Beginnings or multi repo PR support

[dsyme]

• Investigate CI failure in safe_outputs_handlers.test.cjs
• Fix failing test: update assertion from "not found" to "not in the allowed-repos list" since the allowed-repos validation now runs before workspace checkout validation
• Remove stale details field assertions that no longer apply to the allowed-repos error path
• Verify test passes locally

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[kdehl16-web]

Please work it

[kdehl16-web]

Fix the failed workflows (maybe in next commit)

[kdehl16-web]

[kdehl16-web]

Why...

[github-actions]

Hey @dsyme 👋 — the multi-repo PR support work here is a solid start! The new dynamic_checkout.cjs and find_repo_checkout.cjs modules are well-structured, the repo field addition to safe_outputs_tools.json is a clean schema extension, and the accompanying JS and Go tests are a great foundation.

A couple of things to address before this can move out of draft:

• Add a PR description — the body is currently empty. A short summary of what the feature enables (multi-repo checkout during a single workflow run), why it's needed, and what "beginnings" means (what's still TODO) would unblock reviewers immediately.
• Run make agent-finish — CI checks haven't passed yet. Per the project's development process, make agent-finish (build, test, lint, recompile, fmt, lint-errors) must all pass before a PR is ready for review.

When you're ready to finish this up, you can assign this prompt to your coding agent:

This is a draft PR (#18599 in github/gh-aw) adding the beginnings of multi-repo PR support to the safe-outputs create_pull_request handler.

Please complete the following:

1. Read the diff for PR #18599 to understand the full set of changes:
   - dynamic_checkout.cjs — new module for switching git checkout between repos dynamically
   - find_repo_checkout.cjs — new module for locating the correct checkout for a target repo
   - safe_outputs_handlers.cjs — updated to wire in the multi-repo checkout manager
   - create_pull_request.cjs — updated to use the checkout manager per-message
   - safe_outputs_tools.json (both copies) — added optional `repo` field to create_pull_request tool schema
   - pkg/workflow/safe_outputs_config_helpers.go — new Go-side helpers for safe_outputs config
   - Various test files for the above

2. Write a clear PR body covering:
   - What feature this adds (multi-repo PR support via dynamic git checkout)
   - Why it's needed (current limitation: single-repo checkout per workflow run)
   - Which files were added/changed and their roles
   - Known gaps / what "beginnings" means — what is still TODO or not yet implemented
   - Any testing notes or caveats

3. Run `make agent-finish` to validate that build, tests, lint, recompile, and fmt all pass. Fix any failures found.

4. Update the PR body using: gh pr edit 18599 --body "..."

Generated by Contribution Check

[kdehl16-web]

Pls fix conflicts

[dsyme]

@copilot fix the test failing in CI

[Copilot]

Fixed in 511404c. The test was checking for "not found" in the error message, but after adding the allowed-repos validation (which runs before the workspace checkout check), the actual error is now "not in the allowed-repos list". Updated the assertions to match the current behavior.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/github/gh-aw/contents/.github%2Fworkflows%2Faudit-workflows.md
  • Triggering command: /opt/hostedtoolcache/node/24.13.1/x64/bin/node /opt/hostedtoolcache/node/24.13.1/x64/bin/node --conditions node --conditions development --experimental-import-meta-resolve --require /home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/vitest/suppress-warnings.cjs /home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/vitest/dist/workers/forks.js m ode_modules/.bin--verify git push�� -u origin ache/node/24.13.1/x64/bin/git l8nEE git run-script/lib/node-gyp-bin/git git (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)