Conversation
…_review Adds cross-repository support to `submit_pull_request_review` to fix PR review submission failing with 404 in cross-repo workflows. - Add `TargetRepoSlug` and `AllowedRepos` fields to `SubmitPullRequestReviewConfig` - Parse `target-repo` and `allowed-repos` in `parseSubmitPullRequestReviewConfig` - Update compiler config to include new fields in handler config output - Update JS handler to use `resolveTargetRepoConfig`/`resolveAndValidateRepo` - Update TypeScript types to add `target`, `target-repo`, `allowed-repos` fields - Add cross-repo tests in JS and Go test files - Update documentation in safe-outputs.md Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix submit_pull_request_review for target-repo support
fix: add target-repo support to submit_pull_request_review for cross-repo workflows
Mar 12, 2026
Contributor
|
@copilot compare to other handlers and ensure the implementation is similar |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot stopped work on behalf of
pelikhan due to an error
March 12, 2026 14:50
Contributor
|
@copilot keep working |
Contributor
Author
Done — the Go struct now embeds Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
There was a problem hiding this comment.
Pull request overview
Adds target-repo and allowed-repos support to the submit_pull_request_review safe output handler, enabling cross-repository PR review submission workflows. This brings it to parity with other handlers like create-pull-request-review-comment.
Changes:
- Added
SafeOutputTargetConfig(withTargetRepoSlugandAllowedRepos) to the Go config struct and parser, plus compiler config emission - Updated the JS handler to use
resolveTargetRepoConfigandresolveAndValidateRepofor repo resolution instead of hardcodedcontext.repo - Added TypeScript types, tests, and documentation for the new fields
Reviewed changes
Copilot reviewed 6 out of 7 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/submit_pr_review.go | Embed SafeOutputTargetConfig and parse target-repo/allowed-repos |
| pkg/workflow/compiler_safe_outputs_config.go | Emit target-repo and allowed_repos into handler config JSON |
| actions/setup/js/submit_pr_review.cjs | Use repo helpers for cross-repo resolution instead of context.repo |
| actions/setup/js/submit_pr_review.test.cjs | Add tests for cross-repo review submission and rejection |
| actions/setup/js/types/safe-outputs-config.d.ts | Add new optional fields to TS type |
| pkg/workflow/submit_pr_review_footer_test.go | Add Go tests for new config fields |
| docs/src/content/docs/reference/safe-outputs.md | Document new fields |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
submit_pull_request_reviewlackedtarget-repo/allowed-repossupport, causing it to always resolve the repository fromcontext.repo(the provider) rather than the actual PR repository (the consumer), resulting in 404s in cross-repo review flows.Changes
submit_pr_review.go): AddedTargetRepoSlugandAllowedReposfields toSubmitPullRequestReviewConfig; parsing uses the sharedparseTargetRepoWithValidation/parseAllowedReposFromConfighelperscompiler_safe_outputs_config.go): Emittarget-repoandallowed_reposinto the handler config, matching the pattern used bycreate_pull_request_review_commentsubmit_pr_review.cjs): Replaced hardcodedcontext.repowithresolveTargetRepoConfig+resolveAndValidateRepofromrepo_helpers.cjs; PR fetch now targets the configured repotarget,target-repo,allowed-repostoSubmitPullRequestReviewConfigsafe-outputs.mdto document the new fields, matching parity withcreate-pull-request-review-commentExample
Without
target-repo, behavior is unchanged — falls back toGITHUB_REPOSITORY.Warning
Firewall rules blocked me from connecting to one or more addresses (expand for details)
I tried to connect to the following addresses, but was blocked by firewall rules:
https://api.github.com/graphql/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -trimpath 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git(http block)/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GO111MODULE ache/go/1.25.0/x--show-toplevel git rev-�� --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile /usr/bin/git 10 GO111MODULE Name,path,createdAt,startedAt,up--show-toplevel git(http block)/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GO111MODULE 0/x64/bin/node git rev-�� --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/cgo /usr/bin/git vaScript17602633gcc GO111MODULE /opt/hostedtoolc-x git(http block)https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1/usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --get remote.origin.url ache/node/24.14.0/x64/bin/node 804ceef7674f520egit GO111MODULE 64/bin/go ache/node/24.14.0/x64/bin/node -366�� --show-current ache/go/1.25.0/x-importcfg /usr/bin/git 9132361/b417/_pkgit GO111MODULE 64/bin/go git(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v3/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha Cn_Y/5B4iLiQEF4sALTzcCn_Y(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v5/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ndor/bin/bash GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha /tmp/TestHashConsistency_KeyOrdering2993831380/001/test2.md go /usr/bin/git JRst/OFrQgiGYGecgit GO111MODULE 64/bin/go git rev-�� --show-toplevel 9132361/b374/importcfg /usr/bin/git k/gh-aw/gh-aw/cmgit k/gh-aw/gh-aw/cmrev-parse 64/bin/go git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel go /usr/bin/git tants.go tants_test.go 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/compile r: $owner, name: $name) { hasDiscussionsEnabled } } g_.a GO111MODULE ache/go/1.25.0/x--show-toplevel git(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v6/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel -tests /tmp/go-build1696284940/b413/repoutil.test -json GO111MODULE 64/bin/go /tmp/go-build1696284940/b413/repoutil.test -tes�� -test.paniconexit0 -test.v=true /usr/bin/git -test.timeout=10git -test.run=^Test -test.short=true--show-toplevel git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha ry=1 6284940/b422/_testmain.go 6284940/b436/_pkg_.a remote.origin.urgit -nolocalimports -importcfg git rev-�� --show-toplevel -pack ache/node/24.14.0/x64/bin/node d/gh-aw/main.go GO111MODULE 64/bin/go ache/node/24.14.0/x64/bin/node(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE ache/go/1.25.0/x--show-toplevel git(http block)https://api.github.com/repos/actions/github-script/git/ref/tags/v8/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha 1WLZb6UPh GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE ortcfg env 35126d5394e2a1caGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x-buildtags(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env ck '**/*.cjs' '*GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/actions/setup-go/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha k/gh-aw/gh-aw/pkg/styles/theme.go k/gh-aw/gh-aw/pkg/styles/theme_test.go /opt/hostedtoolcache/node/24.14.0/x64/bin/node -json GO111MODULE 64/bin/go node /tmp�� /tmp/TestHashConsistency_GoAndJavaScript176026337/001/test-empty-frontmatter.md go /tmp/go-build1696284940/b428/timeutil.test ck '**/*.cjs' '*git GO111MODULE 64/bin/go /tmp/go-build1696284940/b428/timeutil.test(http block)https://api.github.com/repos/actions/setup-node/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha /tmp/gh-aw-test-runs/20260312-140824-41881/test-3357570995/.github/workflows rev-parse /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/compile -json GO111MODULE 64/bin/go /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/compile -o /tmp/go-build1696284940/b418/_pkg_.a -trimpath /usr/bin/git -p github.com/githurev-parse -lang=go1.25 git(http block)https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha blog-auditor.md g/sliceutil/sliceutil_test.go 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env 6284940/b416/_pkg_.a .cfg 6284940/b416=> GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b/usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet /usr/bin/git SameOutput209514git GO111MODULE 0/x64/bin/node git rev-�� --show-toplevel go /usr/bin/git orts3640137033/0git GO111MODULE(http block)https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts/usr/bin/gh gh run download 1 --dir test-logs/run-1 go x_amd64/vet tierignore GO111MODULE 64/bin/go x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts/usr/bin/gh gh run download 12345 --dir test-logs/run-12345 scripts/**/*.js x_amd64/vet -d GO111MODULE 64/bin/go x_amd64/vet env ty-test.md GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts/usr/bin/gh gh run download 12346 --dir test-logs/run-12346 scripts/**/*.js 64/bin/go -d GO111MODULE 64/bin/go go estl�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts/usr/bin/gh gh run download 2 --dir test-logs/run-2 GOMOD 64/bin/go tierignore GO111MODULE 64/bin/go go estl�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts/usr/bin/gh gh run download 3 --dir test-logs/run-3 go x_amd64/link -d GO111MODULE 64/bin/go x_amd64/link env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 0B/BbpKnpOfd46pb4kTgHEs/EiezGfJK--jq(http block)https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts/usr/bin/gh gh run download 4 --dir test-logs/run-4 GOMOD 64/bin/go -d GO111MODULE 64/bin/go go estl�� ty-test.md GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts/usr/bin/gh gh run download 5 --dir test-logs/run-5 GOCACHE 64/bin/go tierignore GO111MODULE 64/bin/go go estl�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/workflows/usr/bin/gh gh workflow list --json name,state,path -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/a70c5eada06553e3510ac27f2c3bda9d3705bccb/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/a70c5eada06553e3510ac27f2c3bda9d3705bccb --jq .object.sha --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE erignore env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE erignore env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha ck '**/*.cjs' '*GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env e=false GO111MODULE 64/bin/go GOINSECURE %H %ct %D c9da5bcd95dfd607/tmp/gh-aw-test-runs/20260312-140824-41881/test-608256366/.github/workflows go(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE erignore env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/githubnext/agentics/git/ref/tags//usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha --show-toplevel 64/pkg/tool/linu1 /usr/bin/git 6284940/b413/rep/opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/link .cfg 6284940/b413/importcfg.link git rev-�� --show-toplevel gUIYjN6c4lmkV/4fownHncp26b6DL2LBDN/N6GE9dzJuLpfUe9tz4e_/aZSvDGNgremote.origin.url /usr/bin/git ithub-script/git/usr/bin/gh GO111MODULE ache/go/1.25.0/xgraphql git(http block)https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999/usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 0XVD7GS/mRL0tEU7JbrieQ94-F8q env 1079857865/.github/workflows GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/nonexistent/repo/actions/runs/12345/usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion -p main -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/owner/repo/actions/workflows/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE go env heck '**/*.cjs' GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/owner/repo/contents/file.md/tmp/go-build1696284940/b383/cli.test /tmp/go-build1696284940/b383/cli.test -test.testlogfile=/tmp/go-build1696284940/b383/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/test-owner/test-repo/actions/secrets/usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)If you need me to access, download, or install something from one of these locations, you can either:
🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.