Fix safe_outputs: add missing set_issue_type to runtime tools JSON and fix reply_to_pr_review_comment smoke test

[Copilot]

Two independent failures in the safe_outputs job caused by a missing tool definition and an incorrect prompt instruction.

Root Causes

set_issue_type unavailable at runtime — the tool was added to pkg/workflow/js/safe_outputs_tools.json (compiler/prompt generation) but never synced to actions/setup/js/safe_outputs_tools.json (MCP server runtime). The agent correctly reported it missing even though it was configured in the workflow's safe-outputs config.

reply_to_pull_request_review_comment failed with "Parent comment not found" — the smoke test prompt told the agent to use the comment_id returned by create_pull_request_review_comment, but that handler buffers comments and returns { result: "success" } (no ID). Real GitHub comment IDs only exist after the review is finalized at the end of all message processing — after reply messages have already been submitted.

Changes

• actions/setup/js/safe_outputs_tools.json: Add set_issue_type tool definition, matching pkg/workflow/js/safe_outputs_tools.json. These two files must be kept in sync — one drives compilation/prompts, the other is deployed to the runner for the MCP server.

• .github/workflows/smoke-copilot.md: Fix step 12 — instead of using the (nonexistent) comment_id from create_pull_request_review_comment, instruct the agent to call pull_request_read with method: "get_review_comments" to fetch real comment IDs, then reply to the most recent one. Falls back gracefully if no review comments exist on the PR.

• .github/workflows/smoke-copilot.lock.yml: Recompiled.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw g/constants/cons/home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/.bin/pre�� g/workflow/compi--write g/workflow/compi**/*.cjs g/wo�� ath ../../../.pr**/*.json g/workflow/push_--ignore-path /usr/local/sbin/../../../.prettierignore http.https://gitsh (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw g/constants/cons/home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/.bin/pre�� g/workflow/compi--write g/workflow/compi**/*.cjs g/wo�� ath ../../../.pr**/*.json g/workflow/push_--ignore-path 0/x64/bin/bash http.https://gitsh (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
• https://api.github.com/orgs/test-owner/actions/secrets
  • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/xGO111MODULE env 9597149/b385/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE bagabas/go-udiffenv GOMODCACHE go (http block)
• https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
  • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha -unreachable=false /tmp/go-build1533630128/b112/vet.cfg /usr/bin/git ith-tools.md lint:cjs 64/bin/go git rev-�� --show-toplevel sh /usr/bin/git "prettier" --chegit bash 64/bin/go git (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v3
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/link -o ons-test3205935448 -importcfg /usr/bin/git l -w -buildmode=exe git (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v5
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env 5/001/test-simple-frontmatter.md tants_test.go x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel go /opt/hostedtoolcache/node/24.14.0/x64/bin/node -m -json 64/bin/go /opt/hostedtoolcache/node/24.14.0/x64/bin/node /tmp�� secrets.TOKEN go /usr/bin/git -json GO111MODULE x_amd64/compile git (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git -json GO111MODULE ache/go/1.25.0/x--show-toplevel git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE .cfg git (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v6
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel ache/go/1.25.0/xGO111MODULE /usr/bin/git 9597149/b403/_pkgit GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git tv6X/i4YisyJT10-git GO111MODULE 64/bin/go git (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha xterm-color go ache/node/24.14.0/x64/bin/node -json GO111MODULE 64/bin/go ache/node/24.14.0/x64/bin/node 1318�� xterm-color go /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel go /usr/bin/git y.md GO111MODULE sole.test git rev-�� --show-toplevel sole.test /usr/bin/git -json GO111MODULE ache/go/1.25.0/x--show-toplevel git (http block)
• https://api.github.com/repos/actions/github-script/git/ref/tags/v8
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE erignore env e=false GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha ck 'scripts/**/*GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node (http block)
• https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha /repos/github/gh-aw/git/ref/tags/v2.0.0 l /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
• https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha xterm-color go ache/node/24.14.0/x64/bin/node -json GO111MODULE 64/bin/go ache/node/24.14.0/x64/bin/node 6205�� /tmp/TestHashStability_SameInputSameOutput2785433834/001/stability-test.md go /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
• https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq .object.sha k/gh-aw/gh-aw/actions/setup/js/add_workflow_run_comment.cjs k/gh-aw/gh-aw/actions/setup/js/safe_outputs_mcp_schema_validation.test.cjs $name) { hasDiscussionsEnabled } } (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq .object.sha ./../pkg/workflo-f k/gh-aw/gh-aw/acowner=github $name) { hasDiscussionsEnabled } } (http block)
• https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
  • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json l /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha tions/setup/js/safe_outputs_mcp_error_messages.test.cjs tions/setup/js/markdown_code_region_balancer.test.cjs tions/setup/js/safe_outputs_tools_loader.test.cjs tions/setup/js/msh tions/setup/js/a-c tions/setup/js/c"prettier" --write '../../../**/*.json' '!../../../pkg/workflow/js/**/*.json' --ignore-path ../../../.prettierignore tions/setup/js/mcp-scripts-REDACTED.test.cjs tion�� ll 2>&1 tions/setup/js/safe_outputs_mcp_schema_validation.test.cjs ep (http block)
• https://api.github.com/repos/github/gh-aw
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility on' --ignore-path ../../../.pret.prettierignore (http block)
• https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE (http block)
• https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env ithub-script/git/ref/tags/v8 GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
  • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
  • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
  • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
  • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
  • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE rk/cnjHJRsC75-1TI1_m0Vn/cSPgOA5Ap48bvsu2kY9H (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
  • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
  • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/github/gh-aw/actions/workflows
  • Triggering command: /usr/bin/gh gh workflow list --json name,state,path GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/xGO111MODULE env 9597149/b392/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE b/gh-aw/pkg/envuenv GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE go env ofBl/7Q8SO1ccHSWGOSUMDB GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 9597149/b398/importcfg (http block)
  • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha ty-test.md GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha 9597149/b384/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env cOlg/hXvQD2gGBBS-errorsas GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 9597149/b384/impconfig (http block)
• https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node (http block)
• https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node (http block)
• https://api.github.com/repos/githubnext/agentics/git/ref/tags/
  • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha re --log-level=error credential.helper tnet/tools/bash (http block)
• https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
  • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env 2222310216/.github/workflows GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/nonexistent/repo/actions/runs/12345
  • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/owner/repo/actions/workflows
  • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/xGO111MODULE env 9597149/b398/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/xGO111MODULE env 9597149/b404/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE b/gh-aw/pkg/repo--norc GOMODCACHE go (http block)
• https://api.github.com/repos/owner/repo/contents/file.md
  • Triggering command: /tmp/go-build1533630128/b383/cli.test /tmp/go-build1533630128/b383/cli.test -test.testlogfile=/tmp/go-build1533630128/b383/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE go m/_n�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/test-owner/test-repo/actions/secrets
  • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/xGO111MODULE env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Fix the failing GitHub Actions workflow safe_outputs
Analyze the workflow logs, identify the root cause of the failure, and implement a fix.
Job ID: 67434358513
Job URL: https://github.com/github/gh-aw/actions/runs/23203502701/job/67434358513

---

📱 Kick off Copilot coding agent tasks wherever you are with GitHub Mobile, available on iOS and Android.

[github-actions]

Hey @Copilot 👋 — great investigation on the two safe_outputs failures! The root cause analysis is sharp and the fixes for set_issue_type and the reply_to_pull_request_review_comment smoke test instruction are well-reasoned.

A couple of things worth addressing before this is ready for review:

• Unfocused diff — the PR title itself flags these as "two independent failures", which is a signal they'd be cleaner as two separate PRs. Keeping them together makes it harder for reviewers to reason about each fix in isolation, and if one needs to be reverted it takes the other with it.

• Undescribed changes in smoke-copilot.lock.yml — the PR body says the lock file was simply "Recompiled", but the diff also adds || inputs.item_number as a fallback for GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER in three places (two existing steps and one new env: block on the github-script step). These are functional changes — not just recompilation artifacts — and they aren't explained in the Root Causes or Changes sections. A reviewer can't evaluate whether this is correct without knowing why inputs.item_number needs to be the fallback here.

If you'd like a hand cleaning this up, you can assign this prompt to your coding agent:

This PR (github/gh-aw#21421) bundles two independent fixes for the `safe_outputs` job and also includes undescribed functional changes in the lock file. Please:

1. Split the PR into two focused PRs:
   - PR A: Add the missing `set_issue_type` tool definition to `actions/setup/js/safe_outputs_tools.json` (sync it with `pkg/workflow/js/safe_outputs_tools.json`).
   - PR B: Fix the `reply_to_pull_request_review_comment` smoke test in `.github/workflows/smoke-copilot.md` (step 12) and recompile the lock file.

2. For PR B, also document the `|| inputs.item_number` fallback changes in `smoke-copilot.lock.yml`:
   - Add a third root cause / change entry explaining why `inputs.item_number` is needed as a fallback for `GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER`.
   - If these changes originated from the recompilation of `smoke-copilot.md`, confirm that — otherwise describe the bug they fix.

3. Ensure each PR targets the correct base branch and both PR descriptions follow the Root Causes / Changes format already used in #21421.

Generated by Contribution Check · ◷

[Copilot]

Pull request overview

Fixes two safe_outputs job failures by syncing a missing runtime tool definition and correcting the smoke-test instructions for replying to PR review comments.

Changes:

• Added the missing set_issue_type tool definition to the runtime actions/setup/js/safe_outputs_tools.json.
• Updated the smoke test prompt to fetch real review comment IDs via pull_request_read(get_review_comments) before replying.
• Recompiled .github/workflows/smoke-copilot.lock.yml (includes updated PR-number env fallback).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
actions/setup/js/safe_outputs_tools.json	Adds set_issue_type to the runtime tool list so it’s available during execution.
.github/workflows/smoke-copilot.md	Fixes PR review reply instructions to avoid relying on a non-returned comment_id.
.github/workflows/smoke-copilot.lock.yml	Recompiled workflow output reflecting updated prompt/env behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[lpcox]

@copilot create a new PR with this fix