[q] Fix notion-issue-summary workflow safe-outputs configuration

[github-actions]

Summary

This PR addresses a finding from the Agentic Workflow Audit Report (Discussion #13735) by adding safe-outputs configuration to the notion-issue-summary.md workflow.

Investigation Findings

The audit report identified 9 workflows without safe-outputs (6.2% of 145 workflows). After detailed investigation of each workflow, I found that:

• 8 workflows legitimately don't need safe-outputs (test workflows, example workflows, or read-only operations)
• 1 workflow genuinely needed the fix: notion-issue-summary.md

Workflows Without Safe-Outputs - Analysis

Workflow	Needs Fix?	Reason
chroma-issue-indexer.md	❌	Read-only workflow, only indexes to database
codex-github-remote-mcp-test.md	❌	Test workflow, no GitHub writes
example-custom-error-patterns.md	❌	Example workflow for documentation
example-permissions-warning.md	❌	Example workflow for documentation
firewall.md	❌	Test workflow for network firewall
metrics-collector.md	❌	Stores to repo-memory, no GitHub writes
test-workflow.md	❌	Basic test workflow
test-yaml-import.md	❌	Test workflow for imports
notion-issue-summary.md	✅	FIXED - Creates comments but was missing safe-outputs

Changes Made

Modified File: .github/workflows/notion-issue-summary.md

Added safe-outputs configuration:

safe-outputs:
  add-comment:
    max: 1

Rationale: This workflow analyzes issues and creates summaries as comments, but was missing the safe-outputs configuration needed to properly integrate with the safe-outputs framework. This fix ensures the workflow can create comments through the structured safe-outputs pipeline.

Other Audit Findings Investigated

Network Security ✅ Already Configured

Workflows using web-fetch or external network access already have proper network: allowed: configuration with explicit domain allow-lists. No changes needed.

Examples:

• cli-version-checker.md: allowed: [defaults, node, "api.github.com", "ghcr.io"]
• cli-consistency-checker.md: allowed: [defaults, node, "api.github.com"]

MCP Server Adoption ✅ Acceptable

Low MCP adoption (2.8% - only 4 workflows) is intentional and acceptable. Most workflows work perfectly with built-in tools. MCP servers add complexity and should only be used when specialized capabilities are needed.

Runtime Metrics ⚠️ Cannot Fix in Workflows

The audit noted that runtime metrics are unavailable due to missing gh CLI authentication. This is an infrastructure/CI configuration issue, not something that can be fixed in workflow files.

Validation

✅ Changes compiled and validated locally
✅ Only modified the workflow that genuinely needed safe-outputs
✅ No unnecessary changes to working configurations
✅ Minimal, surgical fix addressing the actual issue

Expected Improvements

• Completes safe-outputs migration for the 1 workflow that needed it
• Increases safe-outputs coverage from 93.8% to 94.5% (137/145 workflows)
• Documents why other workflows legitimately don't use safe-outputs

References

• Audit Report: Discussion #13735
• Triggering Command: /q fix from @pelikhan
• Run ID: ${{ github.run_id }}

---

This is a targeted, minimal fix based on thorough investigation of the audit findings. Only 1 of the 9 workflows flagged actually needed safe-outputs - the other 8 are legitimately configured for their specific use cases (tests, examples, read-only operations).

AI generated by Q

• expires on Feb 6, 2026, 1:53 PM UTC

---

Note

This was originally intended as a pull request, but the git push operation failed.

Workflow Run: View run details and download patch artifact

The patch file is available in the agent-artifacts artifact in the workflow run linked above.

To apply the patch locally:

# Download the artifact from the workflow run https://github.com/github/gh-aw/actions/runs/21673890388
# (Use GitHub MCP tools if gh CLI is not available)
gh run download 21673890388 -n agent-artifacts

# The patch file will be at agent-artifacts/tmp/gh-aw/aw.patch after download
# Apply the patch
git am agent-artifacts/tmp/gh-aw/aw.patch

Show patch (36 lines)

From ead6ccf98a11b5f331724d222bda72d095f5ecfb Mon Sep 17 00:00:00 2001
From: Q Workflow Optimizer <q-workflow-optimizer@github.com>
Date: Wed, 4 Feb 2026 13:51:28 +0000
Subject: [PATCH] fix: add safe-outputs to notion-issue-summary workflow

The notion-issue-summary workflow creates comments but was missing
safe-outputs configuration. This adds the required safe-outputs
configuration to ensure proper integration with the safe-outputs
framework.

Addresses finding from workflow audit report (discussion #13735)
showing 9 workflows without safe-outputs. Investigation revealed
8 are legitimately without safe-outputs (test/example workflows),
and only this one needed the fix.
---
 .github/workflows/notion-issue-summary.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/notion-issue-summary.md b/.github/workflows/notion-issue-summary.md
index aeb594f..039f1b9 100644
--- a/.github/workflows/notion-issue-summary.md
+++ b/.github/workflows/notion-issue-summary.md
@@ -16,6 +16,9 @@ tools:
   github:
 imports:
   - shared/mcp/notion.md
+safe-outputs:
+  add-comment:
+    max: 1
 strict: true
 ---
 
-- 
2.52.0