmd : `${cmd} ${(args || []).join(" ")}`;
+        const cmdStr = `${cmd} ${(args || []).join(" ")}`;
         if (cmdStr.includes("ls-remote --heads origin")) {
           return Promise.resolve({ exitCode: 0, stdout: "abc123\trefs/heads/preserve-me\n", stderr: "" });
         }
@@ -3117,7 +3126,7 @@ describe("create_pull_request - patch apply fallback to original base commit", (
     global.exec = {
       exec: vi.fn().mockResolvedValue(0),
       getExecOutput: vi.fn().mockImplementation((cmd, args) => {
-        const cmdStr = typeof cmd === "string" ? cmd : `${cmd} ${(args || []).join(" ")}`;
+        const cmdStr = `${cmd} ${(args || []).join(" ")}`;
         if (cmdStr.includes("ls-remote --heads origin")) {
           return Promise.resolve({ exitCode: 0, stdout: "abc123\trefs/heads/preserve-me\n", stderr: "" });
         }
@@ -3142,7 +3151,7 @@ describe("create_pull_request - patch apply fallback to original base commit", (
     let capturedRenamedBranch = null;
     global.exec = {
       exec: vi.fn().mockImplementation((cmd, args) => {
-        const cmdStr = typeof cmd === "string" ? cmd : `${cmd} ${(args || []).join(" ")}`;
+        const cmdStr = `${cmd} ${(args || []).join(" ")}`;
         // Capture the new branch name from: git branch -m <old> <new>
         const renameMatch = cmdStr.match(/git branch -m \S+ (\S+)/);
         if (renameMatch) {
@@ -3151,7 +3160,7 @@ describe("create_pull_request - patch apply fallback to original base commit", (
         return Promise.resolve(0);
       }),
       getExecOutput: vi.fn().mockImplementation((cmd, args) => {
-        const cmdStr = typeof cmd === "string" ? cmd : `${cmd} ${(args || []).join(" ")}`;
+        const cmdStr = `${cmd} ${(args || []).join(" ")}`;
         if (cmdStr.includes("ls-remote --heads origin")) {
           return Promise.resolve({ exitCode: 0, stdout: "abc123\trefs/heads/chaos/preserve-me\n", stderr: "" });
         }
@@ -3196,14 +3205,14 @@ describe("create_pull_request - patch apply fallback to original base commit", (
     let renameCalled = false;
     global.exec = {
       exec: vi.fn().mockImplementation((cmd, args) => {
-        const cmdStr = typeof cmd === "string" ? cmd : `${cmd} ${(args || []).join(" ")}`;
+        const cmdStr = `${cmd} ${(args || []).join(" ")}`;
         if (cmdStr.includes("git branch -m")) {
           renameCalled = true;
         }
         return Promise.resolve(0);
       }),
       getExecOutput: vi.fn().mockImplementation((cmd, args) => {
-        const cmdStr = typeof cmd === "string" ? cmd : `${cmd} ${(args || []).join(" ")}`;
+        const cmdStr = `${cmd} ${(args || []).join(" ")}`;
         if (cmdStr.includes("ls-remote --heads origin")) {
           return Promise.resolve({ exitCode: 0, stdout: "abc123\trefs/heads/some-branch\n", stderr: "" });
         }
@@ -3393,12 +3402,10 @@ describe("create_pull_request - threat detection caution", () => {
     tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "create-pr-threat-test-"));
     const promptsDir = path.join(tempDir, "prompts");
     fs.mkdirSync(promptsDir, { recursive: true });
-    const requestReviewTemplateSrc = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../md/manifest_protection_request_review.md");
-    fs.copyFileSync(requestReviewTemplateSrc, path.join(promptsDir, "manifest_protection_request_review.md"));
-    const requestChangesTemplateSrc = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../md/manifest_protection_request_changes_review.md");
-    fs.copyFileSync(requestChangesTemplateSrc, path.join(promptsDir, "manifest_protection_request_changes_review.md"));
-    const threatWarningTemplateSrc = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../md/threat_warning_request_changes_review.md");
-    fs.copyFileSync(threatWarningTemplateSrc, path.join(promptsDir, "threat_warning_request_changes_review.md"));
+    copyPromptTemplate(promptsDir, "manifest_protection_request_review.md");
+    copyPromptTemplate(promptsDir, "manifest_protection_request_changes_review.md");
+    copyPromptTemplate(promptsDir, "threat_warning_request_changes_review.md");
+    copyPromptTemplate(promptsDir, "safe_outputs_disclosure_header.md");
     process.env.GH_AW_PROMPTS_DIR = promptsDir;
 
     global.core = {
@@ -4122,6 +4129,22 @@ describe("create_pull_request - branch-prefix config", () => {
     expect(branchArg).not.toContain("signed/");
   });
 
+  it("should use an owner-qualified PR head when head-repo differs from target-repo", async () => {
+    const { main } = require("./create_pull_request.cjs");
+    const handler = await main({
+      allow_empty: true,
+      "head-repo": "fork-owner/test-repo",
+      allowed_repos: ["test-owner/test-repo", "fork-owner/test-repo"],
+    });
+
+    await handler({ title: "Test PR", body: "body", branch: "my-feature" }, {});
+
+    const createCall = global.github.rest.pulls.create.mock.calls[0][0];
+    expect(createCall.owner).toBe("test-owner");
+    expect(createCall.repo).toBe("test-repo");
+    expect(createCall.head).toMatch(/^fork-owner:my-feature(?:-[0-9a-f]+)?$/);
+  });
+
   it("should normalize an invalid branch-prefix and emit a warning", async () => {
     const { main } = require("./create_pull_request.cjs");
     const handler = await main({ branch_prefix: "bad prefix: ", allow_empty: true });
@@ -4149,8 +4172,8 @@ describe("create_pull_request - E003 file-limit fallback-to-issue", () => {
     // Set up prompts directory with the E003 template so getPromptPath resolves
     const promptsDir = path.join(tempDir, "prompts");
     fs.mkdirSync(promptsDir, { recursive: true });
-    const templateSrc = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../md/e003_file_limit_fallback.md");
-    fs.copyFileSync(templateSrc, path.join(promptsDir, "e003_file_limit_fallback.md"));
+    copyPromptTemplate(promptsDir, "e003_file_limit_fallback.md");
+    copyPromptTemplate(promptsDir, "safe_outputs_disclosure_header.md");
     process.env.GH_AW_PROMPTS_DIR = promptsDir;
 
     global.core = {

actions/setup/js/create_pull_request.test.cjs

@@ -223,11 +223,12 @@ function generatePatchPreview(patchContent) {
  * @param {string} branchName
  * @param {string} title
  * @param {number} [fallbackIssueNumber]
+ * @param {string} [headRef]
  * @returns {string}
  */
-function buildManifestProtectionCreatePrUrl(githubServer, repoParts, baseBranch, branchName, title, fallbackIssueNumber) {
+function buildManifestProtectionCreatePrUrl(githubServer, repoParts, baseBranch, branchName, title, fallbackIssueNumber, headRef) {
   const encodedBase = encodePathSegments(baseBranch);
-  const encodedHead = encodePathSegments(branchName);
+  const encodedHead = encodePathSegments(headRef || branchName);
   let createPrUrl = `${githubServer}/${repoParts.owner}/${repoParts.repo}/compare/${encodedBase}...${encodedHead}?expand=1&title=${encodeURIComponent(title)}`;
   if (typeof fallbackIssueNumber === "number") {
     createPrUrl += `&body=${encodeURIComponent(`Closes #${fallbackIssueNumber}`)}`;

actions/setup/js/create_pull_request_helpers.cjs

@@ -22,14 +22,13 @@ function normalizeServerUrl(serverUrl) {
  * Returns an empty array when the key is absent (exit code ≠ 0).
  *
  * @param {string} serverUrl
+ * @param {string} [cwd] - Optional working directory for the git config command
  * @returns {Promise<string[]>}
  */
-async function getExtraheaderValues(serverUrl) {
+async function getExtraheaderValues(serverUrl, cwd) {
   const normalizedUrl = normalizeServerUrl(serverUrl);
-  const result = await exec.getExecOutput("git", ["config", "--get-all", `http.${normalizedUrl}/.extraheader`], {
-    silent: true,
-    ignoreReturnCode: true,
-  });
+  const execOptions = cwd ? { silent: true, ignoreReturnCode: true, cwd } : { silent: true, ignoreReturnCode: true };
+  const result = await exec.getExecOutput("git", ["config", "--get-all", `http.${normalizedUrl}/.extraheader`], execOptions);
   if (result.exitCode !== 0 || !result.stdout.trim()) {
     return [];
   }
@@ -61,21 +60,26 @@ async function checkoutHasPersistedExtraheader(serverUrl) {
  *
  * @param {string} serverUrl
  * @param {string} token
+ * @param {string} [cwd] - Optional working directory for the git config command
  * @returns {Promise<string[]>}
  */
-async function overridePersistedExtraheader(serverUrl, token) {
+async function overridePersistedExtraheader(serverUrl, token, cwd) {
   const normalizedUrl = normalizeServerUrl(serverUrl);
   let previousValues;
   try {
-    previousValues = await getExtraheaderValues(serverUrl);
+    previousValues = await getExtraheaderValues(serverUrl, cwd);
     core.info(`git_auth_helpers: read ${previousValues.length} existing extraheader value(s) for ${normalizedUrl}`);
   } catch (err) {
     core.warning(`git_auth_helpers: could not read existing extraheader values — restoration will proceed with empty defaults: ${getErrorMessage(err)}`);
     previousValues = [];
   }
   core.info(`git_auth_helpers: overriding http.${normalizedUrl}/.extraheader with CI trigger token`);
   const tokenBase64 = Buffer.from(`x-access-token:${token.trim()}`).toString("base64");
-  await exec.exec("git", ["config", "--replace-all", `http.${normalizedUrl}/.extraheader`, `Authorization: basic ${tokenBase64}`]);
+  if (cwd) {
+    await exec.exec("git", ["config", "--replace-all", `http.${normalizedUrl}/.extraheader`, `Authorization: basic ${tokenBase64}`], { cwd });
+  } else {
+    await exec.exec("git", ["config", "--replace-all", `http.${normalizedUrl}/.extraheader`, `Authorization: basic ${tokenBase64}`]);
+  }
   core.info(`git_auth_helpers: extraheader override applied`);
   return previousValues;
 }
@@ -85,14 +89,19 @@ async function overridePersistedExtraheader(serverUrl, token) {
  *
  * @param {string} serverUrl
  * @param {string[]} previousValues
+ * @param {string} [cwd] - Optional working directory for the git config command
  * @returns {Promise<void>}
  */
-async function restorePersistedExtraheader(serverUrl, previousValues) {
+async function restorePersistedExtraheader(serverUrl, previousValues, cwd) {
   const key = `http.${normalizeServerUrl(serverUrl)}/.extraheader`;
   if (!previousValues || previousValues.length === 0) {
     core.info(`git_auth_helpers: no previous extraheader values — unsetting ${key}`);
     try {
-      await exec.exec("git", ["config", "--unset-all", key]);
+      if (cwd) {
+        await exec.exec("git", ["config", "--unset-all", key], { cwd });
+      } else {
+        await exec.exec("git", ["config", "--unset-all", key]);
+      }
     } catch {
       // Nothing to restore/unset.
     }
@@ -108,14 +117,25 @@ async function restorePersistedExtraheader(serverUrl, previousValues) {
   // best-effort cleanup by unsetting the key entirely, then re-throw so the caller
   // is aware that restoration failed.
   try {
-    await exec.exec("git", ["config", "--replace-all", key, previousValues[0]]);
-    for (const value of previousValues.slice(1)) {
-      await exec.exec("git", ["config", "--add", key, value]);
+    if (cwd) {
+      await exec.exec("git", ["config", "--replace-all", key, previousValues[0]], { cwd });
+      for (const value of previousValues.slice(1)) {
+        await exec.exec("git", ["config", "--add", key, value], { cwd });
+      }
+    } else {
+      await exec.exec("git", ["config", "--replace-all", key, previousValues[0]]);
+      for (const value of previousValues.slice(1)) {
+        await exec.exec("git", ["config", "--add", key, value]);
+      }
     }
   } catch (err) {
     core.warning(`git_auth_helpers: partial extraheader restore for ${key} — attempting cleanup: ${getErrorMessage(err)}`);
     try {
-      await exec.exec("git", ["config", "--unset-all", key]);
+      if (cwd) {
+        await exec.exec("git", ["config", "--unset-all", key], { cwd });
+      } else {
+        await exec.exec("git", ["config", "--unset-all", key]);
+      }
     } catch {
       // Best-effort only; ignore secondary failure.
     }