Fix empty GITHUB_AW_AGENT_OUTPUT in safe output jobs

[Copilot]

Problem

Safe output jobs (create-issue, add-comment, create-pull-request, etc.) were failing silently because the GITHUB_AW_AGENT_OUTPUT environment variable was empty. This caused JavaScript scripts to exit early without processing agent output.

The issue was observed in workflow run #18596819745 where the create-issue job logged:

No GITHUB_AW_AGENT_OUTPUT environment variable found

Root Cause

GitHub Actions was masking the job output with the message:

##[warning]Skip output 'output' since it may contain secret.

Safe output jobs were attempting to read agent output using:

env:
  GITHUB_AW_AGENT_OUTPUT: ${{ needs.agent.outputs.output }}

This resulted in an empty value because GitHub Actions security features prevent outputs that might contain sensitive data from being passed between jobs.

Solution

Modified safe output jobs to download the agent_output.json artifact that's already uploaded by the agent job, following the same pattern used by custom safe-jobs:

Before:

- name: Create Output Issue
  env:
    GITHUB_AW_AGENT_OUTPUT: ${{ needs.agent.outputs.output }}  # Empty!

After:

- name: Download agent output artifact
  uses: actions/download-artifact@v5
  with:
    name: agent_output.json
    path: /tmp/gh-aw/safe-outputs/

- name: Setup agent output environment variable
  run: |
    echo "GITHUB_AW_AGENT_OUTPUT=/tmp/gh-aw/safe-outputs/agent_output.json" >> $GITHUB_ENV

- name: Create Output Issue
  env:
    GITHUB_AW_AGENT_OUTPUT: ${{ env.GITHUB_AW_AGENT_OUTPUT }}  # Points to file!

Changes

• Modified buildGitHubScriptStep() in pkg/workflow/safe_output_helpers.go to add artifact download steps before GitHub Script execution
• Created new buildAgentOutputDownloadSteps() helper function that generates the download and environment setup steps
• Updated all safe output job tests to expect the new artifact download pattern
• Recompiled all 64 workflows to include the artifact download steps

Impact

• Fixes safe output jobs that rely on agent output (create-issue, add-comment, create-pull-request, etc.)
• Ensures reliable access to agent output regardless of GitHub Actions output size limits or security masking
• Maintains consistency with the existing safe-jobs pattern
• No breaking changes to workflow syntax or user-facing behavior

Testing

• ✅ All unit tests passing
• ✅ All integration tests passing
• ✅ Manual verification with test workflows
• ✅ All 64 production workflows recompiled successfully

Original prompt

Investigate why GH_AW_ACTION_OUTPUT is empty in create-issue.

https://github.com/githubnext/gh-aw/actions/runs/18596819745

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[github-actions]

Agentic Changeset Generator triggered by this pull request.