[safeoutputs] Clarify update_issue target-dependent behavior in tool description

[Copilot]

Agents were providing issue_number to update_issue in scheduled/dispatch workflows expecting it to route to that issue, but it's silently ignored when the workflow uses target: triggering (the default). The tool gave no feedback — it returned {"result":"success"} before the safe_outputs job ran and failed.

Changes

• pkg/workflow/js/safe_outputs_tools.json and actions/setup/js/safe_outputs_tools.json:
  • Top-level description: Added IMPORTANT: note clarifying that behavior is gated on update-issue: target: config, and that the tool fails (not silently skips) when target: triggering has no triggering issue.
  • issue_number field description: Replaced "Required when target is '*'" with explicit language that the field is ONLY effective under target: '*', and is ignored under the default target: triggering.

Before:

Issue number to update. ... Required when the workflow target is '*' (any issue).

After:

Issue number to update. ... ONLY effective when the workflow is configured with
`update-issue: target: '*'` in the frontmatter. When the workflow uses `target: triggering`
(the default), this field is ignored and the tool updates the issue that triggered the
workflow instead. If you need to update a specific issue in a scheduled or
workflow_dispatch workflow, the workflow frontmatter must include `update-issue: target: '*'`.

All 177 workflow lock files recompiled with the updated tool descriptions.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw 5j80nW5ZGZRC (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw rev-parse 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git om/aymanbagabas/git om/aymanbagabas/rev-parse 64/pkg/tool/linu--show-toplevel git (http block)
• https://api.github.com/orgs/test-owner/actions/secrets
  • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name ithub/workflows HEAD ode_modules/.bin-lang=go1.16 (http block)
• https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
  • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel x_amd64/vet /usr/bin/git '**/*.ts' '**/*.git (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v3
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha 6211480/b436/stringutil.test -buildtags 6211480/b436/importcfg.link -errorsas -ifaceassert -nilfunc vsiWHJxF12LLI/8MBkAlss8NoqMJPDT0us/3YdcVDbgE0y5Gdx8vjli/alK5YuEv-extld=gcc -tes�� ry=1 -test.v=true 6211480/b436/_pkg_.a -test.timeout=10git -test.run=^Test -test.short=true--show-toplevel git (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v5
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha /home/REDACTED/work/gh-aw/gh-aw/.g-errorsas config 64/pkg/tool/linux_amd64/vet remote.origin.ur/opt/hostedtoolcache/node/24.14.0/x64/bin/node (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha REDACTED.os x_amd64/vet /usr/bin/git *.json' '!../../git --log-level x_amd64/link git rev-�� --show-toplevel x_amd64/link /usr/bin/infocmp /home/REDACTED/worgit .cfg 64/pkg/tool/linu--show-toplevel infocmp (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet /usr/bin/git se 6211480/b209/vetrev-parse ache/go/1.25.0/x--show-toplevel git rev-�� --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet /usr/bin/git k/gh-aw/gh-aw/pkgit ../../../**/*.jsrev-parse (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v6
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --get remote.origin.url /usr/bin/git ithub/workflows (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha -bool -buildtags /usr/bin/git -errorsas -ifaceassert -nilfunc git -C /tmp/gh-aw-test-runs/20260323-162742-14800/test-3980692566 rev-parse /usr/bin/git @{u} c x_amd64/vet git (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/link /usr/bin/git hutil.test 6211480/b037/vetrev-parse ortcfg.link git rev-�� --show-toplevel dwFO3cBOLj36ZOwlHC/wPHmRHH07drGoremote.origin.url /usr/bin/git "prettier" --wrigit (http block)
• https://api.github.com/repos/actions/github-script/git/ref/tags/v8
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha ithub/workflows origin /opt/hostedtoolc-nilfunc (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha json' --ignore-p-errorsas (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha --noprofile (http block)
• https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha test/concurrent-image:v1.0.0 bash (http block)
• https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha rhysd/actionlint:latest bash /usr/bin/git ithub/workflows (http block)
• https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
  • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha 6211480/b433/sliceutil.test /tmp/go-build3746211480/b121/vet.cfg 0/x64/bin/node (http block)
• https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha (http block)
• https://api.github.com/repos/github/gh-aw
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility (http block)
• https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha 2742-14800/test-3980692566 /tmp/go-build3746211480/b100/vet.cfg 6211480/b365/vet.cfg l --global de /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet -uns�� k/gh-aw/gh-aw/.github/workflows /tmp/go-build3746211480/b254/vet.cfg ache/node/24.14.0/x64/bin/node ithub/workflows --local p/bin/bash /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
• https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha -unreachable=false /tmp/go-build3746211480/b034/vet.cfg 6211480/b364/vet.cfg /home/REDACTED/worgit (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
  • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
  • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
  • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 rev-parse x_amd64/compile ignore (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
  • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
  • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 -f 64/pkg/tool/linux_amd64/vet ignore owner=github -f 64/pkg/tool/linux_amd64/vet -u rite '**/*.cjs' '**/*.ts' '**/*.json' --ignore-p-errorsas .cfg 64/pkg/tool/linux_amd64/vet (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
  • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 config 64/pkg/tool/linux_amd64/vet ignore (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
  • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 -f 64/pkg/tool/linux_amd64/vet ignore owner=github -f 64/pkg/tool/linutest@example.com -w rite '**/*.cjs' '**/*.ts' '**/*.json' --ignore-path ../../../.pr**/*.json .cfg 64/pkg/tool/linux_amd64/vet OUTPUT -d 168.63.129.16 64/pkg/tool/linux_amd64/vet (http block)
• https://api.github.com/repos/github/gh-aw/actions/workflows
  • Triggering command: /usr/bin/gh gh workflow list --json name,state,path ithub/workflows HEAD ode_modules/.bin/sh (http block)
  • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 (http block)
  • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 (http block)
• https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha ty-test.md .cfg 64/pkg/tool/linux_amd64/vet remote.origin.urgit (http block)
• https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha k/gh-aw/gh-aw/.github/workflows (http block)
• https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha ithub/workflows (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha th .prettierigno-errorsas origin ode_modules/.bin-nilfunc l (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha th .prettierignore --log-level=error origin /opt/hostedtoolcache/go/1.25.0/x64/bin/bash (http block)
• https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha th .prettierigno-errorsas (http block)
• https://api.github.com/repos/githubnext/agentics/git/ref/tags/
  • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha (http block)
• https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
  • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha k/gh-aw/gh-aw/.g@{u} .cfg 64/pkg/tool/linux_amd64/vet l (http block)
• https://api.github.com/repos/nonexistent/repo/actions/runs/12345
  • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion nore (http block)
• https://api.github.com/repos/owner/repo/actions/workflows
  • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo me: String!) { repository(owner: $owner, name:168.63.129.16 (http block)
  • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo /opt/hostedtoolcache/uv/0.10.12/x86_64/git (http block)
• https://api.github.com/repos/owner/repo/contents/file.md
  • Triggering command: /tmp/go-build3746211480/b400/cli.test /tmp/go-build3746211480/b400/cli.test -test.testlogfile=/tmp/go-build3746211480/b400/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true (http block)
• https://api.github.com/repos/test-owner/test-repo/actions/secrets
  • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name ithub/workflows origin /usr/local/sbin/-lang=go1.25 (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.

[Copilot]

Pull request overview

Clarifies how the update_issue safe-outputs tool routes updates depending on the workflow’s update-issue: target: configuration, to prevent agents from assuming issue_number will be honored under the default target: triggering.

Changes:

• Added an IMPORTANT: note to update_issue tool descriptions explaining target: triggering vs target: '*' behavior and failure mode when there’s no triggering issue.
• Updated the issue_number field description to explicitly state it is only effective under target: '*' and ignored under target: triggering.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
pkg/workflow/js/safe_outputs_tools.json	Expands update_issue and issue_number descriptions to document target-dependent routing behavior.
actions/setup/js/safe_outputs_tools.json	Adds the same target-dependent clarification to the runtime tool schema copy used by setup/action scripts.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The update_issue tool description says it updates only “status, title, or body”, but this schema also exposes labels, assignees, and milestone (and operation). This mismatch can mislead agents about supported fields; update the description to reflect the full set of editable properties (or remove unsupported fields from the schema if intentional).

Suggested change

"description": "Update an existing GitHub issue's status, title, or body. Use this to modify issue properties after creation. Only the fields you specify will be updated; other fields remain unchanged. IMPORTANT: The behavior of this tool depends on the workflow's `update-issue: target:` configuration. When `target: triggering` (the default), the tool always updates the issue that triggered the workflow and `issue_number` is ignored. When `target: '*'`, the `issue_number` field controls which issue is updated. The tool will fail (not skip silently) when `target: triggering` and there is no triggering issue (e.g., in scheduled or workflow_dispatch workflows).",

"description": "Update an existing GitHub issue's status, title, body, labels, assignees, or milestone. Use this to modify issue properties after creation. Only the fields you specify will be updated; other fields remain unchanged. IMPORTANT: The behavior of this tool depends on the workflow's `update-issue: target:` configuration. When `target: triggering` (the default), the tool always updates the issue that triggered the workflow and `issue_number` is ignored. When `target: '*'`, the `issue_number` field controls which issue is updated. The tool will fail (not skip silently) when `target: triggering` and there is no triggering issue (e.g., in scheduled or workflow_dispatch workflows).",