fix: push-to-pull-request-branch default max should be 1, not 0

pkg/workflow/push_to_pull_request_branch_test.go

@@ -305,6 +305,12 @@ This workflow has minimal push-to-pull-request-branch configuration.
 	if !strings.Contains(lockContentStr, "contains(needs.agent.outputs.output_types, 'push_to_pull_request_branch')") {
 		t.Errorf("Generated workflow should have safe output type condition")
 	}
+
+	// Verify that the default max is 1 (not 0) when not explicitly set
+	if !strings.Contains(lockContentStr, `"push_to_pull_request_branch":{"max":1}`) &&
+		!strings.Contains(lockContentStr, `"push_to_pull_request_branch": {"max": 1}`) {
+		t.Errorf("Expected push_to_pull_request_branch default max to be 1, got content: %s", lockContentStr)
+	}
 }
 
 func TestPushToPullRequestBranchWithIfNoChangesError(t *testing.T) {

pkg/workflow/safe_outputs_config_generation.go

@@ -239,7 +239,7 @@ func generateSafeOutputsConfig(data *WorkflowData) string {
 		if data.SafeOutputs.PushToPullRequestBranch != nil {
 			safeOutputsConfig["push_to_pull_request_branch"] = generateMaxWithTargetConfig(
 				data.SafeOutputs.PushToPullRequestBranch.Max,
-				0, // default: unlimited
+				1, // default max: 1
 				data.SafeOutputs.PushToPullRequestBranch.Target,
 			)
 		}