fix: enforce draft as policy in create-pull-request, not agent-overridable fallback

[Copilot]

safe-outputs.create-pull-request.draft was treated as a default rather than a policy — the agent could include "draft": true in its message to bypass a draft: false config, violating the Layer 1 security architecture.

Changes

• create_pull_request.cjs: Always use draftDefault (from config); emit core.warning when the agent message contains a draft value that conflicts with config — consistent with how autoMerge and allowEmpty already work:

// Before — agent value wins
const draft = pullRequestItem.draft !== undefined ? pullRequestItem.draft : draftDefault;

// After — config is the policy
const draft = draftDefault;
if (pullRequestItem.draft !== undefined && pullRequestItem.draft !== draftDefault) {
  core.warning(`Agent requested draft: ${pullRequestItem.draft}, but configuration enforces draft: ${draftDefault}. ...`);
}

• create_pull_request.test.cjs: 5 integration tests calling main() end-to-end verifying github.rest.pulls.create receives the config-enforced draft value and that the warning fires only on genuine override attempts.

---

📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.

[Copilot]

Pull request overview

This PR ensures create-pull-request treats draft as a config-enforced policy (not an agent-overridable fallback) and adds end-to-end tests to prevent regressions.

Changes:

• Enforce draft strictly from config (draftDefault) and emit a warning when the agent attempts to override it.
• Add integration-style tests verifying github.rest.pulls.create receives the config-enforced draft value and that warnings only occur on override attempts.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
actions/setup/js/create_pull_request.cjs	Enforces config-controlled draft policy and warns on agent override attempts.
actions/setup/js/create_pull_request.test.cjs	Adds tests covering draft policy enforcement and warning behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

tempDir is created and cleaned up in this test suite, but it is never used (no files are written there and the process CWD isn’t changed). This adds unnecessary setup/teardown work and can be removed, or alternatively use it to write a real patch if the intent was to exercise the filesystem path.