Fix safe-outputs message parsing and schema gaps for detection-failure and agent-failure-*

pkg/parser/schemas/main_workflow_schema.json

@@ -6378,6 +6378,16 @@
               "description": "Custom message template for detection job failure. Available placeholders: {workflow_name}, {run_url}. Default: '\u26a0\ufe0f Security scanning failed for [{workflow_name}]({run_url}). Review the logs for details.'",
               "examples": ["\u26a0\ufe0f Security scanning failed for [{workflow_name}]({run_url}). Review the logs for details.", "\u26a0\ufe0f Detection job failed in [{workflow_name}]({run_url})."]
             },
+            "agent-failure-issue": {
+              "type": "string",
+              "description": "Custom footer template for agent failure tracking issues. Available placeholders: {workflow_name}, {run_url}. Default: '> Agent failure tracked by [{workflow_name}]({run_url})'",
+              "examples": ["> Agent failure tracked by [{workflow_name}]({run_url})", "> Failure report from [{workflow_name}]({run_url})"]
+            },
+            "agent-failure-comment": {
+              "type": "string",
+              "description": "Custom footer template for comments on agent failure tracking issues. Available placeholders: {workflow_name}, {run_url}. Default: '> Agent failure update from [{workflow_name}]({run_url})'",
+              "examples": ["> Agent failure update from [{workflow_name}]({run_url})", "> Update from [{workflow_name}]({run_url})"]
+            },
             "append-only-comments": {
               "type": "boolean",
               "description": "When enabled, workflow completion notifier creates a new comment instead of editing the activation comment. Creates an append-only timeline of workflow runs. Default: false",

pkg/workflow/imports.go

@@ -683,6 +683,15 @@ func mergeMessagesConfig(result, imported *SafeOutputMessagesConfig) *SafeOutput
 	if result.RunFailure == "" && imported.RunFailure != "" {
 		result.RunFailure = imported.RunFailure
 	}
+	if result.DetectionFailure == "" && imported.DetectionFailure != "" {
+		result.DetectionFailure = imported.DetectionFailure
+	}
+	if result.AgentFailureIssue == "" && imported.AgentFailureIssue != "" {
+		result.AgentFailureIssue = imported.AgentFailureIssue
+	}
+	if result.AgentFailureComment == "" && imported.AgentFailureComment != "" {
+		result.AgentFailureComment = imported.AgentFailureComment
+	}
 	if !result.AppendOnlyComments && imported.AppendOnlyComments {
 		result.AppendOnlyComments = imported.AppendOnlyComments
 	}

pkg/workflow/safe_outputs_config_messages.go

@@ -79,6 +79,24 @@ func parseMessagesConfig(messagesMap map[string]any) *SafeOutputMessagesConfig {
 		}
 	}
 
+	if detectionFailure, exists := messagesMap["detection-failure"]; exists {
+		if detectionFailureStr, ok := detectionFailure.(string); ok {
+			config.DetectionFailure = detectionFailureStr
+		}
+	}
+
+	if agentFailureIssue, exists := messagesMap["agent-failure-issue"]; exists {
+		if agentFailureIssueStr, ok := agentFailureIssue.(string); ok {
+			config.AgentFailureIssue = agentFailureIssueStr
+		}
+	}
+
+	if agentFailureComment, exists := messagesMap["agent-failure-comment"]; exists {
+		if agentFailureCommentStr, ok := agentFailureComment.(string); ok {
+			config.AgentFailureComment = agentFailureCommentStr
+		}
+	}
+
 	return config
 }