fix: quality gate review approval + cron enable

[microsasa]

Problem

The quality gate adds the aw-quality-gate-approved label successfully but fails to post the APPROVE review that triggers auto-merge. PRs #171 and #172 are both stuck on this right now.

Root cause: submit_pull_request_review safe output was configured with target: "*", but its tool schema has no pull_request_number field — the agent can't specify which PR to review. The handler logs:

Target is "*" but no pull_request_number specified in PR review item
No review context set - cannot submit review

Per gh-aw docs: for workflow_dispatch triggers, set target to the actual input value (e.g. ${{ inputs.pr_number }}), not "*".

Changes

Quality Gate (.md + .lock.yml)

• submit-pull-request-review: target: "*" → target: ${{ inputs.pr_number }}
• close-pull-request: same fix
• add-comment: same fix
• add-labels: kept as target: "*" — its handler has item_number field, resolves differently
• All changes compiled via gh aw compile

Orchestrator (pipeline-orchestrator.yml)

• Enabled 5-minute cron schedule. Public repo — Actions minutes are unlimited. Cron catches new aw-labeled issues when pipeline is idle.

Docs

• Changelog: quality gate fix + cron enable
• Pitfall [aw][test audit] Test gaps: session detail rendering — failed tools, unknown events, hours-range durations #18: updated with target: ${{ inputs.pr_number }} guidance
• Pitfall [aw][code health] README project structure diagram shows wrong path for developer docs #21 (new): safe output target values differ by handler type
• History: 2026-03-19/20 entry covering autonomous PRs, quality gate fix, cron
• Agent table: updated triggers for quality gate and orchestrator

Testing

Tested from branch via gh workflow run quality-gate.lock.yml -f pr_number=167 --ref fix/quality-gate-review-approval:

• ✅ submit_pull_request_review posted APPROVE review successfully
• ✅ PR fix: use format_tokens() in render_live_sessions (#133) #167 auto-merged
• ❌ add_labels failed with target: ${{ inputs.pr_number }} (no item_number) — fixed by switching to target: "*"

Fixes #168
Closes #135
Related: #165, #164, #173

[Copilot]

Pull request overview

Fixes the autonomous pipeline’s quality-gate approval path by ensuring safe-output handlers can correctly resolve PR context when the workflow is triggered via workflow_dispatch, and enables periodic orchestration via cron.

Changes:

• Updated Quality Gate safe-outputs target to use ${{ inputs.pr_number }} for handlers that can’t infer PR context from target: "*".
• Enabled a 5-minute cron schedule for the pipeline orchestrator.
• Updated docs/changelog to document the pitfall and the operational changes.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
docs/changelog.md	Adds an entry documenting the quality-gate dispatch/approval fix and cron enablement.
docs/agentic-workflows.md	Updates safe-output target guidance and agent inventory/history notes.
.github/workflows/quality-gate.md	Fixes safe-output target values to correctly bind actions to ${{ inputs.pr_number }}.
.github/workflows/quality-gate.lock.yml	Regenerates compiled workflow with updated safe-output target configuration.
.github/workflows/pipeline-orchestrator.yml	Enables schedule trigger to run every 5 minutes.

Comments suppressed due to low confidence (1)

.github/workflows/pipeline-orchestrator.yml:56

• The workflow is now triggered by schedule, but the jobs.orchestrate.if condition doesn’t allow github.event_name == 'schedule', so cron-triggered runs will be skipped and the new schedule will never execute. Update the job-level if to include the schedule event (and ensure any schedule-specific paths behave as intended).

  schedule:
    - cron: "*/5 * * * *"

concurrency:
  group: pipeline-orchestrator
  cancel-in-progress: true

permissions:
  contents: write
  pull-requests: write
  issues: write
  actions: write

jobs:
  orchestrate:
    runs-on: ubuntu-latest
    # Skip pull_request_review unless PR has aw label
    if: >-
      github.event_name == 'workflow_dispatch' ||
      github.event_name == 'push' ||
      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion != 'cancelled') ||
      (github.event_name == 'pull_request_review' && contains(github.event.pull_request.labels.*.name, 'aw'))

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.