From 4c7492e98b10623050f6e24100538b2a12a8134f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 9 Jul 2026 05:34:43 +0000
Subject: [PATCH 01/15] Initial plan


From c1e11ea5914ae1eeb78e0ef39625455a60fe2e05 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 9 Jul 2026 05:56:54 +0000
Subject: [PATCH 02/15] Add disclosure-header message for AI authorship
 disclosure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds a new `disclosure-header` configuration option to `safe-outputs.messages`
that prepends an AI authorship disclosure to every message body (issues,
comments, pull requests, discussions).

- Set `disclosure-header: true` to use the built-in default text:
  "> 🤖 **Automated content** — generated by the [{workflow_name}]({run_url})
   workflow. The account owner did **not** write or review this content personally."
- Set `disclosure-header: "<template>"` to use a custom template string
- Supports `{workflow_name}` and `{run_url}` placeholders

The disclosure header is inserted after any threat-detection caution alert and
before any `body-header` and the main body content.

Closes #38566

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 actions/setup/js/add_comment.cjs             |   9 +-
 actions/setup/js/create_discussion.cjs       |   8 +-
 actions/setup/js/create_issue.cjs            |   8 +-
 actions/setup/js/create_pull_request.cjs     |   8 +-
 actions/setup/js/messages.cjs                |   3 +-
 actions/setup/js/messages_header.cjs         |  29 +++++-
 actions/setup/js/messages_header.test.cjs    |  44 +++++++-
 pkg/parser/schemas/main_workflow_schema.json |  14 +++
 pkg/workflow/safe_outputs_config_types.go    |   1 +
 pkg/workflow/safe_outputs_messages_config.go |  12 +++
 pkg/workflow/safe_outputs_messages_test.go   | 103 +++++++++++++++++++
 11 files changed, 229 insertions(+), 10 deletions(-)

diff --git a/actions/setup/js/add_comment.cjs b/actions/setup/js/add_comment.cjs
index 90888bbd240..be660374d5f 100644
--- a/actions/setup/js/add_comment.cjs
+++ b/actions/setup/js/add_comment.cjs
@@ -17,7 +17,7 @@ const { resolveTargetRepoConfig, resolveAndValidateRepo } = require("./repo_help
 const { createAuthenticatedGitHubClient } = require("./handler_auth.cjs");
 const { getMissingInfoSections } = require("./missing_messages_helper.cjs");
 const { getMessages } = require("./messages_core.cjs");
-const { getBodyHeader } = require("./messages_header.cjs");
+const { getBodyHeader, getDisclosureHeader } = require("./messages_header.cjs");
 const { sanitizeContent } = require("./sanitize_content.cjs");
 const { MAX_COMMENT_LENGTH, MAX_MENTIONS, MAX_LINKS, enforceCommentLimits } = require("./comment_limit_helpers.cjs");
 const { createDiscussionComment, resolveTopLevelDiscussionCommentId } = require("./github_api_helpers.cjs");
@@ -669,11 +669,12 @@ async function main(config = {}) {
       runUrl,
     }).detectionCaution;
 
-    // Inject body header if configured (placed after caution, before user content)
+    // Inject body header and disclosure header if configured (placed after caution, before user content)
     const bodyHeader = getBodyHeader({ workflowName, runUrl });
+    const disclosureHeader = getDisclosureHeader({ workflowName, runUrl });
 
-    // Build prefix: caution (if any) → body header (if any) → user content
-    const prefixParts = [detectionCaution, bodyHeader].filter(Boolean);
+    // Build prefix: caution (if any) → disclosure header (if any) → body header (if any) → user content
+    const prefixParts = [detectionCaution, disclosureHeader, bodyHeader].filter(Boolean);
     if (prefixParts.length > 0) processedBody = prefixParts.join("\n\n") + "\n\n" + processedBody;
 
     // Add tracker ID and footer
diff --git a/actions/setup/js/create_discussion.cjs b/actions/setup/js/create_discussion.cjs
index cb81dfe66a0..ef7a63fa461 100644
--- a/actions/setup/js/create_discussion.cjs
+++ b/actions/setup/js/create_discussion.cjs
@@ -18,7 +18,7 @@ const { getErrorMessage } = require("./error_helpers.cjs");
 const { ERR_VALIDATION } = require("./error_codes.cjs");
 const { createExpirationLine, generateFooterWithExpiration, addExpirationToFooter } = require("./ephemerals.cjs");
 const { assembleMarkdownBodyParts } = require("./markdown_body_helpers.cjs");
-const { getBodyHeader } = require("./messages_header.cjs");
+const { getBodyHeader, getDisclosureHeader } = require("./messages_header.cjs");
 const { generateWorkflowIdMarker, generateWorkflowCallIdMarker, generateCloseKeyMarker, normalizeCloseOlderKey } = require("./generate_footer.cjs");
 const { sanitizeContent } = require("./sanitize_content.cjs");
 const { sanitizeLabelContent } = require("./sanitize_label_content.cjs");
@@ -545,6 +545,12 @@ async function main(config = {}) {
       bodyLines.unshift(...bodyHeader.split("\n"), "");
     }
 
+    // Inject disclosure header before body header (unshifted after, so it appears first)
+    const disclosureHeader = getDisclosureHeader({ workflowName, runUrl });
+    if (disclosureHeader) {
+      bodyLines.unshift(...disclosureHeader.split("\n"), "");
+    }
+
     const triggeringIssueNumber = context.payload?.issue?.number && !context.payload?.issue?.pull_request ? context.payload.issue.number : undefined;
     const triggeringPRNumber = context.payload?.pull_request?.number || (context.payload?.issue?.pull_request ? context.payload.issue.number : undefined);
     const triggeringDiscussionNumber = context.payload?.discussion?.number;
diff --git a/actions/setup/js/create_issue.cjs b/actions/setup/js/create_issue.cjs
index 67528c2b24a..7b5b1b41046 100644
--- a/actions/setup/js/create_issue.cjs
+++ b/actions/setup/js/create_issue.cjs
@@ -5,7 +5,7 @@ const { sanitizeLabelContent } = require("./sanitize_label_content.cjs");
 const { sanitizeTitle, applyTitlePrefix } = require("./sanitize_title.cjs");
 const { sanitizeContent } = require("./sanitize_content.cjs");
 const { generateFooterWithMessages, getDetectionCautionAlert } = require("./messages_footer.cjs");
-const { getBodyHeader } = require("./messages_header.cjs");
+const { getBodyHeader, getDisclosureHeader } = require("./messages_header.cjs");
 const { generateWorkflowIdMarker, generateWorkflowCallIdMarker, generateCloseKeyMarker, normalizeCloseOlderKey } = require("./generate_footer.cjs");
 const { generateHistoryUrl } = require("./generate_history_link.cjs");
 const { getTrackerID } = require("./get_tracker_id.cjs");
@@ -883,6 +883,12 @@ async function main(config = {}) {
       bodyLines.unshift(...bodyHeader.split("\n"), "");
     }
 
+    // Inject disclosure header before body header (unshifted after, so it appears first)
+    const disclosureHeader = getDisclosureHeader({ workflowName, runUrl });
+    if (disclosureHeader) {
+      bodyLines.unshift(...disclosureHeader.split("\n"), "");
+    }
+
     // Inject CAUTION at top of body if threat detection warning was raised
     // (unshifted after header so it appears first in the final output)
     const detectionCaution = getDetectionCautionAlert(workflowName, runUrl);
diff --git a/actions/setup/js/create_pull_request.cjs b/actions/setup/js/create_pull_request.cjs
index 82735b6f33a..62419d583aa 100644
--- a/actions/setup/js/create_pull_request.cjs
+++ b/actions/setup/js/create_pull_request.cjs
@@ -18,7 +18,7 @@ const { addExpirationToFooter } = require("./ephemerals.cjs");
 const { generateWorkflowIdMarker, generateWorkflowCallIdMarker, generateCloseKeyMarker, normalizeCloseOlderKey } = require("./generate_footer.cjs");
 const { parseBoolTemplatable } = require("./templatable.cjs");
 const { assembleMarkdownBodyParts } = require("./markdown_body_helpers.cjs");
-const { getBodyHeader } = require("./messages_header.cjs");
+const { getBodyHeader, getDisclosureHeader } = require("./messages_header.cjs");
 const { generateHistoryUrl } = require("./generate_history_link.cjs");
 const { normalizeBranchName } = require("./normalize_branch_name.cjs");
 const { pushExtraEmptyCommit } = require("./extra_empty_commit.cjs");
@@ -1368,6 +1368,12 @@ async function main(config = {}) {
         bodyLines.unshift(...bodyHeader.split("\n"), "");
       }
 
+      // Inject disclosure header before body header (unshifted after, so it appears first)
+      const disclosureHeader = getDisclosureHeader({ workflowName, runUrl });
+      if (disclosureHeader) {
+        bodyLines.unshift(...disclosureHeader.split("\n"), "");
+      }
+
       // Keep the protected-files notice directly under detection caution:
       // this block runs first, then detectionCaution below unshifts to index 0.
       if (manifestProtectionRequestReview && manifestProtectionRequestReview.length > 0) {
diff --git a/actions/setup/js/messages.cjs b/actions/setup/js/messages.cjs
index 83120ed2215..67f8faa7cd9 100644
--- a/actions/setup/js/messages.cjs
+++ b/actions/setup/js/messages.cjs
@@ -36,7 +36,7 @@ const { getRunStartedMessage, getRunSuccessMessage, getRunFailureMessage } = req
 const { getCloseOlderDiscussionMessage } = require("./messages_close_discussion.cjs");
 
 // Re-export body header messages
-const { getBodyHeader } = require("./messages_header.cjs");
+const { getBodyHeader, getDisclosureHeader } = require("./messages_header.cjs");
 
 module.exports = {
   getMessages,
@@ -56,4 +56,5 @@ module.exports = {
   getRunFailureMessage,
   getCloseOlderDiscussionMessage,
   getBodyHeader,
+  getDisclosureHeader,
 };
diff --git a/actions/setup/js/messages_header.cjs b/actions/setup/js/messages_header.cjs
index 415e0d8d4e1..a63dfb9ada7 100644
--- a/actions/setup/js/messages_header.cjs
+++ b/actions/setup/js/messages_header.cjs
@@ -4,7 +4,7 @@
 /**
  * Body Header Message Module
  *
- * This module provides the body-header generation for safe-output workflows.
+ * This module provides the body-header and disclosure-header generation for safe-output workflows.
  * The body header is prepended to every message body generated by safe outputs
  * (issues, comments, pull requests, discussions).
  */
@@ -17,6 +17,12 @@ const { getMessages, renderTemplate, toSnakeCase } = require("./messages_core.cj
  * @property {string} runUrl - URL of the workflow run
  */
 
+/**
+ * Default AI authorship disclosure text used when disclosure-header is set to true.
+ * Rendered with the same template placeholders as other message templates.
+ */
+const DEFAULT_DISCLOSURE_HEADER = "> 🤖 **Automated content** — generated by the [{workflow_name}]({run_url}) workflow. The account owner did **not** write or review this content personally.";
+
 /**
  * Get the body header text, using the custom template if configured.
  * Returns an empty string when no body-header is configured.
@@ -33,6 +39,27 @@ function getBodyHeader(ctx) {
   return renderTemplate(messages.bodyHeader, templateContext);
 }
 
+/**
+ * Get the AI authorship disclosure header text.
+ * When disclosure-header is "true", returns the built-in default AI disclosure text.
+ * When disclosure-header is a custom string, renders it as a template.
+ * Returns an empty string when disclosure-header is not configured.
+ * @param {BodyHeaderContext} ctx - Context for header generation
+ * @returns {string} The rendered disclosure header text, or empty string if not configured
+ */
+function getDisclosureHeader(ctx) {
+  const messages = getMessages();
+  if (!messages?.disclosureHeader) {
+    return "";
+  }
+
+  const templateContext = toSnakeCase(ctx);
+  const template = messages.disclosureHeader === "true" ? DEFAULT_DISCLOSURE_HEADER : messages.disclosureHeader;
+  return renderTemplate(template, templateContext);
+}
+
 module.exports = {
   getBodyHeader,
+  getDisclosureHeader,
+  DEFAULT_DISCLOSURE_HEADER,
 };
diff --git a/actions/setup/js/messages_header.test.cjs b/actions/setup/js/messages_header.test.cjs
index f2dd5cf02fb..2d22d5de347 100644
--- a/actions/setup/js/messages_header.test.cjs
+++ b/actions/setup/js/messages_header.test.cjs
@@ -11,7 +11,7 @@ const mockCore = {
 };
 global.core = mockCore;
 
-const { getBodyHeader } = require("./messages_header.cjs");
+const { getBodyHeader, getDisclosureHeader, DEFAULT_DISCLOSURE_HEADER } = require("./messages_header.cjs");
 
 const WORKFLOW = "My Workflow";
 const RUN_URL = "https://github.com/owner/repo/actions/runs/99";
@@ -73,4 +73,46 @@ describe("messages_header", () => {
       expect(result).toBe(`> Header ${WORKFLOW} {unknown_placeholder}`);
     });
   });
+
+  describe("getDisclosureHeader", () => {
+    it("returns empty string when disclosure-header is not configured", () => {
+      const result = getDisclosureHeader({ workflowName: WORKFLOW, runUrl: RUN_URL });
+      expect(result).toBe("");
+    });
+
+    it("returns rendered default text when disclosure-header is 'true'", () => {
+      process.env.GH_AW_SAFE_OUTPUT_MESSAGES = JSON.stringify({
+        disclosureHeader: "true",
+      });
+
+      const result = getDisclosureHeader({ workflowName: WORKFLOW, runUrl: RUN_URL });
+      expect(result).toContain(WORKFLOW);
+      expect(result).toContain(RUN_URL);
+      expect(result).toContain("🤖");
+    });
+
+    it("returns rendered custom template when disclosure-header is a string", () => {
+      process.env.GH_AW_SAFE_OUTPUT_MESSAGES = JSON.stringify({
+        disclosureHeader: "> 🤖 Custom disclosure for [{workflow_name}]({run_url}).",
+      });
+
+      const result = getDisclosureHeader({ workflowName: WORKFLOW, runUrl: RUN_URL });
+      expect(result).toBe(`> 🤖 Custom disclosure for [${WORKFLOW}](${RUN_URL}).`);
+    });
+
+    it("returns empty string when messages env is set but disclosure-header is absent", () => {
+      process.env.GH_AW_SAFE_OUTPUT_MESSAGES = JSON.stringify({
+        footer: "> Custom footer",
+      });
+
+      const result = getDisclosureHeader({ workflowName: WORKFLOW, runUrl: RUN_URL });
+      expect(result).toBe("");
+    });
+
+    it("DEFAULT_DISCLOSURE_HEADER contains expected placeholders", () => {
+      expect(DEFAULT_DISCLOSURE_HEADER).toContain("{workflow_name}");
+      expect(DEFAULT_DISCLOSURE_HEADER).toContain("{run_url}");
+      expect(DEFAULT_DISCLOSURE_HEADER).toContain("🤖");
+    });
+  });
 });
diff --git a/pkg/parser/schemas/main_workflow_schema.json b/pkg/parser/schemas/main_workflow_schema.json
index 90b8c72f5a2..3945d316faf 100644
--- a/pkg/parser/schemas/main_workflow_schema.json
+++ b/pkg/parser/schemas/main_workflow_schema.json
@@ -10498,6 +10498,20 @@
               "description": "Custom header text prepended to every message body generated by safe outputs (issues, comments, pull requests, discussions). Applied after any threat-detection caution alert and before the agent-generated content. Available placeholders: {workflow_name}, {run_url}.",
               "examples": ["> ⚠️ This content was generated by [{workflow_name}]({run_url}).", "> 🤖 AI-generated output — please review before acting."]
             },
+            "disclosure-header": {
+              "oneOf": [
+                {
+                  "type": "boolean",
+                  "description": "Set to true to prepend the built-in AI authorship disclosure header to every message body (issues, comments, pull requests, discussions). The default text states the content was automatically generated and was not written or reviewed by the account owner personally."
+                },
+                {
+                  "type": "string",
+                  "description": "Custom AI authorship disclosure header prepended to every message body. Available placeholders: {workflow_name}, {run_url}.",
+                  "examples": ["> 🤖 This content was generated by [{workflow_name}]({run_url}) and was not written by the account owner."]
+                }
+              ],
+              "description": "AI authorship disclosure header prepended to every message body. Set to true for built-in default text, or provide a custom template string. Applied before body-header and after any threat-detection caution alert. Available placeholders: {workflow_name}, {run_url}."
+            },
             "append-only-comments": {
               "type": "boolean",
               "description": "When enabled, workflow completion notifier creates a new comment instead of editing the activation comment. Creates an append-only timeline of workflow runs. Default: false",
diff --git a/pkg/workflow/safe_outputs_config_types.go b/pkg/workflow/safe_outputs_config_types.go
index 2c084932954..911cc814089 100644
--- a/pkg/workflow/safe_outputs_config_types.go
+++ b/pkg/workflow/safe_outputs_config_types.go
@@ -136,6 +136,7 @@ type SafeOutputMessagesConfig struct {
 	AgentFailureIssue              string `yaml:"agent-failure-issue,omitempty" json:"agentFailureIssue,omitempty"`                            // Custom footer template for agent failure tracking issues
 	AgentFailureComment            string `yaml:"agent-failure-comment,omitempty" json:"agentFailureComment,omitempty"`                        // Custom footer template for comments on agent failure tracking issues
 	BodyHeader                     string `yaml:"body-header,omitempty" json:"bodyHeader,omitempty"`                                           // Custom header text prepended to every message body (issues, comments, PRs, discussions). Placeholders: {workflow_name}, {run_url}
+	DisclosureHeader               string `yaml:"disclosure-header,omitempty" json:"disclosureHeader,omitempty"`                               // AI authorship disclosure header prepended to every message body. Set to "true" for built-in default text, or provide a custom template string. Placeholders: {workflow_name}, {run_url}
 }
 
 // MentionsConfig holds configuration for @mention filtering in safe outputs
diff --git a/pkg/workflow/safe_outputs_messages_config.go b/pkg/workflow/safe_outputs_messages_config.go
index bf6c97fa853..d85fc009250 100644
--- a/pkg/workflow/safe_outputs_messages_config.go
+++ b/pkg/workflow/safe_outputs_messages_config.go
@@ -42,6 +42,18 @@ func parseMessagesConfig(messagesMap map[string]any) *SafeOutputMessagesConfig {
 	config.AgentFailureComment = extractStringFromMap(messagesMap, "agent-failure-comment", nil)
 	config.BodyHeader = extractStringFromMap(messagesMap, "body-header", nil)
 
+	// Handle disclosure-header: can be bool (true for default built-in text) or custom string
+	if dh, exists := messagesMap["disclosure-header"]; exists {
+		switch v := dh.(type) {
+		case bool:
+			if v {
+				config.DisclosureHeader = "true"
+			}
+		case string:
+			config.DisclosureHeader = v
+		}
+	}
+
 	return config
 }
 
diff --git a/pkg/workflow/safe_outputs_messages_test.go b/pkg/workflow/safe_outputs_messages_test.go
index edba6c4f54f..8ebee93c3d1 100644
--- a/pkg/workflow/safe_outputs_messages_test.go
+++ b/pkg/workflow/safe_outputs_messages_test.go
@@ -127,6 +127,81 @@ func TestSafeOutputsMessagesConfiguration(t *testing.T) {
 			t.Errorf("Expected BodyHeader to be custom template, got %q", config.Messages.BodyHeader)
 		}
 	})
+
+	t.Run("Should parse disclosure-header as bool true", func(t *testing.T) {
+		frontmatter := map[string]any{
+			"name": "Test Workflow",
+			"safe-outputs": map[string]any{
+				"create-issue": nil,
+				"messages": map[string]any{
+					"disclosure-header": true,
+				},
+			},
+		}
+
+		config := compiler.extractSafeOutputsConfig(frontmatter)
+		if config == nil {
+			t.Fatal("Expected SafeOutputsConfig to be parsed")
+		}
+
+		if config.Messages == nil {
+			t.Fatal("Expected Messages to be parsed")
+		}
+
+		if config.Messages.DisclosureHeader != "true" {
+			t.Errorf("Expected DisclosureHeader to be 'true' when bool true is set, got %q", config.Messages.DisclosureHeader)
+		}
+	})
+
+	t.Run("Should parse disclosure-header as custom string", func(t *testing.T) {
+		frontmatter := map[string]any{
+			"name": "Test Workflow",
+			"safe-outputs": map[string]any{
+				"create-issue": nil,
+				"messages": map[string]any{
+					"disclosure-header": "> 🤖 Custom disclosure for [{workflow_name}]({run_url}).",
+				},
+			},
+		}
+
+		config := compiler.extractSafeOutputsConfig(frontmatter)
+		if config == nil {
+			t.Fatal("Expected SafeOutputsConfig to be parsed")
+		}
+
+		if config.Messages == nil {
+			t.Fatal("Expected Messages to be parsed")
+		}
+
+		if config.Messages.DisclosureHeader != "> 🤖 Custom disclosure for [{workflow_name}]({run_url})." {
+			t.Errorf("Expected DisclosureHeader to be custom template, got %q", config.Messages.DisclosureHeader)
+		}
+	})
+
+	t.Run("Should not set disclosure-header when bool false", func(t *testing.T) {
+		frontmatter := map[string]any{
+			"name": "Test Workflow",
+			"safe-outputs": map[string]any{
+				"create-issue": nil,
+				"messages": map[string]any{
+					"disclosure-header": false,
+				},
+			},
+		}
+
+		config := compiler.extractSafeOutputsConfig(frontmatter)
+		if config == nil {
+			t.Fatal("Expected SafeOutputsConfig to be parsed")
+		}
+
+		if config.Messages == nil {
+			t.Fatal("Expected Messages to be parsed")
+		}
+
+		if config.Messages.DisclosureHeader != "" {
+			t.Errorf("Expected DisclosureHeader to be empty when bool false is set, got %q", config.Messages.DisclosureHeader)
+		}
+	})
 }
 
 func TestSerializeMessagesConfig(t *testing.T) {
@@ -245,4 +320,32 @@ func TestSerializeMessagesConfig(t *testing.T) {
 			t.Errorf("Expected JSON to NOT contain PascalCase key 'BodyHeader', got: %s", result)
 		}
 	})
+
+	t.Run("Should serialize disclosure-header to camelCase JSON key", func(t *testing.T) {
+		config := &SafeOutputMessagesConfig{
+			DisclosureHeader: "true",
+		}
+
+		result, err := serializeMessagesConfig(config)
+		if err != nil {
+			t.Fatalf("Unexpected error: %v", err)
+		}
+
+		var parsed SafeOutputMessagesConfig
+		if err := json.Unmarshal([]byte(result), &parsed); err != nil {
+			t.Fatalf("Result is not valid JSON: %v", err)
+		}
+
+		if parsed.DisclosureHeader != "true" {
+			t.Errorf("Expected DisclosureHeader to be preserved, got %q", parsed.DisclosureHeader)
+		}
+
+		if !strings.Contains(result, `"disclosureHeader"`) {
+			t.Errorf("Expected JSON to contain camelCase key 'disclosureHeader', got: %s", result)
+		}
+
+		if strings.Contains(result, `"DisclosureHeader"`) {
+			t.Errorf("Expected JSON to NOT contain PascalCase key 'DisclosureHeader', got: %s", result)
+		}
+	})
 }

From eea258e1994f596055862053cde8678452cf8d66 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 9 Jul 2026 05:58:23 +0000
Subject: [PATCH 03/15] Clarify disclosure-header ordering in JSON schema
 description

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 pkg/parser/schemas/main_workflow_schema.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/parser/schemas/main_workflow_schema.json b/pkg/parser/schemas/main_workflow_schema.json
index 3945d316faf..e6ca63a8eec 100644
--- a/pkg/parser/schemas/main_workflow_schema.json
+++ b/pkg/parser/schemas/main_workflow_schema.json
@@ -10510,7 +10510,7 @@
                   "examples": ["> 🤖 This content was generated by [{workflow_name}]({run_url}) and was not written by the account owner."]
                 }
               ],
-              "description": "AI authorship disclosure header prepended to every message body. Set to true for built-in default text, or provide a custom template string. Applied before body-header and after any threat-detection caution alert. Available placeholders: {workflow_name}, {run_url}."
+              "description": "AI authorship disclosure header prepended to every message body. Set to true for built-in default text, or provide a custom template string. Insertion order from top to bottom: threat-detection caution alert (if any) → disclosure-header → body-header → agent-generated content. Available placeholders: {workflow_name}, {run_url}."
             },
             "append-only-comments": {
               "type": "boolean",

From 259ec464a8fa22218c8ab6b714236c5bfccb6ef0 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 9 Jul 2026 13:07:57 +0000
Subject: [PATCH 04/15] Fix unresolved disclosure-header review feedback

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
---
 actions/setup/js/create_discussion.cjs       |  2 +-
 actions/setup/js/create_issue.cjs            |  2 +-
 actions/setup/js/create_pull_request.cjs     |  2 +-
 actions/setup/js/messages_core.cjs           |  1 +
 actions/setup/js/messages_header.cjs         | 15 +++++++++--
 actions/setup/js/messages_header.test.cjs    | 26 +++++++++++++++++---
 pkg/parser/schemas/main_workflow_schema.json |  2 +-
 pkg/workflow/safe_outputs_messages_config.go |  4 ++-
 pkg/workflow/safe_outputs_messages_test.go   |  8 +++---
 9 files changed, 48 insertions(+), 14 deletions(-)

diff --git a/actions/setup/js/create_discussion.cjs b/actions/setup/js/create_discussion.cjs
index ef7a63fa461..43f0022bea6 100644
--- a/actions/setup/js/create_discussion.cjs
+++ b/actions/setup/js/create_discussion.cjs
@@ -545,7 +545,7 @@ async function main(config = {}) {
       bodyLines.unshift(...bodyHeader.split("\n"), "");
     }
 
-    // Inject disclosure header before body header (unshifted after, so it appears first)
+    // Inject disclosure header (this runs after body-header, but appears before it because unshift prepends)
     const disclosureHeader = getDisclosureHeader({ workflowName, runUrl });
     if (disclosureHeader) {
       bodyLines.unshift(...disclosureHeader.split("\n"), "");
diff --git a/actions/setup/js/create_issue.cjs b/actions/setup/js/create_issue.cjs
index 7b5b1b41046..1d02c8f6994 100644
--- a/actions/setup/js/create_issue.cjs
+++ b/actions/setup/js/create_issue.cjs
@@ -883,7 +883,7 @@ async function main(config = {}) {
       bodyLines.unshift(...bodyHeader.split("\n"), "");
     }
 
-    // Inject disclosure header before body header (unshifted after, so it appears first)
+    // Inject disclosure header (this runs after body-header, but appears before it because unshift prepends)
     const disclosureHeader = getDisclosureHeader({ workflowName, runUrl });
     if (disclosureHeader) {
       bodyLines.unshift(...disclosureHeader.split("\n"), "");
diff --git a/actions/setup/js/create_pull_request.cjs b/actions/setup/js/create_pull_request.cjs
index 62419d583aa..fde8a1b329b 100644
--- a/actions/setup/js/create_pull_request.cjs
+++ b/actions/setup/js/create_pull_request.cjs
@@ -1368,7 +1368,7 @@ async function main(config = {}) {
         bodyLines.unshift(...bodyHeader.split("\n"), "");
       }
 
-      // Inject disclosure header before body header (unshifted after, so it appears first)
+      // Inject disclosure header (this runs after body-header, but appears before it because unshift prepends)
       const disclosureHeader = getDisclosureHeader({ workflowName, runUrl });
       if (disclosureHeader) {
         bodyLines.unshift(...disclosureHeader.split("\n"), "");
diff --git a/actions/setup/js/messages_core.cjs b/actions/setup/js/messages_core.cjs
index 26aa863fdba..73e163aa8d4 100644
--- a/actions/setup/js/messages_core.cjs
+++ b/actions/setup/js/messages_core.cjs
@@ -48,6 +48,7 @@ const fs = require("fs");
  * @property {string} [agentFailureComment] - Custom footer template for comments on agent failure tracking issues
  * @property {string} [closeOlderDiscussion] - Custom message for closing older discussions as outdated
  * @property {string} [bodyHeader] - Custom header text prepended to every message body (issues, comments, PRs, discussions). Placeholders: {workflow_name}, {run_url}
+ * @property {string|boolean} [disclosureHeader] - AI authorship disclosure header. Set true/"true" for built-in default or provide a custom template
  * @property {boolean} [appendOnlyComments] - If true, create new comments instead of updating the activation comment
  * @property {string|boolean} [activationComments] - If false or "false", disable all activation/fallback comments entirely. Supports templatable boolean values (default: true)
  */
diff --git a/actions/setup/js/messages_header.cjs b/actions/setup/js/messages_header.cjs
index a63dfb9ada7..dca058ba27c 100644
--- a/actions/setup/js/messages_header.cjs
+++ b/actions/setup/js/messages_header.cjs
@@ -22,6 +22,7 @@ const { getMessages, renderTemplate, toSnakeCase } = require("./messages_core.cj
  * Rendered with the same template placeholders as other message templates.
  */
 const DEFAULT_DISCLOSURE_HEADER = "> 🤖 **Automated content** — generated by the [{workflow_name}]({run_url}) workflow. The account owner did **not** write or review this content personally.";
+const DISCLOSURE_HEADER_DEFAULT_SENTINEL = "true";
 
 /**
  * Get the body header text, using the custom template if configured.
@@ -49,12 +50,21 @@ function getBodyHeader(ctx) {
  */
 function getDisclosureHeader(ctx) {
   const messages = getMessages();
-  if (!messages?.disclosureHeader) {
+  const disclosureHeader = messages?.disclosureHeader;
+  if (!disclosureHeader) {
+    return "";
+  }
+
+  let template = "";
+  if (disclosureHeader === true || disclosureHeader === DISCLOSURE_HEADER_DEFAULT_SENTINEL) {
+    template = DEFAULT_DISCLOSURE_HEADER;
+  } else if (typeof disclosureHeader === "string") {
+    template = disclosureHeader;
+  } else {
     return "";
   }
 
   const templateContext = toSnakeCase(ctx);
-  const template = messages.disclosureHeader === "true" ? DEFAULT_DISCLOSURE_HEADER : messages.disclosureHeader;
   return renderTemplate(template, templateContext);
 }
 
@@ -62,4 +72,5 @@ module.exports = {
   getBodyHeader,
   getDisclosureHeader,
   DEFAULT_DISCLOSURE_HEADER,
+  DISCLOSURE_HEADER_DEFAULT_SENTINEL,
 };
diff --git a/actions/setup/js/messages_header.test.cjs b/actions/setup/js/messages_header.test.cjs
index 2d22d5de347..5529fc67843 100644
--- a/actions/setup/js/messages_header.test.cjs
+++ b/actions/setup/js/messages_header.test.cjs
@@ -11,7 +11,7 @@ const mockCore = {
 };
 global.core = mockCore;
 
-const { getBodyHeader, getDisclosureHeader, DEFAULT_DISCLOSURE_HEADER } = require("./messages_header.cjs");
+const { getBodyHeader, getDisclosureHeader, DEFAULT_DISCLOSURE_HEADER, DISCLOSURE_HEADER_DEFAULT_SENTINEL } = require("./messages_header.cjs");
 
 const WORKFLOW = "My Workflow";
 const RUN_URL = "https://github.com/owner/repo/actions/runs/99";
@@ -80,9 +80,20 @@ describe("messages_header", () => {
       expect(result).toBe("");
     });
 
-    it("returns rendered default text when disclosure-header is 'true'", () => {
+    it("returns rendered default text when disclosure-header is sentinel", () => {
       process.env.GH_AW_SAFE_OUTPUT_MESSAGES = JSON.stringify({
-        disclosureHeader: "true",
+        disclosureHeader: DISCLOSURE_HEADER_DEFAULT_SENTINEL,
+      });
+
+      const result = getDisclosureHeader({ workflowName: WORKFLOW, runUrl: RUN_URL });
+      expect(result).toContain(WORKFLOW);
+      expect(result).toContain(RUN_URL);
+      expect(result).toContain("🤖");
+    });
+
+    it("returns rendered default text when disclosure-header is boolean true", () => {
+      process.env.GH_AW_SAFE_OUTPUT_MESSAGES = JSON.stringify({
+        disclosureHeader: true,
       });
 
       const result = getDisclosureHeader({ workflowName: WORKFLOW, runUrl: RUN_URL });
@@ -109,6 +120,15 @@ describe("messages_header", () => {
       expect(result).toBe("");
     });
 
+    it("returns empty string when disclosure-header is boolean false", () => {
+      process.env.GH_AW_SAFE_OUTPUT_MESSAGES = JSON.stringify({
+        disclosureHeader: false,
+      });
+
+      const result = getDisclosureHeader({ workflowName: WORKFLOW, runUrl: RUN_URL });
+      expect(result).toBe("");
+    });
+
     it("DEFAULT_DISCLOSURE_HEADER contains expected placeholders", () => {
       expect(DEFAULT_DISCLOSURE_HEADER).toContain("{workflow_name}");
       expect(DEFAULT_DISCLOSURE_HEADER).toContain("{run_url}");
diff --git a/pkg/parser/schemas/main_workflow_schema.json b/pkg/parser/schemas/main_workflow_schema.json
index e6ca63a8eec..da379868dec 100644
--- a/pkg/parser/schemas/main_workflow_schema.json
+++ b/pkg/parser/schemas/main_workflow_schema.json
@@ -10502,7 +10502,7 @@
               "oneOf": [
                 {
                   "type": "boolean",
-                  "description": "Set to true to prepend the built-in AI authorship disclosure header to every message body (issues, comments, pull requests, discussions). The default text states the content was automatically generated and was not written or reviewed by the account owner personally."
+                  "description": "Set to true to prepend the built-in AI authorship disclosure header to every message body (issues, comments, pull requests, discussions). Set to false to disable disclosure-header. The default text states the content was automatically generated and was not written or reviewed by the account owner personally."
                 },
                 {
                   "type": "string",
diff --git a/pkg/workflow/safe_outputs_messages_config.go b/pkg/workflow/safe_outputs_messages_config.go
index 8853cdcfb3f..d449ecb063b 100644
--- a/pkg/workflow/safe_outputs_messages_config.go
+++ b/pkg/workflow/safe_outputs_messages_config.go
@@ -9,6 +9,8 @@ import (
 
 var safeOutputMessagesLog = logger.New("workflow:safe_outputs_config_messages")
 
+const disclosureHeaderDefaultSentinel = "true"
+
 // ========================================
 // Safe Output Messages Configuration
 // ========================================
@@ -47,7 +49,7 @@ func parseMessagesConfig(messagesMap map[string]any) *SafeOutputMessagesConfig {
 		switch v := dh.(type) {
 		case bool:
 			if v {
-				config.DisclosureHeader = "true"
+				config.DisclosureHeader = disclosureHeaderDefaultSentinel
 			}
 		case string:
 			config.DisclosureHeader = v
diff --git a/pkg/workflow/safe_outputs_messages_test.go b/pkg/workflow/safe_outputs_messages_test.go
index 8ebee93c3d1..f417c98969d 100644
--- a/pkg/workflow/safe_outputs_messages_test.go
+++ b/pkg/workflow/safe_outputs_messages_test.go
@@ -148,8 +148,8 @@ func TestSafeOutputsMessagesConfiguration(t *testing.T) {
 			t.Fatal("Expected Messages to be parsed")
 		}
 
-		if config.Messages.DisclosureHeader != "true" {
-			t.Errorf("Expected DisclosureHeader to be 'true' when bool true is set, got %q", config.Messages.DisclosureHeader)
+		if config.Messages.DisclosureHeader != disclosureHeaderDefaultSentinel {
+			t.Errorf("Expected DisclosureHeader to be %q when bool true is set, got %q", disclosureHeaderDefaultSentinel, config.Messages.DisclosureHeader)
 		}
 	})
 
@@ -323,7 +323,7 @@ func TestSerializeMessagesConfig(t *testing.T) {
 
 	t.Run("Should serialize disclosure-header to camelCase JSON key", func(t *testing.T) {
 		config := &SafeOutputMessagesConfig{
-			DisclosureHeader: "true",
+			DisclosureHeader: disclosureHeaderDefaultSentinel,
 		}
 
 		result, err := serializeMessagesConfig(config)
@@ -336,7 +336,7 @@ func TestSerializeMessagesConfig(t *testing.T) {
 			t.Fatalf("Result is not valid JSON: %v", err)
 		}
 
-		if parsed.DisclosureHeader != "true" {
+		if parsed.DisclosureHeader != disclosureHeaderDefaultSentinel {
 			t.Errorf("Expected DisclosureHeader to be preserved, got %q", parsed.DisclosureHeader)
 		}
 

From 0d150f56509f0c681dafeb2b77160b2d12bbc360 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 9 Jul 2026 18:25:40 +0000
Subject: [PATCH 05/15] Refactor disclosure header default into prompt markdown

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 actions/setup/js/messages_header.cjs          | 26 +++++++++++++++----
 .../md/safe_outputs_disclosure_header.md      |  1 +
 2 files changed, 22 insertions(+), 5 deletions(-)
 create mode 100644 actions/setup/md/safe_outputs_disclosure_header.md

diff --git a/actions/setup/js/messages_header.cjs b/actions/setup/js/messages_header.cjs
index dca058ba27c..74b1bbb81ed 100644
--- a/actions/setup/js/messages_header.cjs
+++ b/actions/setup/js/messages_header.cjs
@@ -9,7 +9,9 @@
  * (issues, comments, pull requests, discussions).
  */
 
-const { getMessages, renderTemplate, toSnakeCase } = require("./messages_core.cjs");
+const fs = require("fs");
+const path = require("path");
+const { getMessages, getPromptPath, renderTemplate, toSnakeCase } = require("./messages_core.cjs");
 
 /**
  * @typedef {Object} BodyHeaderContext
@@ -17,12 +19,26 @@ const { getMessages, renderTemplate, toSnakeCase } = require("./messages_core.cj
  * @property {string} runUrl - URL of the workflow run
  */
 
+const DEFAULT_DISCLOSURE_HEADER_TEMPLATE = "safe_outputs_disclosure_header.md";
+const DEFAULT_DISCLOSURE_HEADER_FALLBACK = "> 🤖 **Automated content** — generated by the [{workflow_name}]({run_url}) workflow. The account owner did **not** write or review this content personally.";
+const DISCLOSURE_HEADER_DEFAULT_SENTINEL = "true";
+
 /**
- * Default AI authorship disclosure text used when disclosure-header is set to true.
- * Rendered with the same template placeholders as other message templates.
+ * Load the default disclosure-header template from prompt markdown.
+ * Falls back to an inline template if the file is unavailable.
+ * @returns {string}
  */
-const DEFAULT_DISCLOSURE_HEADER = "> 🤖 **Automated content** — generated by the [{workflow_name}]({run_url}) workflow. The account owner did **not** write or review this content personally.";
-const DISCLOSURE_HEADER_DEFAULT_SENTINEL = "true";
+function getDefaultDisclosureHeaderTemplate() {
+  try {
+    const hasRuntimePromptsDir = !!(process.env.RUNNER_TEMP || process.env.GH_AW_PROMPTS_DIR);
+    const templatePath = hasRuntimePromptsDir ? getPromptPath(DEFAULT_DISCLOSURE_HEADER_TEMPLATE) : path.join(__dirname, "../md", DEFAULT_DISCLOSURE_HEADER_TEMPLATE);
+    return fs.readFileSync(templatePath, "utf8").trimEnd();
+  } catch {
+    return DEFAULT_DISCLOSURE_HEADER_FALLBACK;
+  }
+}
+
+const DEFAULT_DISCLOSURE_HEADER = getDefaultDisclosureHeaderTemplate();
 
 /**
  * Get the body header text, using the custom template if configured.
diff --git a/actions/setup/md/safe_outputs_disclosure_header.md b/actions/setup/md/safe_outputs_disclosure_header.md
new file mode 100644
index 00000000000..5a36d25c53e
--- /dev/null
+++ b/actions/setup/md/safe_outputs_disclosure_header.md
@@ -0,0 +1 @@
+> 🤖 **Automated content** — generated by the [{workflow_name}]({run_url}) workflow. The account owner did **not** write or review this content personally.

From 892581a02e854247327930b42929854e528ff0d4 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 9 Jul 2026 18:30:01 +0000
Subject: [PATCH 06/15] Clarify runtime prompt selection naming for disclosure
 header

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 actions/setup/js/messages_header.cjs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/actions/setup/js/messages_header.cjs b/actions/setup/js/messages_header.cjs
index 74b1bbb81ed..c8702ad869a 100644
--- a/actions/setup/js/messages_header.cjs
+++ b/actions/setup/js/messages_header.cjs
@@ -30,8 +30,8 @@ const DISCLOSURE_HEADER_DEFAULT_SENTINEL = "true";
  */
 function getDefaultDisclosureHeaderTemplate() {
   try {
-    const hasRuntimePromptsDir = !!(process.env.RUNNER_TEMP || process.env.GH_AW_PROMPTS_DIR);
-    const templatePath = hasRuntimePromptsDir ? getPromptPath(DEFAULT_DISCLOSURE_HEADER_TEMPLATE) : path.join(__dirname, "../md", DEFAULT_DISCLOSURE_HEADER_TEMPLATE);
+    const shouldUseRuntimePrompts = !!(process.env.RUNNER_TEMP || process.env.GH_AW_PROMPTS_DIR);
+    const templatePath = shouldUseRuntimePrompts ? getPromptPath(DEFAULT_DISCLOSURE_HEADER_TEMPLATE) : path.join(__dirname, "../md", DEFAULT_DISCLOSURE_HEADER_TEMPLATE);
     return fs.readFileSync(templatePath, "utf8").trimEnd();
   } catch {
     return DEFAULT_DISCLOSURE_HEADER_FALLBACK;

From 84ac639756b832db64ce89b685ef39315f4fa85c Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 9 Jul 2026 18:34:28 +0000
Subject: [PATCH 07/15] Extract disclosure template path resolution helper

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 actions/setup/js/messages_header.cjs | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/actions/setup/js/messages_header.cjs b/actions/setup/js/messages_header.cjs
index c8702ad869a..b55a9426215 100644
--- a/actions/setup/js/messages_header.cjs
+++ b/actions/setup/js/messages_header.cjs
@@ -23,6 +23,15 @@ const DEFAULT_DISCLOSURE_HEADER_TEMPLATE = "safe_outputs_disclosure_header.md";
 const DEFAULT_DISCLOSURE_HEADER_FALLBACK = "> 🤖 **Automated content** — generated by the [{workflow_name}]({run_url}) workflow. The account owner did **not** write or review this content personally.";
 const DISCLOSURE_HEADER_DEFAULT_SENTINEL = "true";
 
+/**
+ * Resolve disclosure-header template path for runtime or source-tree execution.
+ * @returns {string}
+ */
+function resolveDefaultDisclosureHeaderTemplatePath() {
+  const shouldUseRuntimePath = !!(process.env.RUNNER_TEMP || process.env.GH_AW_PROMPTS_DIR);
+  return shouldUseRuntimePath ? getPromptPath(DEFAULT_DISCLOSURE_HEADER_TEMPLATE) : path.join(__dirname, "../md", DEFAULT_DISCLOSURE_HEADER_TEMPLATE);
+}
+
 /**
  * Load the default disclosure-header template from prompt markdown.
  * Falls back to an inline template if the file is unavailable.
@@ -30,10 +39,12 @@ const DISCLOSURE_HEADER_DEFAULT_SENTINEL = "true";
  */
 function getDefaultDisclosureHeaderTemplate() {
   try {
-    const shouldUseRuntimePrompts = !!(process.env.RUNNER_TEMP || process.env.GH_AW_PROMPTS_DIR);
-    const templatePath = shouldUseRuntimePrompts ? getPromptPath(DEFAULT_DISCLOSURE_HEADER_TEMPLATE) : path.join(__dirname, "../md", DEFAULT_DISCLOSURE_HEADER_TEMPLATE);
+    const templatePath = resolveDefaultDisclosureHeaderTemplatePath();
     return fs.readFileSync(templatePath, "utf8").trimEnd();
-  } catch {
+  } catch (error) {
+    if (typeof globalThis.core?.warning === "function") {
+      globalThis.core.warning(`Failed to load ${DEFAULT_DISCLOSURE_HEADER_TEMPLATE}: ${String(error)}`);
+    }
     return DEFAULT_DISCLOSURE_HEADER_FALLBACK;
   }
 }

From 42988c274c03c7358d2d487f891b5e59558f912e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 10 Jul 2026 04:10:41 +0000
Subject: [PATCH 08/15] Shorten default disclosure header text

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 actions/setup/js/messages_header.cjs               |  2 +-
 actions/setup/js/messages_header.test.cjs          | 12 ++++++------
 actions/setup/md/safe_outputs_disclosure_header.md |  2 +-
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/actions/setup/js/messages_header.cjs b/actions/setup/js/messages_header.cjs
index b55a9426215..2e46fe74661 100644
--- a/actions/setup/js/messages_header.cjs
+++ b/actions/setup/js/messages_header.cjs
@@ -20,7 +20,7 @@ const { getMessages, getPromptPath, renderTemplate, toSnakeCase } = require("./m
  */
 
 const DEFAULT_DISCLOSURE_HEADER_TEMPLATE = "safe_outputs_disclosure_header.md";
-const DEFAULT_DISCLOSURE_HEADER_FALLBACK = "> 🤖 **Automated content** — generated by the [{workflow_name}]({run_url}) workflow. The account owner did **not** write or review this content personally.";
+const DEFAULT_DISCLOSURE_HEADER_FALLBACK = "> **Automated content** generated by the {workflow_name} workflow.";
 const DISCLOSURE_HEADER_DEFAULT_SENTINEL = "true";
 
 /**
diff --git a/actions/setup/js/messages_header.test.cjs b/actions/setup/js/messages_header.test.cjs
index 5529fc67843..4a4fd5e5441 100644
--- a/actions/setup/js/messages_header.test.cjs
+++ b/actions/setup/js/messages_header.test.cjs
@@ -87,8 +87,8 @@ describe("messages_header", () => {
 
       const result = getDisclosureHeader({ workflowName: WORKFLOW, runUrl: RUN_URL });
       expect(result).toContain(WORKFLOW);
-      expect(result).toContain(RUN_URL);
-      expect(result).toContain("🤖");
+      expect(result).not.toContain(RUN_URL);
+      expect(result).not.toContain("🤖");
     });
 
     it("returns rendered default text when disclosure-header is boolean true", () => {
@@ -98,8 +98,8 @@ describe("messages_header", () => {
 
       const result = getDisclosureHeader({ workflowName: WORKFLOW, runUrl: RUN_URL });
       expect(result).toContain(WORKFLOW);
-      expect(result).toContain(RUN_URL);
-      expect(result).toContain("🤖");
+      expect(result).not.toContain(RUN_URL);
+      expect(result).not.toContain("🤖");
     });
 
     it("returns rendered custom template when disclosure-header is a string", () => {
@@ -131,8 +131,8 @@ describe("messages_header", () => {
 
     it("DEFAULT_DISCLOSURE_HEADER contains expected placeholders", () => {
       expect(DEFAULT_DISCLOSURE_HEADER).toContain("{workflow_name}");
-      expect(DEFAULT_DISCLOSURE_HEADER).toContain("{run_url}");
-      expect(DEFAULT_DISCLOSURE_HEADER).toContain("🤖");
+      expect(DEFAULT_DISCLOSURE_HEADER).not.toContain("{run_url}");
+      expect(DEFAULT_DISCLOSURE_HEADER).not.toContain("🤖");
     });
   });
 });
diff --git a/actions/setup/md/safe_outputs_disclosure_header.md b/actions/setup/md/safe_outputs_disclosure_header.md
index 5a36d25c53e..24509568df0 100644
--- a/actions/setup/md/safe_outputs_disclosure_header.md
+++ b/actions/setup/md/safe_outputs_disclosure_header.md
@@ -1 +1 @@
-> 🤖 **Automated content** — generated by the [{workflow_name}]({run_url}) workflow. The account owner did **not** write or review this content personally.
+> **Automated content** generated by the {workflow_name} workflow.

From d01914998af47c1dce240bc8d768bbbb6eb8066b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 10 Jul 2026 04:27:42 +0000
Subject: [PATCH 09/15] Remove disclosure-header default text fallback

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 actions/setup/js/messages_header.cjs | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/actions/setup/js/messages_header.cjs b/actions/setup/js/messages_header.cjs
index 2e46fe74661..352b20b0d85 100644
--- a/actions/setup/js/messages_header.cjs
+++ b/actions/setup/js/messages_header.cjs
@@ -20,7 +20,6 @@ const { getMessages, getPromptPath, renderTemplate, toSnakeCase } = require("./m
  */
 
 const DEFAULT_DISCLOSURE_HEADER_TEMPLATE = "safe_outputs_disclosure_header.md";
-const DEFAULT_DISCLOSURE_HEADER_FALLBACK = "> **Automated content** generated by the {workflow_name} workflow.";
 const DISCLOSURE_HEADER_DEFAULT_SENTINEL = "true";
 
 /**
@@ -29,12 +28,18 @@ const DISCLOSURE_HEADER_DEFAULT_SENTINEL = "true";
  */
 function resolveDefaultDisclosureHeaderTemplatePath() {
   const shouldUseRuntimePath = !!(process.env.RUNNER_TEMP || process.env.GH_AW_PROMPTS_DIR);
-  return shouldUseRuntimePath ? getPromptPath(DEFAULT_DISCLOSURE_HEADER_TEMPLATE) : path.join(__dirname, "../md", DEFAULT_DISCLOSURE_HEADER_TEMPLATE);
+  const sourceTreePath = path.join(__dirname, "../md", DEFAULT_DISCLOSURE_HEADER_TEMPLATE);
+  if (!shouldUseRuntimePath) {
+    return sourceTreePath;
+  }
+
+  const runtimePath = getPromptPath(DEFAULT_DISCLOSURE_HEADER_TEMPLATE);
+  return fs.existsSync(runtimePath) ? runtimePath : sourceTreePath;
 }
 
 /**
  * Load the default disclosure-header template from prompt markdown.
- * Falls back to an inline template if the file is unavailable.
+ * Returns an empty template when the file is unavailable.
  * @returns {string}
  */
 function getDefaultDisclosureHeaderTemplate() {
@@ -45,7 +50,7 @@ function getDefaultDisclosureHeaderTemplate() {
     if (typeof globalThis.core?.warning === "function") {
       globalThis.core.warning(`Failed to load ${DEFAULT_DISCLOSURE_HEADER_TEMPLATE}: ${String(error)}`);
     }
-    return DEFAULT_DISCLOSURE_HEADER_FALLBACK;
+    return "";
   }
 }
 

From 9ce898408bd4a350bb8d0c08b7ef3067ee1ca6a4 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 10 Jul 2026 04:31:30 +0000
Subject: [PATCH 10/15] Clarify disclosure template path warnings

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 actions/setup/js/messages_header.cjs | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/actions/setup/js/messages_header.cjs b/actions/setup/js/messages_header.cjs
index 352b20b0d85..75397c3d8f5 100644
--- a/actions/setup/js/messages_header.cjs
+++ b/actions/setup/js/messages_header.cjs
@@ -34,7 +34,15 @@ function resolveDefaultDisclosureHeaderTemplatePath() {
   }
 
   const runtimePath = getPromptPath(DEFAULT_DISCLOSURE_HEADER_TEMPLATE);
-  return fs.existsSync(runtimePath) ? runtimePath : sourceTreePath;
+  if (fs.existsSync(runtimePath)) {
+    return runtimePath;
+  }
+
+  if (typeof globalThis.core?.warning === "function") {
+    globalThis.core.warning(`Missing runtime disclosure template at ${runtimePath}; using source template ${sourceTreePath}`);
+  }
+
+  return sourceTreePath;
 }
 
 /**
@@ -43,12 +51,12 @@ function resolveDefaultDisclosureHeaderTemplatePath() {
  * @returns {string}
  */
 function getDefaultDisclosureHeaderTemplate() {
+  const templatePath = resolveDefaultDisclosureHeaderTemplatePath();
   try {
-    const templatePath = resolveDefaultDisclosureHeaderTemplatePath();
     return fs.readFileSync(templatePath, "utf8").trimEnd();
   } catch (error) {
     if (typeof globalThis.core?.warning === "function") {
-      globalThis.core.warning(`Failed to load ${DEFAULT_DISCLOSURE_HEADER_TEMPLATE}: ${String(error)}`);
+      globalThis.core.warning(`Failed to load disclosure template from ${templatePath}: ${String(error)}`);
     }
     return "";
   }

From 834f6ab779e544c7c1efe8a172708ce34bf6df0c Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 10 Jul 2026 04:44:42 +0000
Subject: [PATCH 11/15] Remove source-tree fallback for disclosure header
 template

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 actions/setup/js/messages_header.cjs      | 28 ++---------------------
 actions/setup/js/messages_header.test.cjs | 11 +++++++++
 2 files changed, 13 insertions(+), 26 deletions(-)

diff --git a/actions/setup/js/messages_header.cjs b/actions/setup/js/messages_header.cjs
index 75397c3d8f5..5bc8bb6a227 100644
--- a/actions/setup/js/messages_header.cjs
+++ b/actions/setup/js/messages_header.cjs
@@ -10,7 +10,6 @@
  */
 
 const fs = require("fs");
-const path = require("path");
 const { getMessages, getPromptPath, renderTemplate, toSnakeCase } = require("./messages_core.cjs");
 
 /**
@@ -22,41 +21,18 @@ const { getMessages, getPromptPath, renderTemplate, toSnakeCase } = require("./m
 const DEFAULT_DISCLOSURE_HEADER_TEMPLATE = "safe_outputs_disclosure_header.md";
 const DISCLOSURE_HEADER_DEFAULT_SENTINEL = "true";
 
-/**
- * Resolve disclosure-header template path for runtime or source-tree execution.
- * @returns {string}
- */
-function resolveDefaultDisclosureHeaderTemplatePath() {
-  const shouldUseRuntimePath = !!(process.env.RUNNER_TEMP || process.env.GH_AW_PROMPTS_DIR);
-  const sourceTreePath = path.join(__dirname, "../md", DEFAULT_DISCLOSURE_HEADER_TEMPLATE);
-  if (!shouldUseRuntimePath) {
-    return sourceTreePath;
-  }
-
-  const runtimePath = getPromptPath(DEFAULT_DISCLOSURE_HEADER_TEMPLATE);
-  if (fs.existsSync(runtimePath)) {
-    return runtimePath;
-  }
-
-  if (typeof globalThis.core?.warning === "function") {
-    globalThis.core.warning(`Missing runtime disclosure template at ${runtimePath}; using source template ${sourceTreePath}`);
-  }
-
-  return sourceTreePath;
-}
-
 /**
  * Load the default disclosure-header template from prompt markdown.
  * Returns an empty template when the file is unavailable.
  * @returns {string}
  */
 function getDefaultDisclosureHeaderTemplate() {
-  const templatePath = resolveDefaultDisclosureHeaderTemplatePath();
   try {
+    const templatePath = getPromptPath(DEFAULT_DISCLOSURE_HEADER_TEMPLATE);
     return fs.readFileSync(templatePath, "utf8").trimEnd();
   } catch (error) {
     if (typeof globalThis.core?.warning === "function") {
-      globalThis.core.warning(`Failed to load disclosure template from ${templatePath}: ${String(error)}`);
+      globalThis.core.warning(`Failed to load disclosure template ${DEFAULT_DISCLOSURE_HEADER_TEMPLATE}: ${String(error)}`);
     }
     return "";
   }
diff --git a/actions/setup/js/messages_header.test.cjs b/actions/setup/js/messages_header.test.cjs
index 4a4fd5e5441..5685571142a 100644
--- a/actions/setup/js/messages_header.test.cjs
+++ b/actions/setup/js/messages_header.test.cjs
@@ -1,5 +1,7 @@
 // @ts-check
 import { describe, it, expect, beforeEach, vi } from "vitest";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
 
 // messages_core.cjs calls core.warning on parse failures - provide a stub
 const mockCore = {
@@ -11,7 +13,16 @@ const mockCore = {
 };
 global.core = mockCore;
 
+const originalPromptsDir = process.env.GH_AW_PROMPTS_DIR;
+if (!process.env.GH_AW_PROMPTS_DIR) {
+  process.env.GH_AW_PROMPTS_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), "../md");
+}
 const { getBodyHeader, getDisclosureHeader, DEFAULT_DISCLOSURE_HEADER, DISCLOSURE_HEADER_DEFAULT_SENTINEL } = require("./messages_header.cjs");
+if (originalPromptsDir === undefined) {
+  delete process.env.GH_AW_PROMPTS_DIR;
+} else {
+  process.env.GH_AW_PROMPTS_DIR = originalPromptsDir;
+}
 
 const WORKFLOW = "My Workflow";
 const RUN_URL = "https://github.com/owner/repo/actions/runs/99";

From 73349167ff9144a2b6a956861c6cc77991096ff2 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 10 Jul 2026 04:48:44 +0000
Subject: [PATCH 12/15] Isolate messages_header prompt env setup in test hooks

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 actions/setup/js/messages_header.test.cjs | 36 ++++++++++++++++-------
 1 file changed, 25 insertions(+), 11 deletions(-)

diff --git a/actions/setup/js/messages_header.test.cjs b/actions/setup/js/messages_header.test.cjs
index 5685571142a..8b0a2a3aef5 100644
--- a/actions/setup/js/messages_header.test.cjs
+++ b/actions/setup/js/messages_header.test.cjs
@@ -1,5 +1,6 @@
 // @ts-check
-import { describe, it, expect, beforeEach, vi } from "vitest";
+import { describe, it, expect, beforeAll, beforeEach, afterAll, vi } from "vitest";
+import { createRequire } from "node:module";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -13,21 +14,34 @@ const mockCore = {
 };
 global.core = mockCore;
 
-const originalPromptsDir = process.env.GH_AW_PROMPTS_DIR;
-if (!process.env.GH_AW_PROMPTS_DIR) {
-  process.env.GH_AW_PROMPTS_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), "../md");
-}
-const { getBodyHeader, getDisclosureHeader, DEFAULT_DISCLOSURE_HEADER, DISCLOSURE_HEADER_DEFAULT_SENTINEL } = require("./messages_header.cjs");
-if (originalPromptsDir === undefined) {
-  delete process.env.GH_AW_PROMPTS_DIR;
-} else {
-  process.env.GH_AW_PROMPTS_DIR = originalPromptsDir;
-}
+const require = createRequire(import.meta.url);
+let originalPromptsDir;
+let getBodyHeader;
+let getDisclosureHeader;
+let DEFAULT_DISCLOSURE_HEADER;
+let DISCLOSURE_HEADER_DEFAULT_SENTINEL;
 
 const WORKFLOW = "My Workflow";
 const RUN_URL = "https://github.com/owner/repo/actions/runs/99";
 
 describe("messages_header", () => {
+  beforeAll(() => {
+    originalPromptsDir = process.env.GH_AW_PROMPTS_DIR;
+    if (!process.env.GH_AW_PROMPTS_DIR) {
+      process.env.GH_AW_PROMPTS_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), "../md");
+    }
+    vi.resetModules();
+    ({ getBodyHeader, getDisclosureHeader, DEFAULT_DISCLOSURE_HEADER, DISCLOSURE_HEADER_DEFAULT_SENTINEL } = require("./messages_header.cjs"));
+  });
+
+  afterAll(() => {
+    if (originalPromptsDir === undefined) {
+      delete process.env.GH_AW_PROMPTS_DIR;
+    } else {
+      process.env.GH_AW_PROMPTS_DIR = originalPromptsDir;
+    }
+  });
+
   beforeEach(() => {
     vi.clearAllMocks();
     delete process.env.GH_AW_SAFE_OUTPUT_MESSAGES;

From e58147197aa54c3d23d0ab071777e239821b3713 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 10 Jul 2026 04:52:13 +0000
Subject: [PATCH 13/15] Make messages_header test prompt path setup
 deterministic

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 actions/setup/js/messages_header.test.cjs | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/actions/setup/js/messages_header.test.cjs b/actions/setup/js/messages_header.test.cjs
index 8b0a2a3aef5..0a1b8ca56d2 100644
--- a/actions/setup/js/messages_header.test.cjs
+++ b/actions/setup/js/messages_header.test.cjs
@@ -27,9 +27,7 @@ const RUN_URL = "https://github.com/owner/repo/actions/runs/99";
 describe("messages_header", () => {
   beforeAll(() => {
     originalPromptsDir = process.env.GH_AW_PROMPTS_DIR;
-    if (!process.env.GH_AW_PROMPTS_DIR) {
-      process.env.GH_AW_PROMPTS_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), "../md");
-    }
+    process.env.GH_AW_PROMPTS_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), "../md");
     vi.resetModules();
     ({ getBodyHeader, getDisclosureHeader, DEFAULT_DISCLOSURE_HEADER, DISCLOSURE_HEADER_DEFAULT_SENTINEL } = require("./messages_header.cjs"));
   });

From 4f3d09ce19b74d6e5cf2a7432d96588d6d3e3cd9 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 10 Jul 2026 05:04:06 +0000
Subject: [PATCH 14/15] Remove disclosure-header fallback guards

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 actions/setup/js/messages_header.cjs | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/actions/setup/js/messages_header.cjs b/actions/setup/js/messages_header.cjs
index 5bc8bb6a227..2876858f0cf 100644
--- a/actions/setup/js/messages_header.cjs
+++ b/actions/setup/js/messages_header.cjs
@@ -23,19 +23,11 @@ const DISCLOSURE_HEADER_DEFAULT_SENTINEL = "true";
 
 /**
  * Load the default disclosure-header template from prompt markdown.
- * Returns an empty template when the file is unavailable.
  * @returns {string}
  */
 function getDefaultDisclosureHeaderTemplate() {
-  try {
-    const templatePath = getPromptPath(DEFAULT_DISCLOSURE_HEADER_TEMPLATE);
-    return fs.readFileSync(templatePath, "utf8").trimEnd();
-  } catch (error) {
-    if (typeof globalThis.core?.warning === "function") {
-      globalThis.core.warning(`Failed to load disclosure template ${DEFAULT_DISCLOSURE_HEADER_TEMPLATE}: ${String(error)}`);
-    }
-    return "";
-  }
+  const templatePath = getPromptPath(DEFAULT_DISCLOSURE_HEADER_TEMPLATE);
+  return fs.readFileSync(templatePath, "utf8").trimEnd();
 }
 
 const DEFAULT_DISCLOSURE_HEADER = getDefaultDisclosureHeaderTemplate();

From 36ff9e0b11bcd1ae4c9c2b0d6e39326d008aefba Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 10 Jul 2026 05:47:13 +0000
Subject: [PATCH 15/15] refactor: use renderTemplateFromFile for disclosure
 header template

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 actions/setup/js/messages_header.cjs | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/actions/setup/js/messages_header.cjs b/actions/setup/js/messages_header.cjs
index 2876858f0cf..87fdcea0509 100644
--- a/actions/setup/js/messages_header.cjs
+++ b/actions/setup/js/messages_header.cjs
@@ -9,8 +9,7 @@
  * (issues, comments, pull requests, discussions).
  */
 
-const fs = require("fs");
-const { getMessages, getPromptPath, renderTemplate, toSnakeCase } = require("./messages_core.cjs");
+const { getMessages, getPromptPath, renderTemplate, renderTemplateFromFile, toSnakeCase } = require("./messages_core.cjs");
 
 /**
  * @typedef {Object} BodyHeaderContext
@@ -21,16 +20,7 @@ const { getMessages, getPromptPath, renderTemplate, toSnakeCase } = require("./m
 const DEFAULT_DISCLOSURE_HEADER_TEMPLATE = "safe_outputs_disclosure_header.md";
 const DISCLOSURE_HEADER_DEFAULT_SENTINEL = "true";
 
-/**
- * Load the default disclosure-header template from prompt markdown.
- * @returns {string}
- */
-function getDefaultDisclosureHeaderTemplate() {
-  const templatePath = getPromptPath(DEFAULT_DISCLOSURE_HEADER_TEMPLATE);
-  return fs.readFileSync(templatePath, "utf8").trimEnd();
-}
-
-const DEFAULT_DISCLOSURE_HEADER = getDefaultDisclosureHeaderTemplate();
+const DEFAULT_DISCLOSURE_HEADER = renderTemplateFromFile(getPromptPath(DEFAULT_DISCLOSURE_HEADER_TEMPLATE), {}).trimEnd();
 
 /**
  * Get the body header text, using the custom template if configured.