fix: propagate environment: frontmatter field to all safe-output jobs#20384
Merged
fix: propagate environment: frontmatter field to all safe-output jobs#20384
environment: frontmatter field to all safe-output jobs#20384Conversation
…ts-environment-field) Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix environment frontmatter propagation to safe_outputs job
fix: propagate Mar 10, 2026
environment: frontmatter field to safe_outputs job
Contributor
|
@copilot apply to pr jobs too |
… pre_activation, safe-jobs, upload_assets) Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in 597a0c9. The environment is now propagated to all compiler-generated safe-output jobs: Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Copilot
AI
changed the title
fix: propagate
fix: propagate Mar 10, 2026
environment: frontmatter field to safe_outputs jobenvironment: frontmatter field to all safe-output jobs
Contributor
There was a problem hiding this comment.
Pull request overview
This PR ensures the workflow-level environment: context is propagated to all compiler-generated safe-output jobs so environment-scoped secrets are available outside the agent job, with support for an explicit safe-outputs.environment override.
Changes:
- Add
SafeOutputsConfig.Environmentand parsesafe-outputs.environmentfrom frontmatter. - Introduce
resolveSafeOutputsEnvironment()and apply the resolved environment to all safe-output job builders (safe_outputs,conclusion,pre_activation, custom safe-jobs, and jobs created viabuildSafeOutputJob). - Extend schema to allow
safe-outputs.environmentand add an integration test covering propagation tosafe_outputs.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/safe_outputs_jobs.go | Applies resolved environment to jobs built via buildSafeOutputJob. |
| pkg/workflow/safe_outputs_config.go | Extracts/parses safe-outputs.environment from frontmatter into config. |
| pkg/workflow/safe_jobs.go | Applies resolved environment to custom safe-jobs (safe-outputs.jobs). |
| pkg/workflow/notify_comment.go | Applies resolved environment to the conclusion job. |
| pkg/workflow/environment_test.go | Adds an integration test asserting env propagation to safe_outputs. |
| pkg/workflow/compiler_types.go | Adds Environment field to SafeOutputsConfig. |
| pkg/workflow/compiler_safe_outputs_job.go | Adds resolveSafeOutputsEnvironment() and applies env to safe_outputs. |
| pkg/workflow/compiler_pre_activation_job.go | Applies resolved environment to pre_activation job. |
| pkg/parser/schemas/main_workflow_schema.json | Allows environment under safe-outputs in schema. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
| "examples": ["my-workflow-safe-outputs", "safe-outputs-${{ github.repository }}"] | ||
| }, | ||
| "environment": { | ||
| "description": "Override the GitHub deployment environment for the safe-outputs job. When set, this environment is used instead of the top-level environment: field. When not set, the top-level environment: field is propagated automatically so that environment-scoped secrets are accessible in the safe-outputs job.", |
There was a problem hiding this comment.
The schema description says the safe-outputs.environment override (and top-level propagation) applies to the “safe-outputs job”, but the implementation applies it to all safe-output jobs (including conclusion, pre_activation, upload_assets, and custom safe-jobs). Please update the description to match the implemented behavior so users aren’t surprised by environment protections/secret scoping across those jobs.
Suggested change
| "description": "Override the GitHub deployment environment for the safe-outputs job. When set, this environment is used instead of the top-level environment: field. When not set, the top-level environment: field is propagated automatically so that environment-scoped secrets are accessible in the safe-outputs job.", | |
| "description": "Override the GitHub deployment environment for all safe-output jobs (including the main safe-outputs job, conclusion, pre_activation, upload_assets, and any custom safe-output jobs). When set, this environment is used instead of the top-level environment: field. When not set, the top-level environment: field is propagated automatically so that environment-scoped secrets are accessible across all safe-output jobs.", |
Comment on lines
+227
to
+233
| // TestSafeOutputsEnvironmentPropagation verifies that the top-level environment: field is | ||
| // propagated to the safe_outputs job so that environment-scoped secrets are accessible. | ||
| func TestSafeOutputsEnvironmentPropagation(t *testing.T) { | ||
| tests := []struct { | ||
| name string | ||
| frontmatter string | ||
| expectEnvInSafe bool |
There was a problem hiding this comment.
This test only asserts environment propagation for the safe_outputs job, but the PR also adds environment propagation to other generated safe-output jobs (e.g., conclusion, pre_activation, upload_assets, and custom safe-jobs). Please extend test coverage to assert at least one additional job (conclusion or pre_activation) receives the resolved environment, so future changes don’t regress propagation on those jobs silently.
| Steps []any `yaml:"steps,omitempty"` // User-provided steps injected after setup/checkout and before safe-output code | ||
| IDToken *string `yaml:"id-token,omitempty"` // Override id-token permission: "write" to force-add, "none" to disable auto-detection | ||
| ConcurrencyGroup string `yaml:"concurrency-group,omitempty"` // Concurrency group for the safe-outputs job (cancel-in-progress is always false) | ||
| Environment string `yaml:"environment,omitempty"` // Override the GitHub deployment environment for the safe-outputs job (defaults to the top-level environment: field) |
There was a problem hiding this comment.
The new SafeOutputsConfig.Environment field/comment says it overrides the environment for the “safe-outputs job”, but this PR applies the resolved environment to multiple safe-output jobs (safe_outputs, conclusion, pre_activation, buildSafeOutputJob jobs, and custom safe-jobs). Please update the field comment to reflect that it overrides the deployment environment for all safe-output jobs (or adjust behavior to match the comment).
Suggested change
| Environment string `yaml:"environment,omitempty"` // Override the GitHub deployment environment for the safe-outputs job (defaults to the top-level environment: field) | |
| Environment string `yaml:"environment,omitempty"` // Override the GitHub deployment environment for all safe-output jobs (defaults to the top-level environment: field) |
Comment on lines
+509
to
+512
| // Handle environment configuration (override for safe-outputs job; falls back to top-level environment) | ||
| config.Environment = c.extractTopLevelYAMLSection(outputMap, "environment") | ||
| if config.Environment != "" { | ||
| safeOutputsConfigLog.Printf("Configured environment override for safe-outputs job: %s", config.Environment) |
There was a problem hiding this comment.
This log message and nearby comment refer to an environment override “for safe-outputs job”, but the resolved environment is used for all safe-output jobs in this PR. Please adjust wording to avoid misleading operators when reading logs/debugging.
Suggested change
| // Handle environment configuration (override for safe-outputs job; falls back to top-level environment) | |
| config.Environment = c.extractTopLevelYAMLSection(outputMap, "environment") | |
| if config.Environment != "" { | |
| safeOutputsConfigLog.Printf("Configured environment override for safe-outputs job: %s", config.Environment) | |
| // Handle environment configuration (override for all safe-outputs jobs; falls back to top-level environment) | |
| config.Environment = c.extractTopLevelYAMLSection(outputMap, "environment") | |
| if config.Environment != "" { | |
| safeOutputsConfigLog.Printf("Configured environment override for all safe-outputs jobs: %s", config.Environment) |
github-actions bot
added a commit
that referenced
this pull request
Mar 11, 2026
Add reference section for the `safe-outputs.environment:` frontmatter field, which allows specifying a deployment environment for all compiler-generated safe-output jobs. The top-level `environment:` field is now automatically propagated to safe-output jobs; this new field allows overriding it independently. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
pelikhan
pushed a commit
that referenced
this pull request
Mar 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
environment:frontmatter field was only applied to theagentjob. All other compiler-generated jobs ran without any environment context, making environment-scoped secrets (e.g., GitHub App credentials for token minting) silently inaccessible.Changes
SafeOutputsConfig: AddedEnvironmentfield to support an explicit per-job environment override (safe-outputs.environment:)safe_outputs_config.go: Parsesenvironmentfrom thesafe-outputsmap (string orname/urlobject, consistent with top-level field)compiler_safe_outputs_job.go: AddedresolveSafeOutputsEnvironment()helper that usessafe-outputs.environmentif set, otherwise falls back to the top-levelenvironment:value. Applies to thesafe_outputsjob.notify_comment.go: Applies resolved environment to theconclusionjobsafe_outputs_jobs.go: Applies resolved environment to jobs built viabuildSafeOutputJob(e.g.upload_assets)safe_jobs.go: Applies resolved environment to custom safe-jobs (safe-outputs.jobs)compiler_pre_activation_job.go: Applies resolved environment to thepre_activationjobmain_workflow_schema.json: Addsenvironmentas an allowed property undersafe-outputsBehavior
All compiler-generated safe-output jobs (
safe_outputs,conclusion,pre_activation, custom safe-jobs,upload_assets) will now include the environment field:🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.