feat: add safe-outputs.failure-issue-repo to redirect failure issues to a different repo (#20429)

Author: Copilot

actions/setup/js/handle_agent_failure.cjs

@@ -77,10 +77,14 @@ async function findPullRequestForCurrentBranch() {
 /**
  * Search for or create the parent issue for all agentic workflow failures
  * @param {number|null} previousParentNumber - Previous parent issue number if creating due to limit
+ * @param {string} [ownerOverride] - Repository owner override (from failure-issue-repo config)
+ * @param {string} [repoOverride] - Repository name override (from failure-issue-repo config)
  * @returns {Promise<{number: number, node_id: string}>} Parent issue number and node ID
  */
-async function ensureParentIssue(previousParentNumber = null) {
-  const { owner, repo } = context.repo;
+async function ensureParentIssue(previousParentNumber = null, ownerOverride, repoOverride) {
+  const { owner: contextOwner, repo: contextRepo } = context.repo;
+  const owner = ownerOverride || contextOwner;
+  const repo = repoOverride || contextRepo;
   const parentTitle = "[aw] Failed runs";
   const parentLabel = "agentic-workflows";
 
@@ -696,7 +700,18 @@ async function main() {
       return;
     }
 
-    const { owner, repo } = context.repo;
+    // Determine the target repository for failure issues
+    // If GH_AW_FAILURE_ISSUE_REPO is set, use that repo instead of the current repo
+    const failureIssueRepo = process.env.GH_AW_FAILURE_ISSUE_REPO || "";
+    let owner, repo;
+    if (failureIssueRepo && failureIssueRepo.includes("/")) {
+      const parts = failureIssueRepo.split("/");
+      owner = parts[0];
+      repo = parts[1];
+      core.info(`Using configured failure issue repo: ${owner}/${repo}`);
+    } else {
+      ({ owner, repo } = context.repo);
+    }
 
     // Try to find a pull request for the current branch
     const pullRequest = await findPullRequestForCurrentBranch();
@@ -708,7 +723,7 @@ async function main() {
     let parentIssue;
     if (groupReports) {
       try {
-        parentIssue = await ensureParentIssue();
+        parentIssue = await ensureParentIssue(null, owner, repo);
       } catch (error) {
         core.warning(`Could not create parent issue, proceeding without parent: ${getErrorMessage(error)}`);
         // Continue without parent issue

docs/src/content/docs/reference/glossary.md

@@ -139,6 +139,17 @@ safe-outputs:
 
 See [Safe Outputs Reference](/gh-aw/reference/safe-outputs/).
 
+### Failure Issue Repository (`failure-issue-repo:`)
+
+A `safe-outputs` option that redirects failure tracking issues to a different repository. Useful when the workflow's repository has issues disabled:
+
+```yaml
+safe-outputs:
+  failure-issue-repo: github/docs-engineering
+```
+
+See [Safe Outputs Reference](/gh-aw/reference/safe-outputs/).
+
 ### Upload Assets
 
 A safe output capability for uploading generated files (screenshots, charts, reports) to an orphaned git branch for persistent storage. The AI calls the `upload_asset` tool to register files, which are committed to a dedicated assets branch by a separate permission-controlled job. Assets are accessible via GitHub raw URLs. Commonly used for visual testing artifacts, data visualizations, and generated documentation.

docs/src/content/docs/reference/safe-outputs.md

@@ -1232,6 +1232,18 @@ safe-outputs:
 
 This mirrors the `noop.report-as-issue` pattern. Use this to silence noisy failure reports for workflows where failures are expected or handled externally.
 
+### Failure Issue Repository (`failure-issue-repo:`)
+
+Redirects failure tracking issues to a different repository. Useful when the current repository has issues disabled (e.g. `github/docs-internal`).
+
+```yaml wrap
+safe-outputs:
+  failure-issue-repo: github/docs-engineering
+  create-issue:
+```
+
+The value must be in `owner/repo` format. The `GITHUB_TOKEN` used must have permission to create issues in the target repository. When not set, failure issues are created in the current repository.
+
 ### Group Reports (`group-reports:`)
 
 Controls whether failed workflow runs are grouped under a parent "[aw] Failed runs" issue. This is opt-in and defaults to `false`.

pkg/parser/schemas/main_workflow_schema.json

@@ -7198,6 +7198,12 @@
           "default": true,
           "examples": [false, true]
         },
+        "failure-issue-repo": {
+          "type": "string",
+          "description": "Repository to create failure tracking issues in, in the format 'owner/repo'. Useful when the current repository has issues disabled. Defaults to the current repository.",
+          "pattern": "^[^/]+/[^/]+$",
+          "examples": ["github/docs-engineering", "myorg/infra-alerts"]
+        },
         "max-bot-mentions": {
           "description": "Maximum number of bot trigger references (e.g. 'fixes #123', 'closes #456') allowed in output before all of them are neutralized. Default: 10. Supports integer or GitHub Actions expression (e.g. '${{ inputs.max-bot-mentions }}').",
           "oneOf": [

pkg/workflow/compiler_types.go

@@ -498,6 +498,7 @@ type SafeOutputsConfig struct {
 	Footer                          *bool                                  `yaml:"footer,omitempty"`                    // Global footer control - when false, omits visible footer from all safe outputs (XML markers still included)
 	GroupReports                    bool                                   `yaml:"group-reports,omitempty"`             // If true, create parent "Failed runs" issue for agent failures (default: false)
 	ReportFailureAsIssue            *bool                                  `yaml:"report-failure-as-issue,omitempty"`   // If false, disables creating failure tracking issues when workflows fail (default: true)
+	FailureIssueRepo                string                                 `yaml:"failure-issue-repo,omitempty"`        // Repository to create failure issues in (format: "owner/repo"), defaults to current repo
 	MaxBotMentions                  *string                                `yaml:"max-bot-mentions,omitempty"`          // Maximum bot trigger references (e.g. 'fixes #123') allowed before filtering. Default: 10. Supports integer or GitHub Actions expression.
 	Steps                           []any                                  `yaml:"steps,omitempty"`                     // User-provided steps injected after setup/checkout and before safe-output code
 	IDToken                         *string                                `yaml:"id-token,omitempty"`                  // Override id-token permission: "write" to force-add, "none" to disable auto-detection

pkg/workflow/imports.go

@@ -687,6 +687,9 @@ func mergeSafeOutputConfig(result *SafeOutputsConfig, config map[string]any, c *
 	if !result.GroupReports && importedConfig.GroupReports {
 		result.GroupReports = true
 	}
+	if result.FailureIssueRepo == "" && importedConfig.FailureIssueRepo != "" {
+		result.FailureIssueRepo = importedConfig.FailureIssueRepo
+	}
 	if result.MaxBotMentions == nil && importedConfig.MaxBotMentions != nil {
 		result.MaxBotMentions = importedConfig.MaxBotMentions
 	}

pkg/workflow/notify_comment.go

@@ -205,6 +205,11 @@ func (c *Compiler) buildConclusionJob(data *WorkflowData, mainJobName string, sa
 		agentFailureEnvVars = append(agentFailureEnvVars, "          GH_AW_FAILURE_REPORT_AS_ISSUE: \"true\"\n")
 	}
 
+	// Pass failure-issue-repo configuration (optional, defaults to current repo)
+	if data.SafeOutputs != nil && data.SafeOutputs.FailureIssueRepo != "" {
+		agentFailureEnvVars = append(agentFailureEnvVars, fmt.Sprintf("          GH_AW_FAILURE_ISSUE_REPO: %q\n", data.SafeOutputs.FailureIssueRepo))
+	}
+
 	// Pass timeout minutes value so the failure handler can provide an actionable hint when timed out
 	timeoutValue := strings.TrimPrefix(data.TimeoutMinutes, "timeout-minutes: ")
 	if timeoutValue != "" {

pkg/workflow/safe_outputs_config.go

@@ -469,6 +469,14 @@ func (c *Compiler) extractSafeOutputsConfig(frontmatter map[string]any) *SafeOut
 				}
 			}
 
+			// Handle failure-issue-repo (repository for failure issues, format: "owner/repo")
+			if failureIssueRepo, exists := outputMap["failure-issue-repo"]; exists {
+				if failureIssueRepoStr, ok := failureIssueRepo.(string); ok && failureIssueRepoStr != "" {
+					config.FailureIssueRepo = failureIssueRepoStr
+					safeOutputsConfigLog.Printf("Failure issue repo: %s", failureIssueRepoStr)
+				}
+			}
+
 			// Handle max-bot-mentions (templatable integer)
 			if err := preprocessIntFieldAsString(outputMap, "max-bot-mentions", safeOutputsConfigLog); err != nil {
 				safeOutputsConfigLog.Printf("max-bot-mentions: %v", err)