[WIP] Fix missing GitHub Project URL in workflow

[Copilot]

Fix missing GH_AW_PROJECT_URL for missing_data handler ✅

Problem

The missing_data safe output handler doesn't have access to GH_AW_PROJECT_URL environment variable when the workflow has a project: configured in frontmatter. This caused issues when the agent tried to record missing data about the GitHub Project URL itself, as described in workflow run: https://github.com/githubnext/gh-aw/actions/runs/21527086220/job/62033708029

Root Cause

GH_AW_PROJECT_URL was only added to the "Process Project-Related Safe Outputs" step but NOT to the "Process Safe Outputs" step where missing_data (and other non-project safe outputs) are handled.

Solution

• Understand the issue and locate relevant code
• Add GH_AW_PROJECT_URL to the main safe outputs handler step
• Add test coverage for the new behavior
• Verify the fix compiles workflows correctly
• Run linting and formatting
• Run unit tests (all pass)
• Code review (no issues found)
• Security scan (no vulnerabilities)

Changes Made

1. pkg/workflow/compiler_safe_outputs_steps.go: Added GH_AW_PROJECT_URL environment variable to the buildHandlerManagerStep function (lines 185-191), making it available to all safe output handlers
2. pkg/workflow/compiler_safe_outputs_steps_test.go: Added test case "handler manager with project URL from frontmatter" to verify that GH_AW_PROJECT_URL is included when a workflow has a project configured
3. Recompiled workflows: Updated .github/workflows/dependabot-burner.lock.yml to include the new environment variable in the "Process Safe Outputs" step

Impact

• ✅ All safe output handlers now have access to the default project URL when configured
• ✅ The missing_data handler can now properly reference the project URL when recording missing data
• ✅ Maintains consistency across all safe output handlers
• ✅ No breaking changes - adds functionality without changing existing behavior

Verification

# Compiled workflow now includes GH_AW_PROJECT_URL in Process Safe Outputs step
grep -A 5 "Process Safe Outputs" .github/workflows/dependabot-burner.lock.yml
# Shows: GH_AW_PROJECT_URL: "https://github.com/orgs/githubnext/projects/144"

Security Summary

✅ No vulnerabilities found by CodeQL security scanner

Original prompt

Fix issue in run: https://github.com/githubnext/gh-aw/actions/runs/21527086220/job/62033708029
Recorded missing data: GitHub Project URL
Reason: Need to know which GitHub Project board to add Dependabot PRs and bundle issues to
Context: Campaign orchestrator requires a GitHub Project URL to track Dependabot PRs and bundle issues
Alternatives: Provide PROJECT_URL environment variable or specify project URL in workflow configuration

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.