fix: cross-repo create-pull-request checkout ignores triggering branch ref

pkg/workflow/compiler_safe_outputs_steps.go

@@ -72,10 +72,18 @@ func (c *Compiler) buildSharedPRCheckoutSteps(data *WorkflowData) []string {
 	// targeting.  Then a lot of this gnarly event code will be only on the "front end" (prepping the
 	// coding agent) not the "backend" (applying the safe outputs)
 	const baseBranchFallbackExpr = "${{ github.base_ref || github.event.pull_request.base.ref || github.ref_name || github.event.repository.default_branch }}"
+	// Cross-repo fallback omits github.ref_name because it refers to the branch in the triggering repository,
+	// which may not exist in the target repository (e.g., when triggered via workflow_dispatch from a feature branch).
+	const crossRepoFallbackExpr = "${{ github.base_ref || github.event.pull_request.base.ref || github.event.repository.default_branch }}"
 	var checkoutRef string
 	if data.SafeOutputs.CreatePullRequests != nil && data.SafeOutputs.CreatePullRequests.BaseBranch != "" {
 		checkoutRef = data.SafeOutputs.CreatePullRequests.BaseBranch
 		consolidatedSafeOutputsStepsLog.Printf("Using custom base-branch from create-pull-request for checkout ref: %s", checkoutRef)
+	} else if targetRepoSlug != "" {
+		// Cross-repo checkout: avoid github.ref_name which refers to the triggering branch,
+		// not a branch in the target repository.
+		checkoutRef = crossRepoFallbackExpr
+		consolidatedSafeOutputsStepsLog.Printf("Using cross-repo fallback base branch expression for checkout ref (no github.ref_name)")
 	} else {
 		checkoutRef = baseBranchFallbackExpr
 		consolidatedSafeOutputsStepsLog.Printf("Using fallback base branch expression for checkout ref")

pkg/workflow/compiler_safe_outputs_steps_test.go

@@ -13,11 +13,12 @@ import (
 // TestBuildSharedPRCheckoutSteps tests shared PR checkout step generation
 func TestBuildSharedPRCheckoutSteps(t *testing.T) {
 	tests := []struct {
-		name          string
-		safeOutputs   *SafeOutputsConfig
-		trialMode     bool
-		trialRepo     string
-		checkContains []string
+		name             string
+		safeOutputs      *SafeOutputsConfig
+		trialMode        bool
+		trialRepo        string
+		checkContains    []string
+		checkNotContains []string
 	}{
 		{
 			name: "create pull request only",
@@ -120,6 +121,46 @@ func TestBuildSharedPRCheckoutSteps(t *testing.T) {
 				"token: ${{ secrets.GH_AW_CROSS_REPO_PAT }}",
 				"GIT_TOKEN: ${{ secrets.GH_AW_CROSS_REPO_PAT }}",
 				`REPO_NAME: "org/target-repo"`,
+				// Cross-repo checkout must not use github.ref_name
+				"ref: ${{ github.base_ref || github.event.pull_request.base.ref || github.event.repository.default_branch }}",
+			},
+		},
+		{
+			name: "cross-repo without base-branch uses safe ref omitting github.ref_name",
+			safeOutputs: &SafeOutputsConfig{
+				CreatePullRequests: &CreatePullRequestsConfig{
+					TargetRepoSlug: "org/other-repo",
+				},
+			},
+			checkContains: []string{
+				"ref: ${{ github.base_ref || github.event.pull_request.base.ref || github.event.repository.default_branch }}",
+			},
+			checkNotContains: []string{
+				"github.ref_name",
+			},
+		},
+		{
+			name:      "trial mode cross-repo omits github.ref_name from checkout ref",
+			trialMode: true,
+			trialRepo: "org/trial-repo",
+			safeOutputs: &SafeOutputsConfig{
+				CreatePullRequests: &CreatePullRequestsConfig{},
+			},
+			checkContains: []string{
+				"repository: org/trial-repo",
+				"ref: ${{ github.base_ref || github.event.pull_request.base.ref || github.event.repository.default_branch }}",
+			},
+		},
+		{
+			name: "cross-repo with explicit base-branch uses base-branch not cross-repo fallback",
+			safeOutputs: &SafeOutputsConfig{
+				CreatePullRequests: &CreatePullRequestsConfig{
+					TargetRepoSlug: "org/other-repo",
+					BaseBranch:     "develop",
+				},
+			},
+			checkContains: []string{
+				"ref: develop",
 			},
 		},
 		{
@@ -212,6 +253,10 @@ func TestBuildSharedPRCheckoutSteps(t *testing.T) {
 			for _, expected := range tt.checkContains {
 				assert.Contains(t, stepsContent, expected, "Expected to find: "+expected)
 			}
+
+			for _, notExpected := range tt.checkNotContains {
+				assert.NotContains(t, stepsContent, notExpected, "Expected NOT to find: "+notExpected)
+			}
 		})
 	}
 }